What version of Codex is running?
codex-cli 0.21.0
Which model were you using?
N/A
What platform is your computer?
MINGW64_NT-10.0-26100 3.6.3-7674c51e.x86_64 x86_64 unknown
What steps can reproduce the bug?
- Install Codex CLI on Windows:
(also occurs if installed as a dependency; binary present under node_modules\@openai\codex\bin\)
2. Trigger a Defender scan (automatic real-time or manual quick/full scan).
3. Observe Defender alert quarantining:
Trojan:Win32/Wacatac.H!ml
This program is dangerous and executes commands from an attacker.
What is the expected behavior?
The Codex CLI binary should not be flagged by Windows Defender and should remain usable.
What do you see instead?
Microsoft Defender flags and quarantines the binary, breaking the CLI.
- CLI unusable on Windows unless the user manually restores/excludes the file (unsafe).
- May block CI/enterprise environments that rely on Defender defaults.
Additional information
program hash (exe / sha256):
9BF0F15354E6641F75CC83360415873C3678CE441DA3451CA402C22EC1BCABB1
What version of Codex is running?
codex-cli 0.21.0
Which model were you using?
N/A
What platform is your computer?
MINGW64_NT-10.0-26100 3.6.3-7674c51e.x86_64 x86_64 unknown
What steps can reproduce the bug?
(also occurs if installed as a dependency; binary present under
node_modules\@openai\codex\bin\)2. Trigger a Defender scan (automatic real-time or manual quick/full scan).
3. Observe Defender alert quarantining:
What is the expected behavior?
The Codex CLI binary should not be flagged by Windows Defender and should remain usable.
What do you see instead?
Microsoft Defender flags and quarantines the binary, breaking the CLI.
Additional information
program hash (exe / sha256):
9BF0F15354E6641F75CC83360415873C3678CE441DA3451CA402C22EC1BCABB1