Windows Defender flags @openai/codex Windows binary as Trojan:Win32/Wacatac.H!ml

What version of Codex is running?

codex-cli 0.21.0

Which model were you using?

N/A

What platform is your computer?

MINGW64_NT-10.0-26100 3.6.3-7674c51e.x86_64 x86_64 unknown

What steps can reproduce the bug?

1. Install Codex CLI on Windows:

npm i -g @openai/codex

(also occurs if installed as a dependency; binary present under node_modules\@openai\codex\bin\)

1. Trigger a Defender scan (automatic real-time or manual quick/full scan).
2. Observe Defender alert quarantining:

Trojan:Win32/Wacatac.H!ml
This program is dangerous and executes commands from an attacker.

What is the expected behavior?

The Codex CLI binary should not be flagged by Windows Defender and should remain usable.

What do you see instead?

Microsoft Defender flags and quarantines the binary, breaking the CLI.

• CLI unusable on Windows unless the user manually restores/excludes the file (unsafe).
• May block CI/enterprise environments that rely on Defender defaults.

Additional information

program hash (exe / sha256):
9BF0F15354E6641F75CC83360415873C3678CE441DA3451CA402C22EC1BCABB1