›_ Codex Issues
Codex Issues / #30527

Windows 10: Codex app triggers Microsoft Defender Behavior Monitoring / high CPU after recent update

Open 💬 15 comments Opened Jun 29, 2026 by annmont
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.623.61825, released Jun 28, 2026

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Windows 10 Pro x64, version 22H2, ThinkPad X1 Carbon 4th Gen, Intel i5-6300U, 8 GB RAM

What issue are you seeing?

After a recent update, the Codex Windows app started triggering Microsoft Defender Behavior Monitoring / Antimalware Service Executable high CPU on Windows 10.

This started suddenly around June 27–28, 2026. The same large project worked normally in Codex about 2 days earlier on the same laptop.

Steps to reproduce:

  1. Start Windows 10.
  2. Launch Codex app.
  3. Open the same existing project.
  4. Do not start any task; just launch the app / leave it idle.
  5. Microsoft Defender Antimalware Service Executable immediately starts using high CPU.
  6. If Defender Behavior Monitoring is disabled, Defender CPU drops, but Codex processes themselves start consuming CPU instead.
  7. If Defender Behavior Monitoring is enabled, Antimalware Service Executable consumes high CPU while reacting to Codex activity.

Observed processes:

  • codex.exe
  • multiple Codex processes
  • node.exe / node_repl.exe
  • git.exe
  • conhost.exe
  • Antimalware Service Executable / Microsoft Defender Antivirus Service

What I tried:

  • Added Defender exclusions for the project folder.
  • Added Defender process exclusions for codex.exe, node.exe, node_repl.exe, git.exe.
  • Tried limiting Defender scheduled scan CPU usage.
  • Cleaned disk space; free space is now about 57 GB.
  • Restarted Windows.
  • Verified SSD health: CrystalDiskInfo reports Good, 88%.
  • The only thing that noticeably helped was disabling Behavior Monitoring, but Windows Defender / Tamper Protection re-enabled it.

Expected behavior:
Codex should be usable on the same existing project without triggering continuous Defender Behavior Monitoring or spawning enough background activity to make Windows 10 unusable.

Actual behavior:
Simply launching Codex makes either Defender or Codex-related processes consume CPU continuously. The laptop becomes slow and the fan runs continuously.

System:

  • Windows 10 Pro x64 22H2
  • ThinkPad X1 Carbon 4th Gen
  • Intel Core i5-6300U
  • 8 GB RAM
  • SSD with about 57 GB free space
  • Microsoft Defender enabled

What steps can reproduce the bug?

  1. Use Windows 10 Pro x64 22H2 with Microsoft Defender enabled.
  2. Install / update to the latest desktop Codex app version.
  3. Launch Codex.
  4. Open an existing large project that worked normally in Codex 2 days earlier.
  5. Do not start a new task; just leave Codex open or minimized.
  6. Open Task Manager.
  7. Observe that multiple Codex-related processes appear, including codex.exe, node.exe / node_repl.exe, git.exe and conhost.exe.
  8. Microsoft Defender Antimalware Service Executable starts consuming high CPU.
  9. If Defender Behavior Monitoring is disabled, Defender CPU drops, but Codex-related processes themselves start consuming CPU.
  10. If Behavior Monitoring is enabled, Defender consumes CPU while reacting to Codex activity.

This started after a recent Codex / Windows security update. The same project and same laptop worked normally about 2 days earlier.

What is the expected behavior?

Codex should be usable on the same existing project without triggering continuous Microsoft Defender Behavior Monitoring or causing Antimalware Service Executable to consume high CPU.

Launching Codex and leaving it idle should not spawn continuous background activity that makes Windows 10 slow or unusable.

Additional information

_No response_

View original on GitHub ↗

15 Comments

github-actions[bot] contributor · 21 days ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #30345
  • #29911
  • #29858
  • #30061
  • #29110

Powered by Codex Action

netwolf1 · 20 days ago

Same here, constant high Defender CPU usage as soon as Codex desktop is started (even if idle, doing nothing), and instantly drops as soon as Codex is closed.
No disk or network activity but 5-10% CPU usage (and entire core!!).
Codex itself hardly uses any CPU at that time.
I also noticed that it creates a huge number of .js files when started (again, no active tasks at that time).

Extremely annoying, forces me to close Codex whenever I don't actively use it.
Claude and other competitors don't have similar issues.

harrydbarnes · 19 days ago

I have this too

cincinno · 19 days ago

same here

lartpang · 18 days ago

@netwolf1 @cincinno @annmont @harrydbarnes

I'm seeing something very similar on Windows.

From what I observed locally, Codex does not appear to be running a heavy project task when this happens. The active processes are mostly the Codex desktop shell, the local codex.exe app-server, a few helper runtimes such as node_repl.exe / PowerShell, and occasional Git status checks. However, Windows Defender can spike heavily right after Codex starts or while it is idle.

My guess is that Defender is reacting to Codex’s local runtime/cache/workspace activity rather than to actual model computation. In particular, Codex seems to create or touch a number of local runtime/cache files, including JS-related files, and Defender scans them aggressively. This would explain why Defender CPU drops immediately when Codex is closed, even though Codex itself is not using much CPU.

A narrow Defender exclusion for the Codex workspace directory, e.g. C:\Users\<user>\Documents\Codex, appears to reduce the problem, but that is only a workaround and not ideal from a security perspective. It would be useful if Codex could reduce startup/idle file churn, reuse generated runtime files more aggressively, or document which local directories are safe to exclude from Defender scanning.

For diagnosis, the useful processes to compare are:

  • Codex.exe
  • codex.exe app-server
  • node_repl.exe
  • pwsh.exe / powershell.exe
  • git.exe
  • MsMpEng.exe

In my case, the high CPU was mostly Defender, not Codex itself.

---

Update: adding path exclusions for the Codex runtime/cache directories did not fully solve the issue for me.

The CPU usage dropped only after adding Defender process exclusions:

Add-MpPreference -ExclusionProcess "Codex.exe"
Add-MpPreference -ExclusionProcess "codex.exe"

This suggests the high Defender CPU usage is likely caused by real-time monitoring of Codex process behavior, child processes, or script/runtime activity, rather than only file scanning under the Codex workspace/cache directories.

This is not an ideal workaround from a security perspective, but it helps narrow down the issue.

netwolf1 · 18 days ago

Also tried excluding folder and/or process but that didn't really solve the problem of high Defender CPU usage even when Codex is idle (besides the legitimate security concerns).

There is definitely something wrong with current Codex desktop app for Windows.

lartpang · 17 days ago

<img width="1448" height="1086" alt="Image" src="https://github.com/user-attachments/assets/f7ba1e5f-c9b4-4fd2-864f-cb2aed14b787" />

By gpt

mdroidian · 16 days ago

I’m seeing a more specific pattern that may help narrow this down.

If I open Codex and it is on a new chat, I do not see the high CPU behavior from Microsoft Defender / Antimalware Service Executable.

However, as soon as I open a chat that previously created an HTML artifact in /outputs — for example, after a prompt like Create a .html review of PR #1234 — Antimalware Service Executable CPU usage and Power usage spike and stay high until I close Codex.

If I open a chat that does not have this type of generated HTML artifact, I do not see the spike.

So in my case this does not seem to happen for every Codex chat or simply from launching Codex. It appears correlated with reopening a chat/session that has generated an .html artifact under /outputs.

AwakeNow101 · 7 days ago

I can reproduce a very similar issue, with a few additional observations that may help narrow it down.

Environment:

  • Windows 10 Home
  • Microsoft Defender enabled
  • ChatGPT/Codex desktop app: 26.707.8168.0
  • VS Code Codex/OpenAI extension: 26.707.41301
  • Defender engine: 1.1.26060.3008
  • 32 logical processors

Observed behavior:

  • Codex CLI does not reproduce the issue, even during normal chat/task usage.
  • The desktop app does not always trigger the issue just by launching.
  • Opening certain conversations triggers sustained MsMpEng.exe / Antimalware Service Executable CPU.
  • Simple new chats may not reproduce it.
  • Once a “bad” conversation is opened, switching to another conversation does not reduce Defender CPU, suggesting that some local app-server / code-mode / tool bridge is lazily loaded and remains alive.
  • The VS Code extension can also raise Defender CPU on activation, likely because it starts a local codex app-server / code-mode host.

Defender diagnostics:

  • MsMpEng.exe often reaches around 100%-250% process CPU in performance counters.
  • Disk I/O is near zero.
  • Microsoft Defender performance report shows TopScans dominated by:

MemScanVfz-AMSI-...
Reason: AMSI

Things tried:

  • Project folder exclusions: little/no effect.
  • Process exclusions for ChatGPT/Codex executables: little/no effect.
  • Set-MpPreference -ScanAvgCPULoadFactor 15: no meaningful effect.
  • Set-MpPreference -DisableScriptScanning $true: no meaningful effect.
  • Set-MpPreference -DisableBehaviorMonitoring $true could not be made to stick, likely due to Defender protection / Tamper Protection policy.

This suggests the issue may involve Defender behavior monitoring, AMSI/memory scanning, or another real-time protection path triggered by the desktop app / VS Code extension local app-server. The CLI path appears much lighter and does not reproduce the issue.

PeterTobi · 7 days ago

Same problem here, whenever I start VS Code with the Codex extension triggers Microsoft Defender and uses 5% of the CPU continuously, more or less. Operating system: Windows 11

VishveshC · 6 days ago

Same problem. Win11, latest.

Jifancy · 5 days ago

Same problem. Win 11, latest

harrydbarnes · 5 days ago

Happened again to me today

ttys001 · 4 days ago

Same problem. Win 11, latest

askxue · 1 day ago

So, hasn’t anyone fixed this issue? Now the Windows desktop is almost unusable—it immediately spikes CPU usage to 100% when opened.