Windows Defender false positive: codex-x86_64-pc-windows-msvc.exe flagged as Trojan:Win32/Bearfoos.A!ml (v0.29.0)

[stryio]

What version of Codex is running?

0.29.0

Which model were you using?

No response

What platform is your computer?

windows

What steps can reproduce the bug?

While using the Codex CLI to write a Markdown document, Defender popped an alert and immediately quarantined the executable:

Threat: Trojan:Win32/Bearfoos.A!ml
Status: Quarantined
Action: Automatically removed by system
Affected item:
C:\Users<USER>\AppData\Roaming\npm\node_modules@openai\codex\bin\codex-x86_64-pc-windows-msvc.exe

After this, running the CLI fails because the binary has been deleted.

What is the expected behavior?

No response

What do you see instead?

No response

Additional information

No response

[warmaster1884-crypto]

Confirm it’s the same detection

Alert name: Trojan:Win32/Bearfoos.A!ml (the !ml suffix means Defender’s ML heuristic, which is prone to false alarms).
Microsoft
Reddit

Restore the file (if you’re comfortable)

Windows Security → Virus & threat protection → Protection history → select the detection → Allow on device → then reinstall the CLI (npm i -g @openai/codex).

If you’d rather not allow it, skip to step 4 (WSL workaround).
(General background on similar false-positives and heuristics:
Super User
JUCE
)

Report the false positive to Microsoft (recommended)

Submit the quarantined file to Microsoft Security Intelligence as a Software developer submission. This is the standard way to get Defender signatures corrected quickly.
JUCE

Workarounds that avoid the Windows .exe entirely

Use WSL2: install and run Codex in your Linux subsystem (npm i -g @openai/codex) so Defender never touches the Windows EXE. (Codex CLI supports non-Windows environments well.)
Hacker News

Or temporarily pin an older version (e.g., npm i -g @openai/codex@0.28.x) if that version isn’t flagged on your machine. If it still flags, switch to WSL2.

(Optional) Add a targeted Defender exclusion

Exclude only the specific path to the Codex binary (e.g., %APPDATA%\npm\node_modules@openai\codex\bin\codex-x86_64-pc-windows-msvc.exe). Do this only if you’re comfortable with the security trade-off.

[joasoze]

I got this today, so no fix yet.

[stryio]

The same issue occurs again, usually when writing a document it gets quarantined by Windows Defender.
version 0.34.0

[mirseo]

I had the same issue today too. Windows Defender quarantined it as Trojan:Win32/Bearfoos.A!ml, and it's now been removed. It seems like there's no security problem for now, but I don't feel great about it. This is safe, right...?

[warmaster1884-crypto]

Yes — that’s the same detection:

**⚠️ **

• The “.A!ml” suffix means flagged it using its machine-learning heuristic rather than a known malware signature.
• This type of detection is well known to produce false positives, especially with newly built binaries like the (@openai/codex) executable.
• Multiple developers (like the one you quoted, “mirseo”) are reporting the same issue with version 0.34.0, which makes it even more likely this is a false positive, not an actual infection.

---

✅ What This Means for You

• There is no confirmed security threat in the package — just that Defender is being overly cautious.
• The CLI gets flagged when it writes or rebuilds parts of itself (such as when generating documents), which triggers heuristic suspicion.

---

🛠 Your Options

Option A — Restore and Continue (if you trust it):

1. Open Windows Security → Virus & threat protection → Protection history

2. Find the Bearfoos.A!ml entry

3. Click Allow on device

4. Reinstall:

   npm i -g @openai/codex

Option B — Avoid Windows EXE entirely:

• Install and run it inside (WSL2):

  npm i -g @openai/codex

• Defender won’t scan Linux binaries, so it won’t get quarantined.

Option C — Use an older version (if not flagged):

npm i -g @openai/codex@0.28.x

Option D — Report the false positive to Microsoft:

• Submit the quarantined .exe to via their [ portal](https://www.microsoft.com/en-us/wdsi/filesubmission) (choose Software developer submission).

ORRRRRR

⚙️ Fix Microsoft Defender False Positive (While Staying on Windows)

Goal: Stop Defender from quarantining the Trojan:Win32/Bearfoos.A!ml false positive so the Codex CLI can run.

🛠 Step 1 — Restore the quarantined file

Open Windows Security

Go to Virus & threat protection → Protection history

Find the detection entry (Bearfoos.A!ml)

Select it → Actions → Allow on device

This tells Defender that the specific file is safe.

🛠 Step 2 — Add a targeted exclusion

Open Windows Security

Go to Virus & threat protection → Manage settings → Exclusions

Click Add an exclusion → Folder

Add this folder (default global npm install path):

%APPDATA%\npm\node_modules@openai\codex\bin

This makes Defender ignore only that path without turning off your whole antivirus.

🛠 Step 3 — Reinstall the CLI
npm i -g @openai/codex

After this, the binary won’t get flagged or deleted anymore, and development can continue normally on Windows.

📝 (Optional) Step 4 — Report to Microsoft Security Intelligence

Submit the quarantined .exe as a false positive (software developer submission)

Submit here

This will help get the signature fixed for everyone.

✅ Result: Defender stops quarantining the file, you stay on Windows, and development can continue normally.

[mirseo]

Yes — that’s the same detection:

**⚠️ **

• The “.A!ml” suffix means flagged it using its machine-learning heuristic rather than a known malware signature.
• This type of detection is well known to produce false positives, especially with newly built binaries like the (@openai/codex) executable.
• Multiple developers (like the one you quoted, “mirseo”) are reporting the same issue with version 0.34.0, which makes it even more likely this is a false positive, not an actual infection.

✅ What This Means for You

• There is no confirmed security threat in the package — just that Defender is being overly cautious.
• The CLI gets flagged when it writes or rebuilds parts of itself (such as when generating documents), which triggers heuristic suspicion.

🛠 Your Options

Option A — Restore and Continue (if you trust it):

1. Open Windows Security → Virus & threat protection → Protection history
2. Find the Bearfoos.A!ml entry
3. Click Allow on device
4. Reinstall:
   npm i -g @openai/codex

Option B — Avoid Windows EXE entirely:

• Install and run it inside (WSL2):
  npm i -g @openai/codex
• Defender won’t scan Linux binaries, so it won’t get quarantined.

Option C — Use an older version (if not flagged):

npm i -g @openai/codex@0.28.x
Option D — Report the false positive to Microsoft:

• Submit the quarantined .exe to via their [ portal](https://www.microsoft.com/en-us/wdsi/filesubmission) (choose Software developer submission).

ORRRRRR

⚙️ Fix Microsoft Defender False Positive (While Staying on Windows)

Goal: Stop Defender from quarantining the Trojan:Win32/Bearfoos.A!ml false positive so the Codex CLI can run.

🛠 Step 1 — Restore the quarantined file

Open Windows Security

Go to Virus & threat protection → Protection history

Find the detection entry (Bearfoos.A!ml)

Select it → Actions → Allow on device

This tells Defender that the specific file is safe.

🛠 Step 2 — Add a targeted exclusion

Open Windows Security

Go to Virus & threat protection → Manage settings → Exclusions

Click Add an exclusion → Folder

Add this folder (default global npm install path):

%APPDATA%\npm\node_modules@openai\codex\bin

This makes Defender ignore only that path without turning off your whole antivirus.

🛠 Step 3 — Reinstall the CLI npm i -g @openai/codex

After this, the binary won’t get flagged or deleted anymore, and development can continue normally on Windows.

📝 (Optional) Step 4 — Report to Microsoft Security Intelligence

Submit the quarantined .exe as a false positive (software developer submission)

Submit here

This will help get the signature fixed for everyone.

✅ Result: Defender stops quarantining the file, you stay on Windows, and development can continue normally.

Thank you. I've submitted the relevant details to MS Intelligence Feed, and the VirusTotal scan results show no detections. Thanks again :)

[etraut-openai]

I think this bug is likely no longer relevant. There has been no activity in over three months, so I'm going to close. If you see this with the latest version of codex, let us know.

[danielkornev]

Got a strange bug in what codex generated on my Win11 arm64 PC:

Trojan:Win32/Steanoz.Z!MTB

Details:

CmdLine: C:\Program Files\PowerShell\7\pwsh.exe -Command [Console]::OutputEncoding=[System.Text.Encoding]::UTF8;
$base='c:\stuff\dev\successors\test5\UiMappingApp2\bin\x64\Debug\net10.0-windows10.0.19041'; $sessionRoot='c:\stuff\dev\successors\test5\_tmp_validate_session\2026-01-15 18.45.36 (Copy)'; $uiGraph=Join-Path $sessionRoot 'statebook\semantic_trace_ui_graph (New).json'; $outBase='c:\stuff\dev\successors\test5\_tmp_validate_output'; if(!(Test-Path $uiGraph)){ throw "ui graph missing: $uiGraph" }; if(Test-Path $outBase){ [System.IO.Directory]::Delete($outBase,$true)}; [System.IO.Directory]::CreateDirectory($outBase) | Out-Null; $asm=[System.Reflection.Assembly]::LoadFrom((Join-Path $base 'UiMappingApp2.dll')); [System.Reflection.Assembly]::LoadFrom((Join-Path $base 'FaraUiAgent.Platform.dll')) | Out-Null; $reqType=$asm.GetType('UiMappingApp2.Emulation.HighFidelityTwinAppGenerator+Request',$true); $genType=$asm.GetType('UiMappingApp2.Emulation.HighFidelityTwinAppGenerator',$true); $req=[Activator]::CreateInstance($reqType,@($outBase,'proj_validation',$sessionRoot,$uiGraph,'workflow_validation')); $m=$genType.GetMethod('GenerateAsync',[System.Reflection.BindingFlags]'Public,Static'); $task=$m.Invoke($null,@($req,$null,[System.Threading.CancellationToken]::None)); $result=$task.GetAwaiter().GetResult(); $result | ConvertTo-Json -Depth 6

Screenshot of Microsoft Defender's report:

[mssveca]

i got also this windows defender threat report from codex running powershell. I asked codex to explain itself and it replied with the following/

"""
That alert came from a verification command I chose badly.

What the command was trying to do:

Load the newly built Dialogotron.dll from bin\x64\Debug\net8.0-windows.
Instantiate the rule/knowledge classes from that DLL.
Call the new dialog-override resolver with your ownership-conflict sample text.
Print the resolved code/label/source so I could sanity-check the fix without deploying.

Why Defender reacted:

It used Assembly.LoadFrom(...) to load a local DLL into PowerShell.
It used reflection: GetType, CreateInstance, GetMethod, Invoke.
It piped a here-string into another PowerShell process: ... | powershell -NoProfile -Command -.
That combination looks a lot like malware behavior, even when the script is visible and local.
"""