Windows: `codex update` installer blocked by McAfee Real Protect as `rp-fileless`

Start at the codex update entry point and trace its Windows path to the remotely fetched install.ps1; the issue provides the failing command and official package/checksum URLs but no repository file path or test. Compare the script-based update with the verified codex-package-x86_64-pc-windows-msvc.tar.gz workaround. Done means a supported update path works with McAfee's script scanning, or gives safe recovery instructions while retaining checksum verification.

Product surface

Codex CLI on Windows.

Environment

• Codex CLI: reproduced on 0.145.0 and again after manually updating to 0.146.0
• OS: Windows 11 Pro, version 10.0.26200, build 26200, x64
• Antivirus: McAfee WPS 1.40.161.1
• Microsoft Defender antivirus and real-time protection were disabled

Issue

Running:

codex update

launches:

powershell -ExecutionPolicy Bypass -c '$env:CODEX_NON_INTERACTIVE=1; irm https://chatgpt.com/codex/install.ps1 | iex'

PowerShell then fails before the installer can run:

This script contains malicious content and has been blocked by your antivirus software.
FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand

McAfee quarantined the downloaded installer with:

Detection: Real Protect-PSL!ee70f112cad0
Category: rp-fileless
File: install.ps1

The same script was also blocked when downloaded to a file and run with powershell.exe -File, so the failure is not caused solely by the irm | iex invocation.

Provenance checks

The blocked script was fetched directly from:

https://chatgpt.com/codex/install.ps1

Its SHA-256 was:

391f247de2c70c7e99041979ec02dae7e76be27ac9cfc1dfe7c1eb21d48d8b97

That exactly matched the install.ps1 digest in OpenAI's official 0.146.0 release metadata at https://releases.openai.com/codex/channels/latest.

There were no matching Microsoft Defender events. Windows Security Center showed McAfee active, while Get-MpComputerStatus reported Defender antivirus and real-time protection disabled.

Reproduction steps

1. Use Windows with McAfee WPS active.
2. Install Codex CLI using the standalone Windows layout.
3. Run codex update.
4. Observe ScriptContainedMaliciousContent before the installer executes.
5. Download the same official script and run it from disk.
6. Observe the same block and a McAfee quarantine entry classified as rp-fileless.

Expected behavior

codex update should update the CLI successfully on a standard Windows system with a supported third-party antivirus product, or provide a safe supported fallback when script scanning blocks the PowerShell installer.

Workaround verified

I manually downloaded the official codex-package-x86_64-pc-windows-msvc.tar.gz and codex-package_SHA256SUMS assets from releases.openai.com, verified the release-metadata and manifest checksums, extracted the package into the existing versioned standalone layout, and switched the managed current junction. Codex 0.146.0 then ran successfully.

However, codex update on 0.146.0 still reproduces the McAfee block, so future self-updates remain broken.

Suspected trigger

The installer combines several patterns that may trigger fileless-malware heuristics:

• PowerShell ExecutionPolicy Bypass
• downloading a script and passing it directly to Invoke-Expression
• embedded C# via Add-Type
• P/Invoke calls to CreateFileW and DeviceIoControl
• FSCTL_SET_REPARSE_POINT junction manipulation

These operations can be legitimate for an installer, but overlap with behavior detected by script/fileless-malware engines.

Suggested improvements

• Avoid the download-and-Invoke-Expression update path on Windows.
• Provide a native or direct-package fallback that retains the existing checksum verification.
• Detect ScriptContainedMaliciousContent and print supported recovery instructions.
• Consider reducing the AV-sensitive junction-retargeting implementation or submitting the exact official installer to McAfee for false-positive allowlisting.

Related but not identical: #25425 reports a similar antivirus-sensitive PowerShell pattern with Norton.