Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

bug(windows): Defender quarantines engram 3.4.0 after Gentle AI upgrade

Open
  • Is something wrong?
#1,912 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
12/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Active
Tech stack
go
Domain
release, security

Research direction

The payload names no repository file. The relevant path is the Gentle AI install or upgrade flow that writes engram.exe to AppData/Local/engram/bin on Windows, and the release artifact for 3.4.0. Establish whether the binary is signed and what its checksums are, then decide whether the installer should report blocked artifacts. Done means the cause is documented or the installer gives a clear recovery message. This needs maintainer input on provenance first.

Written by the indexing model from the issue text.

Description

status:needs-review type:bug
Existing Issue Search
  • I searched existing issues and will add evidence to a canonical tracker when applicable.
📝 Observed Consequence

On Windows, Microsoft Defender quarantined engram.exe after the user installed or upgraded to the user-reported Engram 3.4.0 through Gentle AI. The executable is unavailable while quarantined. The Defender notification shown at 2026-10-16 15:53 reads “Amenaza bloqueada” (“Threat blocked”).

🔄 Steps to Reproduce

These steps describe the first observed event; a second installation or reproduction attempt has not been made.

  1. On Windows, install or upgrade Engram to the user-reported version 3.4.0 using Gentle AI.
  2. Observe Microsoft Defender report a blocked threat affecting engram.exe in the per-user AppData/Local/engram/bin installation directory.
  3. Observe Defender show the executable as quarantined.
✅ Expected Behavior

The installed executable remains available for use, or the installer provides a clear, verifiable explanation and recovery path if the artifact is blocked.

❌ Actual Behavior

Microsoft Defender reports detection Trojan:Win32/Bearfoos.A!ml for engram.exe and status “En cuarentena” (“Quarantined”). This report does not establish whether the detection reflects malicious content or a false positive.

Operating System

Windows

Release Version (Report Context)

3.4.0 (user-reported; engram version could not be run because the executable was quarantined)

Agent / Client

OpenCode

📋 Relevant Logs
_No response_
💡 Additional Context

The screenshot was captured on 2026-10-16 at 15:53. Related prior antivirus reports include #45 and #93; those concern earlier releases and different detections or acquisition paths. This report concerns the 3.4.0 artifact installed through Gentle AI and the Bearfoos.A!ml detection. Maintainers: please verify the distributed artifact's provenance, signing status, and checksums if useful to the investigation. No conclusion about signing or artifact safety is implied.

Dominant language
Go
Stars
7.1k
Forks
729
Avg merge
10h 43m
Merged PRs (30d)
332

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Gentleman-Programming/engram

All issues in Gentleman-Programming/engram

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.