Defender uploaded unreleased software without asking

A software developer has discovered that Microsoft Defender uploaded unreleased programs from his computer to Microsoft without asking. According to the story shared on Hacker News, he noticed the activity while investigating a separate problem using a connection-monitoring tool he had built himself.

Defender's event log recorded 217 sample submissions over three months. According to the developer, 201 of these were different builds of the same Go test program, while 16 came from other unreleased projects. The busiest single day logged 75 submissions, and he says he never saw a consent prompt for any of them.

The article explains that Microsoft offers automatic submission of files judged unlikely to contain personal information as the default setting. That is exactly where the developer's objection lies: the absence of personal data does not mean he is willing to share the program. Defender also tried to send a Python script from his Recycle Bin and a temporary file belonging to a local development database; the second attempt failed.

According to the report, the developer disabled submission to stop the uploads. But roughly two hours later the setting turned itself back on, and 25 more uploads followed. It is unclear why the setting reverted; the logs that would identify the responsible process had already rotated out. The practical takeaway for developers: check Defender's event log to see which files are being sent, and verify now and then that the setting has stayed off.