Unsigned codex-computer-use.exe (bundled @oai/sky) triggers repeated Defender Trojan:Win32/PowhidSubExec.B false positives

What version of the IDE extension are you using?

26.707.31428

What subscription do you have?

Plus

Which IDE are you using?

VS Code

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Microsoft Defender repeatedly detects the bundled Windows helper
codex-computer-use.exe (from the @oai/sky package, path:
%LOCALAPPDATA%\OpenAI\Codex\runtimes\cua_node\<runtime>\bin\node_modules\@oai\sky\bin\windows\codex-computer-use.exe,
SHA-256: F2B2F56FCD1699B0FA32DEC3214A56A1D36B937A2ECF58CC822AB4A904551E03,
size 1,691,648 bytes) as Trojan:Win32/PowhidSubExec.B (Threat ID
2147941383, Severity: Severe) when a Codex agent turn completes.

Four detections were recorded within 15 minutes, all on the CmdLine
resource type rather than a quarantined file. Defender reported
DidThreatExecute: false for every event, and remediation succeeded
each time. Investigation showed the flagged command line carried
serialized JSON turn-metadata that included earlier conversation text
referencing a hidden PowerShell subprocess pattern (Start-Process with
a hidden window) used in a prior, unrelated local script - that text
was present as inert data in the JSON payload, not re-executed by the
turn-ended call.

Notably, this helper is the only executable in the Codex install that
is NOT Authenticode-signed. Sibling binaries in the same installation
(codex.exe, codex-command-runner.exe, codex-windows-sandbox-setup.exe)
all carry a valid "OpenAI OpCo, LLC" signature, and the bundled Node.js
binary carries a valid OpenJS Foundation signature. The @oai/sky
package is also not available on the public npm registry, so an
independent hash comparison wasn't possible.

What steps can reproduce the bug?

1. Use the Codex VS Code extension for a session that at some point

includes an earlier PowerShell-related message/tool call using a
hidden subprocess start pattern (e.g. Start-Process -WindowStyle
Hidden) anywhere in the thread history.

1. Complete a subsequent Codex agent turn (any turn-ended event) later

in the same session.

1. Microsoft Defender flags the resulting turn-ended command line as

Trojan:Win32/PowhidSubExec.B, even though no new process is being
launched - the historical text is simply serialized into the
turn-ended payload.

What is the expected behavior?

The bundled Windows helper (codex-computer-use.exe) should be
Authenticode-signed like the other Codex executables, and OpenAI
should publish verifiable release hashes for the @oai/sky package
binaries. This would let Microsoft Defender (and users) distinguish
legitimate Codex helper invocations from malicious activity, and would
let affected users independently verify the file instead of relying
on an unsigned, unpublished-hash binary.

Additional information

Full incident write-up with timeline, event log evidence, and
containment steps is available on request. Root cause assessment: a
Defender command-line heuristic matching serialized conversation
content, not actual malicious execution - but this cannot be
confirmed as a definitive false positive until OpenAI signs the
binary or publishes a reference hash, and/or Microsoft confirms the
classification via file submission (WDSI case pending).