Windows Defender flags unsigned codex-computer-use.exe command line as Trojan:Win32/ClickFix.DE!MTB #31419

Activity

1. github-actions

   added

   bugSomething isn't workingSomething isn't working

   appIssues related to the Codex desktop appIssues related to the Codex desktop app

   windows-osIssues related to Codex on Windows systemsIssues related to Codex on Windows systems

   computer-use

   safety-checkIssues related to safety and abuse checksIssues related to safety and abuse checks

   on Jul 7, 2026
2. github-actions commented on Jul 7, 2026

   

   github-actionsbot

   on Jul 7, 2026 – with GitHub Actions

   Contributor

   More actions

   Potential duplicates detected. Please review them and close your issue if it is a duplicate.

   • macOS detects Codex Computer Use.app as malware and deletes it! #31251

   Powered by Codex Action
3. laz-jamesfuller commented on Jul 7, 2026

   

   laz-jamesfuller

   on Jul 7, 2026

   Author

   More actions

   Reviewed #31251 and the issues it points to (#30972, #30608, #30298).

   I agree this is adjacent to the Computer Use signing / malware-detection cluster, so I added #31251 to the related list in the description.

   I am not closing this as a duplicate yet because the observed failure mode is different:

   • macOS detects Codex Computer Use.app as malware and deletes it! #31251 is macOS / XProtect / Gatekeeper deleting or blocking Codex Computer Use.app after an update.
   • This issue is Windows / Microsoft Defender flagging codex-computer-use.exe turn-ended ... as Trojan:Win32/ClickFix.DE!MTB.
   • The Windows helper binary checked locally as Authenticode status: NotSigned.
   • Clicking "Allow" in Windows Security persisted a Defender threat-ID default action for 2147932647, which is broader than a narrow helper-binary trust decision.

   The shared product ask is still signing / packaging / reputation hardening for the Computer Use helper across platforms. If maintainers prefer one umbrella issue for all Computer Use helper signing/reputation failures, I am fine with closing this after the Windows Defender-specific evidence is linked there.

   👍React with 👍2Reacted by Ocean Bennett and NERDHEAD
4. undergroundrap commented on Jul 13, 2026

   

   undergroundrap

   on Jul 13, 2026

   More actions

   Just wanted to chime in and confirm that this false positive (Trojan:Win32/ClickFix.DE!MTB on codex-computer-use.exe) appears to be resolved on my end now after updating Windows Defender. Looks like Microsoft cleared up the heuristic trigger!

   https://community.openai.com/t/windows-defender-flags-codex-computer-use-helper-as-trojan-win32-clickfix-de-mtb/1385584
5. undergroundrap commented on Jul 13, 2026

   

   undergroundrap

   on Jul 13, 2026

   More actions

   Another user in the same thread I made mentioned this too. I was curious if that also relates to all those 'want to send this file to Microsoft' spam notifications?

   
6. styler-ai commented on Jul 22, 2026

   

   styler-ai

   on Jul 22, 2026

   Last edited by styler-ai

   More actions

   Current deterministic reproduction and local forensic evidence (Windows, 2026-07-22)

   This remains reproducible with current Codex and Defender builds, including the Trojan:Win32/PowhidSubExec.B variant previously reported in #32343.

   Environment

   • Codex CLI 0.145.0 (the original blocked turn was recorded by CLI 0.144.1)
   • Codex Windows app 26.715.4045.0
   • Windows 10.0.26200.0 x64
   • PowerShell 7.6.4
   • Defender security intelligence 1.455.263.0 (updated 2026-07-21T22:58:42Z)
   • Defender threat ID 2147941383

   The relevant user-level configuration has this shape:

   notify = ["<Codex desktop runtime>\\codex-computer-use.exe", "turn-ended"]

   First detection: Codex-generated command wrapper

   A Codex agent generated a PowerShell wrapper around a benign local development test. The wrapper used a hidden child process, stdout/stderr redirection, and a two-hour timeout.

   Timeline from the Codex session and Defender Operational event log:

   • 2026-07-16T15:50:40.613Z: Codex issued the wrapper through its execution tool.
   • 2026-07-16T15:50:41.756Z: Defender event 1116 classified its command-line resource as Trojan:Win32/PowhidSubExec.B.
   • At the same instant, Codex received CreateProcess ... Access is denied (os error 5).
   • A process query immediately afterward found no matching test child process.
   • 2026-07-16T15:51:12.620Z: Defender event 1117 recorded Action: Remove, Action Status: No additional actions required, and error code 0x00000000.

   This establishes that Defender blocked process creation; there was no persistent Trojan file associated with that event. The affected resource was CmdLine, Process Name was Unknown, and Defender reported successful remediation.

   Deterministic text-only reproduction

   1. A later normal Codex thread contained the already-blocked PowerShell text solely for analysis. The text was not executed.
   2. When the turn completed, the configured notifier invoked codex-computer-use.exe turn-ended.
   3. The notifier command line contained serialized JSON with the full input-messages and last-assistant-message, including the inert PowerShell text.
   4. At 2026-07-22T11:36:42.410Z, Defender event 1116 raised the same PowhidSubExec.B detection against the notifier's CmdLine resource.
   5. Get-MpThreatDetection preserved the notifier JSON in the resource record, confirming that the suspicious-looking content was conversation data.
   6. At 2026-07-22T11:37:09.890Z, Defender event 1117 again recorded Remove and No additional actions required.

   The second event is the key reproduction: no suspicious script was run. Merely carrying its text in the turn-ended argv was enough to trigger the same signature.

   Local safety checks

   • No active PowhidSubExec.B threat is reported after remediation.
   • Defender real-time protection, behavior monitoring, network inspection, and tamper protection are enabled.
   • The currently installed Microsoft Store PowerShell executable has a valid Microsoft Authenticode signature.
   • The script contained no download, encoded payload, persistence mechanism, credential access, Defender modification, or external command source.

   Expected behavior

   • Do not place complete conversation contents in process arguments.
   • Pass the turn payload through stdin or authenticated IPC, or pass only thread/turn identifiers.
   • Prefer Codex's direct long-running execution/session mechanism over generating nested hidden PowerShell wrappers for ordinary development commands.
   • Keep normal turn completion from producing severe Defender detections or remediation actions.
   • Do not require users to create broad Defender exclusions for Codex, PowerShell, or their workspaces.

   A private /feedback diagnostic report was submitted separately. Public evidence here is intentionally stripped of usernames, repository names, local project paths, and unrelated session content.

   👍React with 👍1Reacted by daikanyama
7. daikanyama commented on Aug 19, 2026

   

   daikanyama

   on Aug 19, 2026

   More actions

   I’m experiencing the same issue on Windows 11.

   Microsoft Defender repeatedly detects:

   Trojan:Win32/ClickFix.DE!MTB

   Affected executable:
   %LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node...\codex-computer-use.exe

   The detection occurs around turn-ended / agent-turn-complete.

   Today, Defender detected it several times.

   I also uninstalled Codex and reinstalled the latest official version from the Microsoft Store, but the detection occurred again.

   I have NOT added any Defender exclusions and have NOT allowed the detected threat.

   The Defender command-line details contain Codex conversation history inside the JSON passed to codex-computer-use.exe, so I am not posting the full command line here for privacy reasons.

   Could you please confirm whether this is a known false positive and whether a fix is planned?

   👍React with 👍2Reacted by daikanyama and Campbell Reid
8. campbell-reid-displayr commented on Aug 20, 2026

   

   campbell-reid-displayr

   on Aug 20, 2026

   More actions

   I’m experiencing the same issue on Windows 11.

   Microsoft Defender repeatedly detects:

   Trojan:Win32/ClickFix.DE!MTB

   Affected executable: %LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node...\codex-computer-use.exe

   The detection occurs around turn-ended / agent-turn-complete.

   Today, Defender detected it several times.

   I also uninstalled Codex and reinstalled the latest official version from the Microsoft Store, but the detection occurred again.

   I have NOT added any Defender exclusions and have NOT allowed the detected threat.

   The Defender command-line details contain Codex conversation history inside the JSON passed to codex-computer-use.exe, so I am not posting the full command line here for privacy reasons.

   Could you please confirm whether this is a known false positive and whether a fix is planned?

   Just had this show up as well.

   👍React with 👍1Reacted by daikanyama
9. theblackjt commented on Sep 6, 2026

   

   theblackjt

   on Sep 6, 2026 – with ChatGPT Codex Connector

   More actions

   Additional redacted evidence from Codex Desktop on Windows (2026-09-06):

   Microsoft Defender raised the same detection twice:

   • Threat: Trojan:Win32/FileFix.BBA!MTB
   • Threat ID: 2147955906
   • Defender intelligence: 1.459.76.0
   • Defender engine: 1.1.26080.3

   First detection: a bundled, Microsoft-signed pwsh.exe was invoked with a long, benign verification script in -Command. The generated script embedded document strings directly in executable PowerShell source while reconstructing and hashing a prior text state.

   Second detection, about five minutes later: the bundled, validly OpenAI-signed codex-computer-use.exe was invoked as turn-ended {JSON...}. Its argv contained the complete recent input/assistant text, including the previously detected PowerShell command line, under the event payload's input messages. At this point the PowerShell text was inert JSON data, not executed by the helper, yet Defender raised the same signature again.

   Both alerts were remediated with Remove; no allow-list entry or Defender exclusion was created.

   This provides a useful content-controlled comparison: the same suspicious-looking text was detected once as executable command source and once merely because Codex Desktop transported it inside a process command line. It also means a single detection can cascade into another when the event helper repeats the full transcript through argv.

   Requested product changes:

   1. Do not pass full prompts, transcripts, tool commands, or assistant text through process arguments. Use stdin, a named pipe, or another bounded IPC channel for the turn-ended payload.
   2. Keep executable shell source separate from user/project data. Generated shell commands should use short fixed script bodies and pass content through typed parameters, files, or stdin.
   3. Add a Windows regression test in which a sentinel command-like string is present in a completed turn and verify that it never appears in the helper process command line.
   4. Preserve Defender and Smart App Control protections; the expected fix is product-side transport/data separation, not exclusions.

   Privacy note: paths, user/project names, thread/session IDs, screenshots, and original transcript content are intentionally omitted. No session is being shared.
10. ZFXzzz commented on Sep 13, 2026

    

    ZFXzzz

    on Sep 13, 2026

    More actions

    I’m seeing the same Microsoft Defender detection on Codex Desktop for Windows:

    • Detection: Trojan:Win32/ClickFix.DE!MTB
    • Threat ID: 2147932647
    • Detection time: 2026-09-14 06:04 (local time)
    • Status: Threat blocked; Windows Security reports that the threat or application was removed
    • Affected resource: a CmdLine entry under %LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node...@OAI\sky\bin\windows\codex-computer-use.exe
    • Trigger: occurred during normal Codex Computer Use activity, around agent-turn completion / turn-ended.

    For the exact helper file present on disk, Get-AuthenticodeSignature returned Valid, with signer OpenAI OpCo, LLC. I did not allow, restore, or exclude the detection, and I am not asserting that it is definitely a false positive.

    Please confirm whether this is a known Microsoft Defender heuristic issue for the Computer Use helper and whether any updated Codex/Defender build or recommended reporting path is available.
11. jtgreen4891-hub commented on Sep 29, 2026

    

    jtgreen4891-hub

    on Sep 29, 2026

    More actions

    I’m seeing a Windows Computer Use failure consistent with this issue.

    Environment:

    • Windows 10 build 19045
    • ChatGPT/Codex package 26.924.2738.0
    • Computer Use helper files are present
    • CodexSandboxService.OpenAI.Codex is installed and running

    Symptoms:

    • cua.getState() consistently returns apps: []
    • Browser control works, but native Windows applications are never visible
    • CryptoTool 2 is open manually but cannot be discovered or controlled
    • Initial Computer Use startup produced CreateProcessWithLogonW failed: 1056

    Troubleshooting performed:

    • Windows fully updated and rebooted
    • ChatGPT/Codex uninstalled and reinstalled
    • Dependencies reinstalled
    • ChatGPT repaired
    • Defender network permissions enabled
    • Codex sandbox service restarted
    • No active Defender ClickFix detection found

    Additional evidence:

    • The installed package declares Computer Use ports 1455 and 1457, but neither port listens after service restart.
    • Windows logs repeatedly show DCOM Local Activation permission-denied events involving the OpenAI Codex app container.

    Related issue: #31419. This appears to be a Windows sandbox/Computer Use endpoint startup failure rather than a CryptoTool or ordinary firewall issue.