[BUG] Claude Desktop 2.9939.2 (Windows): SentinelOne flags signed launcher claude.exe as malware - app killed, quarantined and remediated

What's Wrong?

Since the Claude Desktop auto-update to 2.9939.2 (Windows, Squirrel/.exe install), SentinelOne classifies the app's launcher %LOCALAPPDATA%\AnthropicClaude\claude.exe as malware. Each detection does three things:

• kills Claude Desktop and its whole process tree
• quarantines the launcher, so the app can't start again
• runs SentinelOne's "Remediate" step, which deletes files the flagged process tree created

This happened 3 times in under 18 hours, including after two clean reinstalls with the official installer:

| Detection (UTC) | Processes killed | Quarantine | Remediate | Rollback |
|---|---|---|---|---|
| 2026-09-25 15:42 | 120 | Success | Success | Failure |
| 2026-09-25 19:54 | 110 | Success | Success | Failure |
| 2026-09-26 09:11 | 224 | Success | Success | Failure |

The flagged file has a valid Authenticode signature (CN="Anthropic, PBC"), so this looks like a false positive on this build's launcher. The damage went beyond the app: Remediate also removed files in local project folders that Claude Code sessions had written to. In one case, a repository's .git directory disappeared.

What Should Happen?

SentinelOne shouldn't classify the signed launcher as malware. Please look into why the 2.9939.2 launcher is flagged and raise it with SentinelOne as a false positive. Ideally, ship a build that isn't flagged.

Error Messages/Logs

SentinelOne/Operational, Event ID 31 (identical all 3 times):
Malware detected! Name: claude.exe Path: C:\Users\<user>\AppData\Local\AnthropicClaude\claude.exe Detection engine: windows.executables

Event ID 32 per detection: Kill Success (x110-224), Quarantine Success, Remediate Success, Rollback Failure ("no snapshots were found")

Flagged file (same after each reinstall):
Size:    448,672 bytes
SHA-256: 071721357002535AF2C7CC15381EF5AF45D9997C07F8CD2306374EC4803FECF2
Authenticode: Valid - CN="Anthropic, PBC"

Steps to Reproduce

1. On Windows 11 with the SentinelOne agent 25.1.3.334 (auto-mitigation on), run Claude Desktop 2.9939.2. You can install it with the .exe installer or let an older version auto-update.
2. Use it normally (Chat, Cowork, Code sessions, local MCP servers).
3. Within 40 minutes to a day, SentinelOne flags the launcher, kills Claude, quarantines the launcher and remediates.
4. Reinstall. The new launcher has the same hash and is flagged again.

Is this a regression?

Yes. Last working version: 2.7032.0. SentinelOne's log on this machine goes back to 2026-06-23. It shows zero detections across about 31 Desktop versions since late July (1.24012.9 through 2.7032.0). The first detection came about 19 hours after the update to 2.9939.2.

Environment

• Claude Desktop 2.9939.2 (Electron 44.4.3, bundled Claude Code 2.1.281)
• Windows 11 Pro x64, build 26200
• Only the root launcher is flagged, not app-2.9939.2\claude.exe
• The VS Code extension binary (2.1.283) on the same machine has not been flagged
• Rollback failed every time, so changed files weren't reverted. Files the flagged process tree created were deleted.