Windows Defender flags unsigned codex-computer-use.exe command line as Trojan:Win32/ClickFix.DE!MTB

Open 💬 7 comments Opened Jul 7, 2026 by laz-jamesfuller

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using?

Codex Desktop on Windows.

Verified local package path:

C:\Program Files\WindowsApps\OpenAI.Codex_26.623.19656.0_x64__2p2nqsd0c76g0\app\resources\codex.exe

The main codex.exe file did not expose embedded ProductVersion / FileVersion metadata through Windows file version info.

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Windows.

What issue are you seeing?

Microsoft Defender flagged normal Codex Desktop Computer Use activity as a severe ClickFix trojan:

Threat: Trojan:Win32/ClickFix.DE!MTB
Threat ID: 2147932647
Category: Trojan
Severity: Severe
Detection time: 2026-07-07 10:10 AM America/New_York
Defender intelligence: AV 1.453.463.0, AS 1.453.463.0, NIS 1.453.463.0
Engine: AM 1.1.26050.11, NIS 1.1.26050.11

The affected item was a command line for the Windows Computer Use helper:

C:\Users\<user>\AppData\Local\OpenAI\Codex\runtimes\cua_node\1b23c930bdf84ed6\bin\node_modules\@oai\sky\bin\windows\codex-computer-use.exe turn-ended ...

The command line contained a normal Codex Desktop agent-turn-complete / turn-ended payload with thread metadata and recent user/assistant prompt text. This appears to be a Defender heuristic hit on the Computer Use helper invocation and/or its long prompt-bearing command line, not a user-downloaded executable.

Local Defender readback after the alert:

ThreatID: 2147932647
ThreatName: Trojan:Win32/ClickFix.DE!MTB
DidThreatExecute: False
IsActive: False
Action: Remove
Action Status: No additional actions required

Important: clicking "Allow" in Windows Security persisted a threat-specific default action:

ThreatIDDefaultAction_Ids: {2147932647}
ThreatIDDefaultAction_Actions: {6}

That means the UX can lead users to allow the whole threat ID rather than making a narrow trust decision about a specific Codex helper binary.

The helper binary was present on disk, but it was not signed and did not expose embedded ProductVersion / FileVersion metadata:

Path: C:\Users\<user>\AppData\Local\OpenAI\Codex\runtimes\cua_node\1b23c930bdf84ed6\bin\node_modules\@oai\sky\bin\windows\codex-computer-use.exe
Authenticode status: NotSigned
Embedded ProductVersion: <empty>
Embedded FileVersion: <empty>
@oai/sky package version: 0.4.19
File size: 1,691,648 bytes
Created: 2026-06-22 09:29:05 local time
LastWriteTime: 2026-06-11 19:00:17 local time
SHA256: F2B2F56FCD1699B0FA32DEC3214A56A1D36B937A2ECF58CC822AB4A904551E03

What steps can reproduce the bug?

I do not have a deterministic minimal repro yet. The observed flow was:

Use Codex Desktop on Windows.
Use or have enabled Computer Use.
A Codex thread completed a turn.
Defender flagged codex-computer-use.exe turn-ended ... as Trojan:Win32/ClickFix.DE!MTB.
Windows Security offered an "Allow" path that persisted a Defender threat action for threat ID 2147932647.

What is the expected behavior?

Normal Codex Desktop Computer Use helper activity should not trigger Microsoft Defender as a severe ClickFix trojan.

Please consider:

code-signing codex-computer-use.exe and any other bundled Windows helper binaries;
submitting the signed helper and current hash to Microsoft for Defender reputation / false-positive review;
avoiding command-line shapes where large prompt/thread payloads are passed directly to a helper in a way that resembles ClickFix or command-from-attacker behavior;
making the product guidance clearer when Defender fires, because "Allow" can create a broad persistent threat allow entry instead of a narrow Codex helper allow.

I do not want to disable Computer Use. I also do not want to use broad Defender exclusions for the Codex runtime tree. A durable product-side fix seems needed.

Related issues

These appear adjacent but not exact duplicates:

#15423: On Windows, some tool-generated PowerShell commands can be blocked by Defender as Trojan:Win32/ClickFix.SA!A
#26218: Windows Defender Severe alert from Codex-generated pwsh reflection command
#20315: browser-use (browser-client.mjs) marked as trojan by Windows Defender
#31251: macOS detects Codex Computer Use.app as malware and deletes it!

This issue differs from the macOS signing/Gatekeeper reports because the affected item is the Windows Computer Use helper executable (codex-computer-use.exe), the detection is Microsoft Defender Trojan:Win32/ClickFix.DE!MTB, and Windows Security persisted a threat-ID allow entry after the user clicked "Allow." The shared theme is that Computer Use helper packaging/signing/reputation needs attention across platforms.

View original on GitHub ↗

7 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#31251

Powered by Codex Action

laz-jamesfuller · 1 month ago

Reviewed #31251 and the issues it points to (#30972, #30608, #30298).

I agree this is adjacent to the Computer Use signing / malware-detection cluster, so I added #31251 to the related list in the description.

I am not closing this as a duplicate yet because the observed failure mode is different:

#31251 is macOS / XProtect / Gatekeeper deleting or blocking Codex Computer Use.app after an update.
This issue is Windows / Microsoft Defender flagging codex-computer-use.exe turn-ended ... as Trojan:Win32/ClickFix.DE!MTB.
The Windows helper binary checked locally as Authenticode status: NotSigned.
Clicking "Allow" in Windows Security persisted a Defender threat-ID default action for 2147932647, which is broader than a narrow helper-binary trust decision.

The shared product ask is still signing / packaging / reputation hardening for the Computer Use helper across platforms. If maintainers prefer one umbrella issue for all Computer Use helper signing/reputation failures, I am fine with closing this after the Windows Defender-specific evidence is linked there.

undergroundrap · 1 month ago

Just wanted to chime in and confirm that this false positive (Trojan:Win32/ClickFix.DE!MTB on codex-computer-use.exe) appears to be resolved on my end now after updating Windows Defender. Looks like Microsoft cleared up the heuristic trigger!

https://community.openai.com/t/windows-defender-flags-codex-computer-use-helper-as-trojan-win32-clickfix-de-mtb/1385584

undergroundrap · 1 month ago

Another user in the same thread I made mentioned this too. I was curious if that also relates to all those 'want to send this file to Microsoft' spam notifications?

styler-ai · 1 month ago

Current deterministic reproduction and local forensic evidence (Windows, 2026-07-22)

This remains reproducible with current Codex and Defender builds, including the Trojan:Win32/PowhidSubExec.B variant previously reported in #32343.

Environment

Codex CLI 0.145.0 (the original blocked turn was recorded by CLI 0.144.1)
Codex Windows app 26.715.4045.0
Windows 10.0.26200.0 x64
PowerShell 7.6.4
Defender security intelligence 1.455.263.0 (updated 2026-07-21T22:58:42Z)
Defender threat ID 2147941383

The relevant user-level configuration has this shape:

notify = ["<Codex desktop runtime>\\codex-computer-use.exe", "turn-ended"]

First detection: Codex-generated command wrapper

A Codex agent generated a PowerShell wrapper around a benign local development test. The wrapper used a hidden child process, stdout/stderr redirection, and a two-hour timeout.

Timeline from the Codex session and Defender Operational event log:

2026-07-16T15:50:40.613Z: Codex issued the wrapper through its execution tool.
2026-07-16T15:50:41.756Z: Defender event 1116 classified its command-line resource as Trojan:Win32/PowhidSubExec.B.
At the same instant, Codex received CreateProcess ... Access is denied (os error 5).
A process query immediately afterward found no matching test child process.
2026-07-16T15:51:12.620Z: Defender event 1117 recorded Action: Remove, Action Status: No additional actions required, and error code 0x00000000.

This establishes that Defender blocked process creation; there was no persistent Trojan file associated with that event. The affected resource was CmdLine, Process Name was Unknown, and Defender reported successful remediation.

Deterministic text-only reproduction

A later normal Codex thread contained the already-blocked PowerShell text solely for analysis. The text was not executed.
When the turn completed, the configured notifier invoked codex-computer-use.exe turn-ended.
The notifier command line contained serialized JSON with the full input-messages and last-assistant-message, including the inert PowerShell text.
At 2026-07-22T11:36:42.410Z, Defender event 1116 raised the same PowhidSubExec.B detection against the notifier's CmdLine resource.
Get-MpThreatDetection preserved the notifier JSON in the resource record, confirming that the suspicious-looking content was conversation data.
At 2026-07-22T11:37:09.890Z, Defender event 1117 again recorded Remove and No additional actions required.

The second event is the key reproduction: no suspicious script was run. Merely carrying its text in the turn-ended argv was enough to trigger the same signature.

Local safety checks

No active PowhidSubExec.B threat is reported after remediation.
Defender real-time protection, behavior monitoring, network inspection, and tamper protection are enabled.
The currently installed Microsoft Store PowerShell executable has a valid Microsoft Authenticode signature.
The script contained no download, encoded payload, persistence mechanism, credential access, Defender modification, or external command source.

Expected behavior

Do not place complete conversation contents in process arguments.
Pass the turn payload through stdin or authenticated IPC, or pass only thread/turn identifiers.
Prefer Codex's direct long-running execution/session mechanism over generating nested hidden PowerShell wrappers for ordinary development commands.
Keep normal turn completion from producing severe Defender detections or remediation actions.
Do not require users to create broad Defender exclusions for Codex, PowerShell, or their workspaces.

A private /feedback diagnostic report was submitted separately. Public evidence here is intentionally stripped of usernames, repository names, local project paths, and unrelated session content.

daikanyama · 8 days ago

I’m experiencing the same issue on Windows 11.

Microsoft Defender repeatedly detects:

Trojan:Win32/ClickFix.DE!MTB

Affected executable:
%LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node\...\codex-computer-use.exe

The detection occurs around turn-ended / agent-turn-complete.

Today, Defender detected it several times.

I also uninstalled Codex and reinstalled the latest official version from the Microsoft Store, but the detection occurred again.

I have NOT added any Defender exclusions and have NOT allowed the detected threat.

The Defender command-line details contain Codex conversation history inside the JSON passed to codex-computer-use.exe, so I am not posting the full command line here for privacy reasons.

Could you please confirm whether this is a known false positive and whether a fix is planned?

campbell-reid-displayr · 8 days ago

I’m experiencing the same issue on Windows 11. Microsoft Defender repeatedly detects: Trojan:Win32/ClickFix.DE!MTB Affected executable: %LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node...\codex-computer-use.exe The detection occurs around turn-ended / agent-turn-complete. Today, Defender detected it several times. I also uninstalled Codex and reinstalled the latest official version from the Microsoft Store, but the detection occurred again. I have NOT added any Defender exclusions and have NOT allowed the detected threat. The Defender command-line details contain Codex conversation history inside the JSON passed to codex-computer-use.exe, so I am not posting the full command line here for privacy reasons. Could you please confirm whether this is a known false positive and whether a fix is planned?

Just had this show up as well.