[BUG] 2.1.114+ on Windows triggers Bitdefender Advanced Threat Defense, causes abrupt mid-session kills

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Starting with 2.1.114, every Claude Code version on Windows is killed abruptly mid-session on machines running Bitdefender. 2.1.112 is unaffected on the same machine, same Bitdefender configuration. Something in 2.1.114+ shifted the binary or runtime behavior enough to cross Bitdefender's Advanced Threat Defense (ATD) behavioral threshold.

Session starts and runs successfully for some minutes.

Process exits abruptly with no crash dump in ~/.claude/debug/.

Leaves orphaned claude.exe worker subprocesses (9 in one observed startup, all spawned within a 7-second window then killed together — classic ATD process-tree kill signature).
Often paired with dllhost.exe (COM Surrogate) Application Hang events in Windows Event Log roughly contemporaneous with the kill — suggests Bitdefender's shell-extension hooks are also
destabilizing the ConPTY/terminal substrate.
Bitdefender's user-visible Notifications panel does not always show a block for these kills
— they appear in C:\ProgramData\Bitdefender\DTrace\ traces but not in ATD's "blocked
applications" UI.

What Should Happen?

Claude should not crash mid session.

Error Messages/Logs

Steps to Reproduce

1. Install Bitdefender (any recent consumer version) with default ATD settings.
2. Install Claude Code 2.1.114 or later.
3. Run claude from cmd and use it normally.
4. Within minutes to ~an hour, the session exits abruptly.

Claude Model

Opus

Is this a regression?

Yes, this worked in a previous version

Last Working Version

2.1.112 (possibly 2.1.113)

Claude Code Version

2.1.145 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

<img width="666" height="476" alt="Image" src="https://github.com/user-attachments/assets/a11a3bb7-e6ea-45ae-bd6e-0a507b4ea669" />