Running agent update on Windows consistently triggers Microsoft Defender, which detects the update process as Trojan:Win32/ClickFix.R!ml and blocks it.
As a result, the update fails with spawn EPERM.
I found the existing report about Microsoft Defender detecting inno_updater.exe as a false positive (Trojan:Win32/Wacatac.B!ml), but this appears to be a different issue because the detection occurs while updating the Agent CLI via PowerShell rather than the IDE updater.
Steps to Reproduce
Open PowerShell.
Run:
agent update
Microsoft Defender detects Trojan:Win32/ClickFix.R!ml.
The update is blocked and terminates with:
Error: Update failed: spawn EPERM
Expected Behavior
agent update should complete successfully without being blocked by Microsoft Defender.
The command blocked by Defender downloads and executes the update script from https://cursor.com/install.
I’m wondering whether this PowerShell-based update mechanism is expected for the Agent CLI, and whether this is another Defender false positive similar to the previously reported Wacatac detection.
Does this stop you from using Cursor?
Sometimes - Cursor itself works, but Agent CLI updates are currently blocked.
For AI issues: which model did you use?
Model name (e.g., Sonnet 4, Tab…)
For AI issues: add Request ID with privacy disabled
Request ID: f9a7046a-279b-47e5-ab48-6e8dc12daba1
For Background Agent issues, also post the ID: bc-…
Additional Information
Add any other context about the problem here.
Does this stop you from using Cursor?
Yes - Cursor is unusable
Sometimes - I can sometimes use Cursor
No - Cursor works, but with this issue
The more details you provide, the easier it is for us to reproduce and fix the issue. Thanks!
I retried agent update today, and both completed successfully.
The issue is no longer reproducible on my machine, and Microsoft Defender no longer blocks the update process.
I’m not sure whether this was resolved by a Microsoft Defender signature update or by changes to the update mechanism, but everything appears to be working now.
Yesterday, agent update completed successfully, so I initially thought the issue had been resolved. However, today Microsoft Defender started detecting Trojan:Win32/ClickFix.R!ml again.
Simply running agent (without explicitly running agent update) also triggers the same Defender detection. However, the Agent CLI still starts and works normally—the only thing being blocked appears to be the background update process.
