Repository navigation
Windows 10: Codex app triggers Microsoft Defender Behavior Monitoring / high CPU after recent update #30527
Description
What version of the Codex App are you using (From “About Codex” dialog)?
26.623.61825, released Jun 28, 2026
What subscription do you have?
ChatGPT Plus
What platform is your computer?
Windows 10 Pro x64, version 22H2, ThinkPad X1 Carbon 4th Gen, Intel i5-6300U, 8 GB RAM
What issue are you seeing?
After a recent update, the Codex Windows app started triggering Microsoft Defender Behavior Monitoring / Antimalware Service Executable high CPU on Windows 10.
This started suddenly around June 27–28, 2026. The same large project worked normally in Codex about 2 days earlier on the same laptop.
Steps to reproduce:
- Start Windows 10.
- Launch Codex app.
- Open the same existing project.
- Do not start any task; just launch the app / leave it idle.
- Microsoft Defender Antimalware Service Executable immediately starts using high CPU.
- If Defender Behavior Monitoring is disabled, Defender CPU drops, but Codex processes themselves start consuming CPU instead.
- If Defender Behavior Monitoring is enabled, Antimalware Service Executable consumes high CPU while reacting to Codex activity.
Observed processes:
- codex.exe
- multiple Codex processes
- node.exe / node_repl.exe
- git.exe
- conhost.exe
- Antimalware Service Executable / Microsoft Defender Antivirus Service
What I tried:
- Added Defender exclusions for the project folder.
- Added Defender process exclusions for codex.exe, node.exe, node_repl.exe, git.exe.
- Tried limiting Defender scheduled scan CPU usage.
- Cleaned disk space; free space is now about 57 GB.
- Restarted Windows.
- Verified SSD health: CrystalDiskInfo reports Good, 88%.
- The only thing that noticeably helped was disabling Behavior Monitoring, but Windows Defender / Tamper Protection re-enabled it.
Expected behavior:
Codex should be usable on the same existing project without triggering continuous Defender Behavior Monitoring or spawning enough background activity to make Windows 10 unusable.
Actual behavior:
Simply launching Codex makes either Defender or Codex-related processes consume CPU continuously. The laptop becomes slow and the fan runs continuously.
System:
- Windows 10 Pro x64 22H2
- ThinkPad X1 Carbon 4th Gen
- Intel Core i5-6300U
- 8 GB RAM
- SSD with about 57 GB free space
- Microsoft Defender enabled
What steps can reproduce the bug?
- Use Windows 10 Pro x64 22H2 with Microsoft Defender enabled.
- Install / update to the latest desktop Codex app version.
- Launch Codex.
- Open an existing large project that worked normally in Codex 2 days earlier.
- Do not start a new task; just leave Codex open or minimized.
- Open Task Manager.
- Observe that multiple Codex-related processes appear, including codex.exe, node.exe / node_repl.exe, git.exe and conhost.exe.
- Microsoft Defender Antimalware Service Executable starts consuming high CPU.
- If Defender Behavior Monitoring is disabled, Defender CPU drops, but Codex-related processes themselves start consuming CPU.
- If Behavior Monitoring is enabled, Defender consumes CPU while reacting to Codex activity.
This started after a recent Codex / Windows security update. The same project and same laptop worked normally about 2 days earlier.
What is the expected behavior?
Codex should be usable on the same existing project without triggering continuous Microsoft Defender Behavior Monitoring or causing Antimalware Service Executable to consume high CPU.
Launching Codex and leaving it idle should not spawn continuous background activity that makes Windows 10 slow or unusable.
Additional information
No response
Activity
github-actions commentedon Jun 29, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
.gitDirectories, Then Repeatedly Scans Them and Triggers Windows Defender High CPU #29911Powered by Codex Action
netwolf1 commentedon Jun 30, 2026
Same here, constant high Defender CPU usage as soon as Codex desktop is started (even if idle, doing nothing), and instantly drops as soon as Codex is closed.
No disk or network activity but 5-10% CPU usage (and entire core!!).
Codex itself hardly uses any CPU at that time.
I also noticed that it creates a huge number of .js files when started (again, no active tasks at that time).
Extremely annoying, forces me to close Codex whenever I don't actively use it.
Claude and other competitors don't have similar issues.
harrydbarnes commentedon Jul 1, 2026
I have this too
cincinno commentedon Jul 2, 2026
same here
lartpang commentedon Jul 2, 2026
@netwolf1 @cincinno @annmont @harrydbarnes
I'm seeing something very similar on Windows.
From what I observed locally, Codex does not appear to be running a heavy project task when this happens. The active processes are mostly the Codex desktop shell, the local
codex.exe app-server, a few helper runtimes such asnode_repl.exe/ PowerShell, and occasional Git status checks. However, Windows Defender can spike heavily right after Codex starts or while it is idle.My guess is that Defender is reacting to Codex’s local runtime/cache/workspace activity rather than to actual model computation. In particular, Codex seems to create or touch a number of local runtime/cache files, including JS-related files, and Defender scans them aggressively. This would explain why Defender CPU drops immediately when Codex is closed, even though Codex itself is not using much CPU.
A narrow Defender exclusion for the Codex workspace directory, e.g.
C:\Users\<user>\Documents\Codex, appears to reduce the problem, but that is only a workaround and not ideal from a security perspective. It would be useful if Codex could reduce startup/idle file churn, reuse generated runtime files more aggressively, or document which local directories are safe to exclude from Defender scanning.For diagnosis, the useful processes to compare are:
Codex.execodex.exe app-servernode_repl.exepwsh.exe/powershell.exegit.exeMsMpEng.exeIn my case, the high CPU was mostly Defender, not Codex itself.
Update: adding path exclusions for the Codex runtime/cache directories did not fully solve the issue for me.
The CPU usage dropped only after adding Defender process exclusions:
Add-MpPreference -ExclusionProcess "Codex.exe"
Add-MpPreference -ExclusionProcess "codex.exe"
This suggests the high Defender CPU usage is likely caused by real-time monitoring of Codex process behavior, child processes, or script/runtime activity, rather than only file scanning under the Codex workspace/cache directories.
This is not an ideal workaround from a security perspective, but it helps narrow down the issue.
netwolf1 commentedon Jul 2, 2026
Also tried excluding folder and/or process but that didn't really solve the problem of high Defender CPU usage even when Codex is idle (besides the legitimate security concerns).
There is definitely something wrong with current Codex desktop app for Windows.
lartpang commentedon Jul 3, 2026
By gpt
mdroidian commentedon Jul 4, 2026
I’m seeing a more specific pattern that may help narrow this down.
If I open Codex and it is on a new chat, I do not see the high CPU behavior from Microsoft Defender / Antimalware Service Executable.
However, as soon as I open a chat that previously created an HTML artifact in
/outputs— for example, after a prompt likeCreate a .html review of PR #1234— Antimalware Service Executable CPU usage and Power usage spike and stay high until I close Codex.If I open a chat that does not have this type of generated HTML artifact, I do not see the spike.
So in my case this does not seem to happen for every Codex chat or simply from launching Codex. It appears correlated with reopening a chat/session that has generated an
.htmlartifact under/outputs.AwakeNow101 commentedon Jul 13, 2026
I can reproduce a very similar issue, with a few additional observations that may help narrow it down.
Environment:
Observed behavior:
Defender diagnostics:
MemScanVfz-AMSI-...
Reason: AMSI
Things tried:
This suggests the issue may involve Defender behavior monitoring, AMSI/memory scanning, or another real-time protection path triggered by the desktop app / VS Code extension local app-server. The CLI path appears much lighter and does not reproduce the issue.
PeterTobi commentedon Jul 13, 2026
Same problem here, whenever I start VS Code with the Codex extension triggers Microsoft Defender and uses 5% of the CPU continuously, more or less. Operating system: Windows 11
VishveshC commentedon Jul 14, 2026
Same problem. Win11, latest.
Jifancy commentedon Jul 15, 2026
Same problem. Win 11, latest
harrydbarnes commentedon Jul 15, 2026
Happened again to me today
ttys001 commentedon Jul 17, 2026
Same problem. Win 11, latest
askxue commentedon Jul 19, 2026
So, hasn’t anyone fixed this issue? Now the Windows desktop is almost unusable—it immediately spikes CPU usage to 100% when opened.
suiyuebaobao commentedon Jul 22, 2026
The Defender load in this report matches the downstream behavior I measured; in my reproduction, repeated desktop Git refreshes were the original workload.
I published a single-file Windows launcher for the original Microsoft Store/MSIX Codex app:
It starts Codex with a process-scoped
GIT_DIR=NUL. On my machine, the stable trace changed from 247 newgit.exeand 137 newtaskkill.exeprocesses per 10 seconds to 0 and 0 over 15 seconds; WMI Provider Host fell from about 6.6% to 0.9%.Usage: fully exit Codex from the Windows system tray, then run the script.
This is an unofficial workaround, not an upstream fix. It deliberately disables or limits Review, Changes, branch detection, commit, and other Git-backed Codex features. It does not patch Codex, modify repositories or Git configuration, write system environment variables, require elevation, terminate processes, or remove chat history. Launching Codex normally restores Git integration.
zhang8630 commentedon Aug 6, 2026
I have this too
loktar00 commentedon Aug 10, 2026
Same here, has been getting worse recently.
athan614 commentedon Aug 26, 2026
I can replicate this too with latest version to-date