browser-use (browser-client.mjs) marked as trojan by Windows Defender

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #20151

Powered by Codex Action

I’m seeing the same Windows Defender detection on Codex Desktop for Windows.

Codex Desktop path/version observed:
C:\Program Files\WindowsApps\OpenAI.Codex_26.422.2339.0_x64__2p2nqsd0...

Defender detection:
Trojan:JS/DrillApp.A!MTB
Alert level: Severe
ThreatID: 2147964955
Detection time: 2026-04-29 around 21:25-21:26 America/Phoenix
ActionSuccess: True
CleaningActionID: 2
ThreatStatusID: 3

Remediated paths:
C:\Users\Brian\.codex\.tmp\bundled-marketplaces\openai-bundled\plugins\browser-use\scripts\browser-client.mjs
C:\Users\Brian\.codex\plugins\cache\openai-bundled\browser-use\0.1.0-alpha1\scripts\browser-client.mjs
C:\Users\Brian\.codex\tmp\arg0\codex-arg0vLLBtz\plugins\openai-bundled\plugins\browser-use\scripts\browser-client.mjs

After remediation, the Browser Use plugin is no longer usable. Please confirm whether this is a Defender false positive and whether users should delete the plugin cache, reinstall Codex, or wait for an updated bundle/signature.

I got notified that trojan found at below paths:
/Users/macbookpro/.codex/plugins/cache/openai-bundled/browser-use/0.1.0-alpha1/scripts/browser-client.mjs
/Users/macbookpro/.codex/.tmp/bundled-marketplaces/openai-bundled/plugins/browser-use/scripts/browser-client.mjs

I was not using Browser Use when this happened.

Below screenshot from Windows Defender, on macOS 26.4.1 (25E253)
<img width="838" height="628" alt="Image" src="https://github.com/user-attachments/assets/de40d2a7-dea8-4b04-8e03-6a8275fd2072" />

Is this normal?
Happened few times, everytime I open or use codex, tried re-installation.

Please let me know if I can provide any more information / logs.

Trojan reported by Windows Defender in the this path . Windows 11 , native install of codex app and codex cli.
Windows defender has quarantied both files.
C:\Users\username\.codex\plugins\cache\openai-bundled\browser-use\0.1.0-alpha1\scripts\browser-client.mjs
C:\Users\username\.codex\.tmp\bundled-marketplaces\openai-bundled\plugins\browser-use\scripts\browser-client.mjs

Trojan reported by Windows Defender in the this path . Windows 11 , native install of codex app and codex cli.
Windows defender has quarantied both files.
C:\Users\<userprofile>\.codex\plugins\cache\openai-bundled\browser-use\0.1.0-alpha1\scripts\browser-client.mjs
C:\Users\<userprofile>\.codex\.tmp\bundled-marketplaces\openai-bundled\plugins\browser-use\scripts\browser-client.mjs

Same thing on windows 11 today. Codex was open, but I haven't conversated with it in atleast an hour.

Clicking "Learn More" takes you to microsofts website, where it has no info on this particular flag.

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Trojan%3AJS%2FDrillApp.A!MTB&threatid=2147964955

<img width="1318" height="371" alt="Image" src="https://github.com/user-attachments/assets/aaf5365e-a822-42db-a85b-6985df2c3296" />

Same here!
Trojan reported by Windows Defender in the this path . Windows 11 , native install of codex app and codex cli.
Windows defender has quarantied both files.
C:\Users\...\plugins\cache\openai-bundled\browser-use\0.1.0-alpha1\scripts\browser-client.mjs
C:\Users\...\bundled-marketplaces\openai-bundled\plugins\browser-use\scripts\browser-client.mjs

Same here:

<img width="506" height="230" alt="Image" src="https://github.com/user-attachments/assets/9f38860d-2eeb-4f50-9c9d-70f558e8a7a8" />

I will be annoying and add my own screenshot here. Sorry.

<img width="612" height="611" alt="Image" src="https://github.com/user-attachments/assets/2b34600a-1b6b-4f86-b2ed-7cc596dadf11" />