Codex CLI's hourly Windows updater gets blocked by McAfee as fileless malware
elliottwaves-20 · ghdev · 2026-10-14
A GitHub issue on openai/codex reports that on Windows, the managed app-server daemon's hourly background updater pipes its PowerShell installer into powershell.exe via stdin + Invoke-Expression. McAfee Real Protect flags the script every time as fileless malware (Real Protect-PSFL!…), so the daemon never updates and the user gets an antivirus alert every hour.
Key details:
- Environment: Windows 11 Home, Codex CLI 0.162.1 (npm), McAfee WPS 1.40.161.1 (Defender passive, no detections)
- Logs show installerfetch succeeds but installerrun fails; 7 McAfee detections match 7 installerrun failures one-to-one by timestamp
- The author believes this is the missing piece for issue #48528, which saw the same hourly detections without identifying the parent process
More from coding & agent
- Claude Code Pushes Urgent Security Update Across All Installations — umeshonai · 2026-10-23
- Claude cut a 2.6-hour video export to 20 minutes — but only after being told to rebuild the server — byhewar · 2026-10-23
- 3 flight-booking rules my AI agent checks that I'd never do by hand — Efistoffeles · 2026-10-23
- OpenJet claims Qwen3.8-27B coding runs 1.9x faster than llama.cpp on one RTX 3090 — JeremyCMorgan · 2026-10-23
- Building an autonomous SEO agent in Hermes with three skills: programmatic pages, Keywords Everywhere, DataForSEO — EXM7777 · 2026-10-23
- Building a sports betting AI agent with onchain execution and human approval by default: architecture and lessons — Dry-Comfortable-2678 · 2026-10-23