You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Windows antivirus alert when running OpenCode. #8204
The current solution is to use the old version and disable any upgrades.
Alternatively, you can ignore the warnings from Windows Defender and continue using the system, but I do not recommend this approach.
It’s best to wait patiently for the author to fix this issue.
Alternatively, you can ignore the warnings from Windows Defender and continue using the system
Well... you can't ignore it. The DLL that triggers Windows Defender keeps changing name every time Windows Defender blocks it. It's kinda chicken & egg situation that prevents us from adding it into exclusions. You don't know the name of the DLL until you run OpenCode, and once you run it, Windows Defender blocks the file and removes it. And you can go in circles indefinitely.
The current solution is to use the old version and disable any upgrades. Alternatively, you can ignore the warnings from Windows Defender and continue using the system, but I do not recommend this approach. It’s best to wait patiently for the author to fix this issue.
What is the latest version that does not have this problem?
this just happened to me with the latest 1.1.23 version. downgrading to 1.1.20 makes the trojan alert go away.
npm install -g opencode-ai@1.1.20
i also note that opencode updates itself automaticaly to 1.1.23 when i ran it as 1.1.20. hows that? for now i can workaround that with npx opencode-ai@1.1.20
It's not just Windows Defender, it's Smart App Control that blocks the app from running. You also shouldn't disable Smart App Control because you cannot enable it again without doing a fresh Windows install.
I tried just disabling various Windows Defender features and some in Smart App Control and I cannot get opencode to work. Worked fine like 8-10 hours ago. I guess it got updated when I ran it now?
I've seen the team is working on code signing which should make things work fine so I guess we just have to wait in order to use latest version.
Using npx opencode-ai@1.1.21, or bunx opencode-ai@1.1.21 seems to work fine at the moment. If you work with opencode a lot in a single repo, I'd suggest installing it there as a dev dependency (e.g npm i -D opencode-ai@1.1.21) and then just doing npx opencode-ai in that folder so that you don't have to type the version each time.
I ran into this issue, reinstalled Windows, and it worked for a day, but now it’s back again. I have no idea what’s causing it. I also have two PCs—it works fine on one but not the other, which is really confusing.
Activity
github-actions commentedon Jan 13, 2026
This issue might be a duplicate of existing issues. Please check:
Trojan:Win32/Wacatac.H!mlwhen running opencode #7592: [False Positive?] Windows Defender detectsTrojan:Win32/Wacatac.H!mlwhen running opencodeFeel free to ignore if none of these address your specific case.
BaseBlank commentedon Jan 13, 2026
I encountered exactly the same bug.
Trojan:Script/Wacatac.C!ml
magicprinc commentedon Jan 13, 2026
any chance? 😭
BaseBlank commentedon Jan 13, 2026
The current solution is to use the old version and disable any upgrades.
Alternatively, you can ignore the warnings from Windows Defender and continue using the system, but I do not recommend this approach.
It’s best to wait patiently for the author to fix this issue.
okazakov commentedon Jan 14, 2026
Well... you can't ignore it. The DLL that triggers Windows Defender keeps changing name every time Windows Defender blocks it. It's kinda chicken & egg situation that prevents us from adding it into exclusions. You don't know the name of the DLL until you run OpenCode, and once you run it, Windows Defender blocks the file and removes it. And you can go in circles indefinitely.
norm2782 commentedon Jan 14, 2026
What is the latest version that does not have this problem?
vip32 commentedon Jan 15, 2026
this just happened to me with the latest 1.1.23 version. downgrading to 1.1.20 makes the trojan alert go away.
npm install -g opencode-ai@1.1.20i also note that opencode updates itself automaticaly to 1.1.23 when i ran it as 1.1.20. hows that? for now i can workaround that with
npx opencode-ai@1.1.20marko-hologram commentedon Jan 16, 2026
It's not just Windows Defender, it's Smart App Control that blocks the app from running. You also shouldn't disable Smart App Control because you cannot enable it again without doing a fresh Windows install.
I tried just disabling various Windows Defender features and some in Smart App Control and I cannot get opencode to work. Worked fine like 8-10 hours ago. I guess it got updated when I ran it now?
I've seen the team is working on code signing which should make things work fine so I guess we just have to wait in order to use latest version.
Using
npx opencode-ai@1.1.21, orbunx opencode-ai@1.1.21seems to work fine at the moment. If you work with opencode a lot in a single repo, I'd suggest installing it there as a dev dependency (e.gnpm i -D opencode-ai@1.1.21) and then just doingnpx opencode-aiin that folder so that you don't have to type the version each time.AamiRobin commentedon Jan 16, 2026
I ran into this issue, reinstalled Windows, and it worked for a day, but now it’s back again. I have no idea what’s causing it. I also have two PCs—it works fine on one but not the other, which is really confusing.
jMerta commentedon Jan 16, 2026
Happens to me on my corproate laptop when I finally got approved to use it through Copilot. :(
On personal works just fine.
vip32 commentedon Jan 16, 2026
same versions on both? as it seems the issues started or reappeared with 1.1.23
rekram1-node commentedon Jan 16, 2026
this will probably keep happening until we get through the code signing process
opencode has a few binary deps (opentui for example) and on first start extracts them to a tmp folder
unfortunately some virus protectors are treating this is always malicious behavior
jMerta commentedon Jan 16, 2026
Yes. On my personal windows machine im running 1.1.23 without alerts.
1.1.23 is completely blocked on work laptop. Reverting to 1.1.21 allowed me to start it.
boazcstrike commentedon Mar 6, 2026
I'm currently experiencing exactly the same warning and quarantine file from windows defender antivirus.
Hona commentedon Mar 29, 2026
As of OpenCode v1.3.4 across the CLI + Desktop apps, we have full code signing - so there should be no more warnings.
Please let me know otherwise
DerekLoadout commentedon Mar 30, 2026
1.3.7 it's back :D
Hona commentedon Mar 30, 2026
the AV warning?
desktop? cli?