opencode detected as malware by Cortex XDR

Description

Cortex XDR, installed and centrally managed by my company on my work laptop, detects the OpenCode executable as malware and blocks it from running.

Since Cortex XDR is managed by the company, I cannot whitelist or add a local exception for OpenCode.

This effectively prevents using OpenCode in corporate environments where Cortex XDR endpoint protection is enforced.

It may be a false positive, but it would be useful to investigate what in the distributed binary/build is triggering the detection and whether the binary could be submitted to Palo Alto Networks for false-positive analysis.

Plugins

No response

OpenCode version

1.18.31

Steps to reproduce

1. Install OpenCode.
2. Run opencode.
3. Cortex XDR detects the executable as malware.
4. Cortex XDR blocks its execution.

Screenshot and/or share link

Operating System

MacOS 26.7 (screenshot says 26.6, I updated the OS after this issue and it is still happening)

Terminal

No response

Start by reproducing the block with OpenCode 1.18.31 on macOS using Cortex XDR, then investigate what in the distributed executable or build triggers the detection. Done means identifying a likely cause and determining whether the executable can be submitted to Palo Alto Networks for false-positive analysis.