[BUG] download-skill zip is retried indefinitely after AV quarantine, generating hundreds of detections (extends #53572)

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

Claude Code Version

2.1.220

Operating System

Windows 11 Pro, build 10.0.26200.8875

Steps to Reproduce

1. Run Claude Code on Windows with an endpoint protection product that scans %TEMP% on write.
2. Use it normally over a period of days.
3. Observe repeated antivirus detections on %TEMP%\download-skill_<id>-<suffix>.zip.
4. Observe that the same skill id is re-downloaded indefinitely, because each copy is quarantined before it can be used, and the download is retried.

What's Wrong?

This extends #53572, which reported the same download-skill_*.zip files being quarantined by Bitdefender as JS.TeslaCrypt.4.Gen. That issue was closed as not planned and marked stale.

The problem is not limited to one vendor, and the consequence is more serious than a recurring alert. Because the download is retried after every quarantine, it forms a loop that generates detections indefinitely. On a managed endpoint that volume can cross an EDR's outbreak threshold and put the whole machine into an elevated response state.

That is what happened on my machine. I exported the full endpoint-protection event log (874 events, 16 April – 29 July) and analysed it.

Every single detection of this signature — 836 of them — was on a download-skill_*.zip file. No exceptions. They all carried the same skill id, with only the temp-file suffix varying, which is consistent with one bundle being retried rather than many distinct downloads.

Daily counts once the loop began:

15 Jul   75        22 Jul   31
16 Jul   81        23 Jul   48
17 Jul   60        24 Jul   85
18 Jul   99        25 Jul   15
19 Jul   24        26 Jul   12
20 Jul   45        27 Jul   24
21 Jul   36        28 Jul  129   <-- crossed the outbreak threshold

Before this started, the machine averaged fewer than two detections per month.

Sophos documents that an outbreak is declared at 100 detections in 24 hours. 28 July reached 129 — the only day in four months above that line — and an outbreak was declared that evening. The endpoint then entered Adaptive Attack Protection, an elevated state Sophos applies when it believes an active hands-on attack is underway.

From the following morning, that state began blocking unrelated software on the machine:

• every unsigned executable produced by a local build (an Electron app packaged with electron-builder), quarantined within seconds of being written
• previously working installers of that same app, deleted on access
• AnyDesk, blocked as T1219 Remote Access Software

None of that had anything to do with Claude Code. It was collateral of the detection volume. The machine is still in that state and requires an administrator to clear it.

Expected Behavior

A quarantined skill download should not be retried indefinitely. Something like:

• back off and stop retrying after a small number of consecutive failures for the same skill id
• surface a clear error (skill <id> could not be installed — the downloaded file was removed by another process) rather than failing silently
• ideally, verify the file still exists after writing it and treat disappearance as a terminal error for that skill

Any of these would cap the blast radius at a handful of detections instead of hundreds.

Actual Behavior

The download is retried indefinitely, roughly 12–15 times per hour during active use, for as long as the tool is used. In my case that ran for 15 days and produced 836 detections.

Error Messages/Logs

File "C:\Users\<user>\AppData\Local\Temp\download-skill_<id>-XbDh3WhgWmLu.zip" belongs to virus/spyware 'Mal/DrodZp-A'.
File "C:\Users\<user>\AppData\Local\Temp\download-skill_<id>-njuxLAy8auyc.zip" belongs to virus/spyware 'Mal/DrodZp-A'.
File "C:\Users\<user>\AppData\Local\Temp\download-skill_<id>-uP_jzNqLmr8U.zip" belongs to virus/spyware 'Mal/DrodZp-A'.

Same skill id throughout; only the trailing suffix changes.

Bitdefender reported the same files differently, per #53572:

The file C:\Users\<user>\AppData\Local\Temp\download-skill_<id>-<suffix>.zip is infected with JS.TeslaCrypt.4.Gen and was moved to quarantine.

Additional Information

The detections follow human working hours, which suggests the retry is driven by session activity rather than a background timer. Distribution of all 836 detections by hour of day:

 0:00   69      8:00   48     16:00   51
 1:00   25      9:00   78     17:00   21
 2:00   18     10:00   75     18:00   39
 3:00   10     11:00   36     19:00   48
 4:00    0     12:00   42     20:00   27
 5:00    0     13:00    9     21:00   15
 6:00    3     14:00   78     22:00   36
 7:00    9     15:00   48     23:00   51

Zero at 04:00 and 05:00, a dip to 9 at 13:00 between 42 and 78 either side, and Sunday the lowest day of the week. That shape is useful for diagnosis and it is also what let me demonstrate to my IT team that the source was a foreground application and not an implant.

Why this is worth reopening even though the file is benign. I am not asking anyone to make a false positive go away — that is between the AV vendors and Anthropic, and both vendors here are using generic archive heuristics. The retry loop is the part that is in Claude Code's control, and it is what converts a single benign false positive into an endpoint-wide security incident.

Two vendors so far (Sophos Mal/DrodZp-A, Bitdefender JS.TeslaCrypt.4.Gen), and #53572 reported it on the same Windows build as mine.

Workaround for anyone else who lands here: ask whoever administers your endpoint protection to exclude %TEMP%\download-skill_*.zip. Without that the count keeps climbing. If your machine has already tripped an outbreak or elevated-protection state, that has to be cleared separately by an administrator — excluding the pattern afterwards is what stops it recurring.

Related: #53572