Introduction

Killed: 9 in macOS Terminal means the process received signal 9, which is SIGKILL. That signal stops a process immediately, without letting it clean up or print a friendly error. The hard part is that SIGKILL is an effect, not a cause, so the real task is finding out who sent it and why.

What Signal 9 Means

Signal 9 is the non-catchable kill signal in Unix-like systems. If a process gets it, the process dies immediately.

That signal can come from:

• your own kill -9 command
• another privileged process
• the kernel under memory pressure
• a macOS security mechanism rejecting the process

So Killed: 9 is a symptom, not the diagnosis.

The Most Common Cause: Memory Pressure

One common cause is the operating system terminating a process because it is consuming too much memory. This is especially likely with browsers, machine learning tools, big compilers, or data-processing jobs.

Check memory pressure with Activity Monitor or from Terminal.

top -o mem

If the process dies when memory use spikes, the fix is usually to reduce memory demand, close other heavy apps, or use a smaller workload.

Check Whether You Sent the Signal Yourself

It sounds obvious, but sometimes the process was explicitly killed from another shell or script.

Look for commands such as:

kill -9 12345
pkill -9 myprocess

If the process is being managed by a script or supervisor, inspect that control path first before blaming macOS.

Security and Code-Signing Problems

On macOS, unsigned or quarantined binaries can also behave strangely. In some cases, the process starts and then gets terminated because the system does not trust the binary or its environment.

Check quarantine attributes:

xattr -l /path/to/your/binary

If you see quarantine metadata and you trust the binary, removing that attribute may be part of the fix.

xattr -d com.apple.quarantine /path/to/your/binary

Only do this when you know where the binary came from and why you trust it.

Look at macOS Logs

When the cause is not obvious, the system log is often more informative than the terminal message.

log show --last 5m --predicate 'eventMessage CONTAINS "killed"'

Or inspect the process name directly:

log show --last 5m --predicate 'eventMessage CONTAINS "your-process-name"'

This can reveal whether the process was terminated by memory pressure, policy enforcement, or another system component.

Architecture and Binary Compatibility Issues

On Apple Silicon Macs, some older binaries still depend on Rosetta or specific library combinations. A broken or incompatible binary can fail in ways that show up only as abrupt termination.

Check the binary architecture:

file /path/to/your/binary

If you are running an Intel-only binary on Apple Silicon, verify whether Rosetta is installed and whether the toolchain is actually compatible.

Shell Script and Permission Issues

Sometimes the thing being killed is not the final program, but a wrapper script or an interpreter child process. Confirm the exact executable path and permissions.

which python3
which node
ls -l /path/to/script.sh

If a script launches a different binary than you expect, the real problem may live one layer deeper than the shell command you typed.

Practical Fix Strategy

Use this order when debugging:

1. check whether memory pressure is the cause
2. check whether you or a supervisor sent SIGKILL
3. inspect macOS logs
4. verify the binary's architecture and trust state
5. reduce the workload or replace the problematic binary

That sequence is more reliable than guessing based only on the terminal message.

Common Pitfalls

• Treating Killed: 9 as if it were the root cause instead of the final symptom.
• Looking only at the terminal output and never checking system logs.
• Ignoring memory pressure when the failing process is large or data-heavy.
• Removing quarantine blindly without understanding the trust implications.
• Forgetting Apple Silicon versus Intel compatibility issues on newer Macs.

Summary

• 'Killed: 9 means the process received SIGKILL.'
• The usual causes are manual termination, memory pressure, or macOS policy/security enforcement.
• Activity Monitor, top, and log show are the fastest tools for diagnosis.
• Binary trust and architecture issues matter on modern macOS systems.
• Fix the underlying cause, because SIGKILL itself is only the final stop signal.