Conflict between Codex and Antivirus (Bitdefender)
Open 💬 7 comments Opened Mar 8, 2026 by raphaelp-github
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
What version of the Codex App are you using (From “About Codex” dialog)?
Latest
What subscription do you have?
Plus
What platform is your computer?
Microsoft Windows NT 10.0.26200.0 x64
What issue are you seeing?
Hi,
Problem with Codex sending actions to Powershell that Bitdefender detects as a threat. I don't encounter this problem with any other client (GitHub Copilot, Google Antigravity, etc.).
<img width="1920" height="1069" alt="Image" src="https://github.com/user-attachments/assets/c6fad46b-7e9c-4537-bf9c-55d67a0d90ac" />
Please try to look into this with Bitdefender or fix it in Codex. If this problem occurs for me, it also occurs for everyone else using Bitdefender.
Best,
What steps can reproduce the bug?
Install Bitdefender + Codex > run any instruction that needs Powershell action.
What is the expected behavior?
_No response_
Additional information
_No response_
7 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
Same issue on my side.
In my case, Codex is using a BASE64 encoded PowerShell script which looks suspicious to Bitdefender. See below Bitdefender log entry with the full powershell command.
I decoded the BASE64 and it is a local helper launched by Codex as a long-lived PowerShell AST parser used by the Rust command-safety layer on Windows.
Here the content of this Codex PowerShell script:
codex_helper.ps1.txt
@chatgptdev do you have a solution for this?
It's driving me nuts and I'm not disabling my security.
It's pretty anoying
Putting this in my AGENTS.md handled most of the issues with Bit Defender
\## Security / antivirus compatibility
This environment uses Bitdefender on Windows, and PowerShell-heavy or suspicious command lines may be blocked.
Follow these rules strictly:
\- Avoid PowerShell unless absolutely necessary
\- Do not use encoded PowerShell commands
\- Do not generate long shell one-liners for file rewriting
\- Do not chain many shell commands together
\- Prefer direct file edits over shell-based search/replace
\- Prefer normal file I/O over shell piping or generated scripts
\- Do not touch registry, startup settings, scheduled tasks, antivirus settings, or security settings
\- Do not use obfuscated scripts or suspicious automation patterns
\- Prefer standard dotnet CLI and git commands when command execution is needed
\- Keep commands short, explicit, and readable
\- If a command is blocked or likely to trigger antivirus heuristics, stop and propose the smallest safe manual alternative
@truong-bui
Only solution for now is to add codex to the exception list:
c:\users\idras\appdata\roaming\npm\codexc:\users\idras\appdata\roaming\npm\codex.cmdc:\users\idras\appdata\roaming\npm\node_modules\@openai\codex\node_modules\@openai\codex-win32-x64\vendor\x86_64-pc-windows-msvc\codex\codex-command-runner.exec:\users\idras\appdata\roaming\npm\node_modules\@openai\codex\node_modules\@openai\codex-win32-x64\vendor\x86_64-pc-windows-msvc\codex\codex-windows-sandbox-setup.exec:\users\idras\appdata\roaming\npm\node_modules\@openai\codex\node_modules\@openai\codex-win32-x64\vendor\x86_64-pc-windows-msvc\codex\codex.exeAlso, a smaller variant of @JoMiJor solution should also work: putting "Do not use encoded PowerShell commands" in AGENTS.md since the issue seems to come from the BASE64 encoded command used by Codex.
Thanks, this works for me.