Windows has been silently uploading your files to Microsoft — and it's enabled by default.
A dev caught Microsoft Defender exfiltrating 217 files over 3 months. Unreleased programs, scripts from his Recycle Bin. Zero prompts. Zero consent.
The culprit? "Automatic sample submission." Microsoft calls them "safe samples" and ships them without asking.
How to turn it off:
1. Windows Security → Virus & threat protection → Manage settings
2. Disable "Automatic sample submission"
3. Check back in a few days — his setting flipped back on after 2 hours
Want to see what's already been sent?
1. Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational
2. Filter Event ID 2050
Trade-off: Disabling this slows Defender's ability to detect brand-new malware. But if you're building anything sensitive or running crypto tools, you probably don't want Microsoft scraping your machine.
Your PC. Your files. Your call.
A dev caught Microsoft Defender exfiltrating 217 files over 3 months. Unreleased programs, scripts from his Recycle Bin. Zero prompts. Zero consent.
The culprit? "Automatic sample submission." Microsoft calls them "safe samples" and ships them without asking.
How to turn it off:
1. Windows Security → Virus & threat protection → Manage settings
2. Disable "Automatic sample submission"
3. Check back in a few days — his setting flipped back on after 2 hours
Want to see what's already been sent?
1. Event Viewer → Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational
2. Filter Event ID 2050
Trade-off: Disabling this slows Defender's ability to detect brand-new malware. But if you're building anything sensitive or running crypto tools, you probably don't want Microsoft scraping your machine.
Your PC. Your files. Your call.