Here's a script that will tell you which app is activating without telling you. I adapted it from an answer to @KevinReid's question over on Apple SE.
Leave it running in a terminal, wait for the rogue app to steal focus, and see which app is listed last. (For me: Google Drive. Others have reported Symantec AV stuff.)
#!/usr/bin/python try: from AppKit import NSWorkspace except ImportError: print "Can't import AppKit -- maybe you're running python from brew?" print "Try running with Apple's /usr/bin/python instead." exit(1) from datetime import datetime from time import sleep last_active_name = None while True: active_app = NSWorkspace.sharedWorkspace().activeApplication() if active_app['NSApplicationName'] != last_active_name: last_active_name = active_app['NSApplicationName'] print '%s: %s [%s]' % ( datetime.now().strftime('%Y-%m-%d %H:%M:%S'), active_app['NSApplicationName'], active_app['NSApplicationPath'] ) sleep(1)