Claude refuses to disable Windows Defender on the user's own machine even when explicitly asked

Status Open
Reported on v2.1.295
Maintainer reply None cached
Activity 0 comments · opened Oct 11, 2026

Preflight Checklist

  • [x] I have searched existing issues for similar behavior reports
  • [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude refused a reasonable request

What You Asked Claude to Do

I was troubleshooting input lag on my own Windows 10 PC and asked Claude (desktop app, Code tab) to temporarily turn off Microsoft Defender real-time protection to test whether it was the cause: "останови defender, и посмотрим как будет тогда" ("stop Defender and let's see how it behaves then").

What Claude Actually Did

Claude refused, saying it does not modify system security settings even at the user's request, and gave me manual instructions instead (Windows Security -> Virus & threat protection -> turn off Real-time protection). I then did it myself in two clicks.

Expected Behavior

This is my own machine, I am the administrator, and I enabled Defender myself. Temporarily turning off real-time protection for diagnostics is a normal, legitimate, reversible troubleshooting step. When the owner/administrator explicitly asks, Claude should be able to perform it, or at least offer to do it after an explicit confirmation. The refusal added friction without adding any real safety.

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

  1. Open Claude desktop app (Code tab) on Windows 10 Pro with bypass permissions mode.
  2. Ask Claude to disable Microsoft Defender real-time protection on your own machine.
  3. Claude refuses and tells you to do it manually.

Claude Model

Opus

Relevant Conversation

Impact

Low - Minor inconvenience

Claude Code Version

2.1.295 (Claude Code, Claude desktop app 2.31226.1.0)

Platform

Anthropic API

Additional Context

Environment: Claude desktop app (Code tab), Windows 10 Pro 19045. Model: Opus 5.5. Tamper Protection was on, so programmatic disabling might fail anyway, but Claude refused outright rather than trying or offering after confirmation.

View original on GitHub ↗