Windows Defender false positive: codex-x86_64-pc-windows-msvc.exe flagged as Trojan:Win32/Bearfoos.A!ml (v0.29.0) #3207

Activity

1. stryio

   added

   bugSomething isn't workingSomething isn't working

   on Sep 5, 2025
2. pakrym-oai

   added

   windows-osIssues related to Codex on Windows systemsIssues related to Codex on Windows systems

   on Sep 5, 2025
3. warmaster1884-crypto commented on Sep 5, 2025

   

   warmaster1884-crypto

   on Sep 5, 2025

   More actions

   Confirm it’s the same detection

   Alert name: Trojan:Win32/Bearfoos.A!ml (the !ml suffix means Defender’s ML heuristic, which is prone to false alarms).
   Microsoft
   Reddit

   Restore the file (if you’re comfortable)

   Windows Security → Virus & threat protection → Protection history → select the detection → Allow on device → then reinstall the CLI (npm i -g @openai/codex).

   If you’d rather not allow it, skip to step 4 (WSL workaround).
   (General background on similar false-positives and heuristics:
   Super User
   JUCE
   )

   Report the false positive to Microsoft (recommended)

   Submit the quarantined file to Microsoft Security Intelligence as a Software developer submission. This is the standard way to get Defender signatures corrected quickly.
   JUCE

   Workarounds that avoid the Windows .exe entirely

   Use WSL2: install and run Codex in your Linux subsystem (npm i -g @openai/codex) so Defender never touches the Windows EXE. (Codex CLI supports non-Windows environments well.)
   Hacker News

   Or temporarily pin an older version (e.g., npm i -g @openai/codex@0.28.x) if that version isn’t flagged on your machine. If it still flags, switch to WSL2.

   (Optional) Add a targeted Defender exclusion

   Exclude only the specific path to the Codex binary (e.g., %APPDATA%\npm\node_modules@openai\codex\bin\codex-x86_64-pc-windows-msvc.exe). Do this only if you’re comfortable with the security trade-off.
4. joasoze commented on Sep 10, 2025

   

   joasoze

   on Sep 10, 2025

   More actions

   I got this today, so no fix yet.
5. stryio commented on Sep 11, 2025

   

   stryio

   on Sep 11, 2025

   Author

   More actions

   The same issue occurs again, usually when writing a document it gets quarantined by Windows Defender.
   version 0.34.0
6. mirseo commented on Sep 11, 2025

   

   mirseo

   on Sep 11, 2025

   More actions

   I had the same issue today too. Windows Defender quarantined it as Trojan:Win32/Bearfoos.A!ml, and it's now been removed. It seems like there's no security problem for now, but I don't feel great about it. This is safe, right...?
7. warmaster1884-crypto commented on Sep 11, 2025

   

   warmaster1884-crypto

   on Sep 11, 2025

   More actions

   Yes — that’s the same detection:

   **⚠️ **

   • The “.A!ml” suffix means flagged it using its machine-learning heuristic rather than a known malware signature.
   • This type of detection is well known to produce false positives, especially with newly built binaries like the (@openai/codex) executable.
   • Multiple developers (like the one you quoted, “mirseo”) are reporting the same issue with version 0.34.0, which makes it even more likely this is a false positive, not an actual infection.

   ---

   ✅ What This Means for You

   • There is no confirmed security threat in the package — just that Defender is being overly cautious.
   • The CLI gets flagged when it writes or rebuilds parts of itself (such as when generating documents), which triggers heuristic suspicion.

   ---

   🛠 Your Options

   Option A — Restore and Continue (if you trust it):

   1. Open Windows Security → Virus & threat protection → Protection history

   2. Find the Bearfoos.A!ml entry

   3. Click Allow on device

   4. Reinstall:

      npm i -g @openai/codex

   Option B — Avoid Windows EXE entirely:

   • Install and run it inside (WSL2):

     npm i -g @openai/codex

   • Defender won’t scan Linux binaries, so it won’t get quarantined.

   Option C — Use an older version (if not flagged):

   npm i -g @openai/codex@0.28.x

   Option D — Report the false positive to Microsoft:

   • Submit the quarantined .exe to via their [ portal](https://www.microsoft.com/en-us/wdsi/filesubmission) (choose Software developer submission).

   ORRRRRR

   ⚙️ Fix Microsoft Defender False Positive (While Staying on Windows)

   Goal: Stop Defender from quarantining the Trojan:Win32/Bearfoos.A!ml false positive so the Codex CLI can run.

   🛠 Step 1 — Restore the quarantined file

   Open Windows Security

   Go to Virus & threat protection → Protection history

   Find the detection entry (Bearfoos.A!ml)

   Select it → Actions → Allow on device

   This tells Defender that the specific file is safe.

   🛠 Step 2 — Add a targeted exclusion

   Open Windows Security

   Go to Virus & threat protection → Manage settings → Exclusions

   Click Add an exclusion → Folder

   Add this folder (default global npm install path):

   %APPDATA%\npm\node_modules@openai\codex\bin

   This makes Defender ignore only that path without turning off your whole antivirus.

   🛠 Step 3 — Reinstall the CLI
   npm i -g @openai/codex

   After this, the binary won’t get flagged or deleted anymore, and development can continue normally on Windows.

   📝 (Optional) Step 4 — Report to Microsoft Security Intelligence

   Submit the quarantined .exe as a false positive (software developer submission)

   Submit here

   This will help get the signature fixed for everyone.

   ✅ Result: Defender stops quarantining the file, you stay on Windows, and development can continue normally.

   👍React with 👍1Reacted by JUN-HYEOK SEO
8. mirseo commented on Sep 11, 2025

   

   mirseo

   on Sep 11, 2025

   More actions

   Yes — that’s the same detection:

   **⚠️ **

   • The “.A!ml” suffix means flagged it using its machine-learning heuristic rather than a known malware signature.
   • This type of detection is well known to produce false positives, especially with newly built binaries like the (@openai/codex) executable.
   • Multiple developers (like the one you quoted, “mirseo”) are reporting the same issue with version 0.34.0, which makes it even more likely this is a false positive, not an actual infection.

   ✅ What This Means for You

   • There is no confirmed security threat in the package — just that Defender is being overly cautious.
   • The CLI gets flagged when it writes or rebuilds parts of itself (such as when generating documents), which triggers heuristic suspicion.

   🛠 Your Options

   Option A — Restore and Continue (if you trust it):

   1. Open Windows Security → Virus & threat protection → Protection history
   2. Find the Bearfoos.A!ml entry
   3. Click Allow on device
   4. Reinstall:
      npm i -g @openai/codex

   Option B — Avoid Windows EXE entirely:

   • Install and run it inside (WSL2):
     npm i -g @openai/codex
   • Defender won’t scan Linux binaries, so it won’t get quarantined.

   Option C — Use an older version (if not flagged):

   npm i -g @openai/codex@0.28.x
   Option D — Report the false positive to Microsoft:

   • Submit the quarantined .exe to via their [ portal](https://www.microsoft.com/en-us/wdsi/filesubmission) (choose Software developer submission).

   ORRRRRR

   ⚙️ Fix Microsoft Defender False Positive (While Staying on Windows)

   Goal: Stop Defender from quarantining the Trojan:Win32/Bearfoos.A!ml false positive so the Codex CLI can run.

   🛠 Step 1 — Restore the quarantined file

   Open Windows Security

   Go to Virus & threat protection → Protection history

   Find the detection entry (Bearfoos.A!ml)

   Select it → Actions → Allow on device

   This tells Defender that the specific file is safe.

   🛠 Step 2 — Add a targeted exclusion

   Open Windows Security

   Go to Virus & threat protection → Manage settings → Exclusions

   Click Add an exclusion → Folder

   Add this folder (default global npm install path):

   %APPDATA%\npm\node_modules@openai\codex\bin

   This makes Defender ignore only that path without turning off your whole antivirus.

   🛠 Step 3 — Reinstall the CLI npm i -g @openai/codex

   After this, the binary won’t get flagged or deleted anymore, and development can continue normally on Windows.

   📝 (Optional) Step 4 — Report to Microsoft Security Intelligence

   Submit the quarantined .exe as a false positive (software developer submission)

   Submit here

   This will help get the signature fixed for everyone.

   ✅ Result: Defender stops quarantining the file, you stay on Windows, and development can continue normally.

   Thank you. I've submitted the relevant details to MS Intelligence Feed, and the VirusTotal scan results show no detections. Thanks again :)
9. etraut-openai commented on Nov 23, 2025

   

   etraut-openai

   on Nov 23, 2025

   Contributor

   More actions

   I think this bug is likely no longer relevant. There has been no activity in over three months, so I'm going to close. If you see this with the latest version of codex, let us know.
10. etraut-openai

    closed this as completedon Nov 23, 2025
11. danielkornev commented on Feb 11, 2026

    

    danielkornev

    on Feb 11, 2026

    More actions

    Got a strange bug in what codex generated on my Win11 arm64 PC:

    Trojan:Win32/Steanoz.Z!MTB
    

    Details:

    CmdLine: C:\Program Files\PowerShell\7\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
    $base='c:\stuff\dev\successors\test5\UiMappingApp2\bin\x64\Debug\net10.0-windows10.0.19041'; $sessionRoot='c:\stuff\dev\successors\test5\_tmp_validate_session\2026-01-15 18.45.36 (Copy)'; $uiGraph=Join-Path $sessionRoot 'statebook\semantic_trace_ui_graph (New).json'; $outBase='c:\stuff\dev\successors\test5\_tmp_validate_output'; if(!(Test-Path $uiGraph)){ throw "ui graph missing: $uiGraph" }; if(Test-Path $outBase){ [System.IO.Directory]::Delete($outBase,$true)}; [System.IO.Directory]::CreateDirectory($outBase) | Out-Null; $asm=[System.Reflection.Assembly]::LoadFrom((Join-Path $base 'UiMappingApp2.dll')); [System.Reflection.Assembly]::LoadFrom((Join-Path $base 'FaraUiAgent.Platform.dll')) | Out-Null; $reqType=$asm.GetType('UiMappingApp2.Emulation.HighFidelityTwinAppGenerator+Request',$true); $genType=$asm.GetType('UiMappingApp2.Emulation.HighFidelityTwinAppGenerator',$true); $req=[Activator]::CreateInstance($reqType,@($outBase,'proj_validation',$sessionRoot,$uiGraph,'workflow_validation')); $m=$genType.GetMethod('GenerateAsync',[System.Reflection.BindingFlags]'Public,Static'); $task=$m.Invoke($null,@($req,$null,[System.Threading.CancellationToken]::None)); $result=$task.GetAwaiter().GetResult(); $result | ConvertTo-Json -Depth 6
    

    Screenshot of Microsoft Defender's report:
    

    👍React with 👍7Reacted by Hans-Christian Holm, Tin Dizdarevic, Ivan Zubak, mssveca, Minh Quang Tran, logancox and konstantin
12. mssveca commented on Mar 31, 2026

    

    mssveca

    on Mar 31, 2026

    More actions

    i got also this windows defender threat report from codex running powershell. I asked codex to explain itself and it replied with the following/

    """
    That alert came from a verification command I chose badly.

    What the command was trying to do:

    Load the newly built Dialogotron.dll from bin\x64\Debug\net8.0-windows.
    Instantiate the rule/knowledge classes from that DLL.
    Call the new dialog-override resolver with your ownership-conflict sample text.
    Print the resolved code/label/source so I could sanity-check the fix without deploying.

    Why Defender reacted:

    It used Assembly.LoadFrom(...) to load a local DLL into PowerShell.
    It used reflection: GetType, CreateInstance, GetMethod, Invoke.
    It piped a here-string into another PowerShell process: ... | powershell -NoProfile -Command -.
    That combination looks a lot like malware behavior, even when the script is visible and local.
    """