diff --git a/cmd/tailscale/cli/file.go b/cmd/tailscale/cli/file.go
index 3197b3774..70aaac4eb 100644
--- a/cmd/tailscale/cli/file.go
+++ b/cmd/tailscale/cli/file.go
@@ -29,6 +29,7 @@ import (
 	"tailscale.com/client/tailscale"
 	"tailscale.com/client/tailscale/apitype"
 	"tailscale.com/ipn"
+	"tailscale.com/version"
 )
 
 var fileCmd = &ffcli.Command{
@@ -131,6 +132,9 @@ func runCp(ctx context.Context, args []string) error {
 		} else {
 			f, err := os.Open(fileArg)
 			if err != nil {
+				if version.IsSandboxedMacOS() {
+					return errors.New("the GUI version of Tailscale on macOS runs in a macOS sandbox that can't read files")
+				}
 				return err
 			}
 			defer f.Close()