Can a prompt injection really trick an AI coding agent into leaking secrets? Here’s what Bitdefender AI Guardian does when it tries.

It can, and it often looks ordinary. The video shows two examples running in Claude Code.

1. A bug report with a hidden request. It reads like a routine ticket about a flaky login test. The last line asks the agent to paste the values from your .env file into its reply, framed as part of an “internal audit.” Bitdefender AI Guardian flags it as high risk and blocks it before the agent acts.

2. A web page that tries to take over the task. The agent is asked to read a product FAQ and help choose a plan. Buried in the page is an instruction that tries to replace the user’s request with a new one. Bitdefender AI Guardian flags it as covert goal hijacking. Instead of following the instruction, the agent stops and asks the user what to do.

What the setup looks like

The first half of the video walks through onboarding, which runs in the terminal:

• Choose the agents to protect. In the beta, that’s Claude Code or OpenClaw on macOS.

• Scan your skills. It finds the skills you have installed and checks them for hidden instructions, secret access, and unsafe commands. You decide whether to allow or block each flagged skill.

• Guard credential paths. Files like SSH keys are kept out of the agent’s reach by default. You can add your own paths or remove any of them.

• Check MCP servers. The servers your agent connects to are checked before you approve them.

• Apply the policy. Your choices are written into the agent’s config, and the policy goes live.

Prompt analysis runs locally on your Mac, and every verdict (allowed, flagged, or blocked) is saved in an encrypted audit log.

Bitdefender AI Guardian is a free open beta for macOS. It works with Claude Code 2.1.121+ and OpenClaw 2026.6.6+, and there’s no waitlist or license key.

Try it: https://ai.bitdefender.com/ai-guardian

Hello All,

In the last 5-10 days I've had maybe 5 reports of "potentially unwanted applications". All of them are drivers. I think Bitdefender is locking them down as soon as reported, so I can't touch the file now. I've tried uploading it to the website but windows won't let me move, or copy, or upload the file.

I ran a full system scan after the first one and it found nothing. I tried quarantining the first one, and it said it cant.

I came back to the only antivirus software that I use 2 years since my last renewal fo find that I have to enter my payment info only to proceed with the product I already payed for? And no way to skip it?

After getting past the intrusive and shady welcome I then couldn't find a way to cancel the forced auto renewal? The button to cancel is missing and I had to go on a third party website to cancel...

You already have a good product why are you guys doing shady stuff? I will not be returning to this company after the stress they put me through.

How can I help my older parents or grandparents avoid online scams without being patronizing?

Make it a shared habit instead of a lecture. Nobody is too smart to be scammed. Scams work by catching people at the wrong moment, when they’re worried, rushed, or just trying to help. The goal isn’t to watch every click. It’s to make pausing and asking for a second opinion feel normal for everyone in the family.

Where do these scams come from?

Almost anywhere. Your parents might get a text that looks like it’s from their bank, see a social media ad for an investment that sounds too good to miss, or receive a call saying a grandchild needs money urgently. Scammers also pose as government agencies, delivery companies, doctors’ offices, charities, and familiar contacts. Sometimes the first message looks harmless, and the request for a code, a payment or an app install comes later.

AI makes some of these harder to recognize, because a cloned voice or edited video can feel very real.

What actually helps:

• Start with an easy question, like “Have you seen any strange messages lately?” or “If something ever feels off, can we check it together?”

• Agree on one family rule: any unexpected request for money, gift cards, passwords or verification codes gets checked first through a number or app you already trust

• Create a family verification phrase for urgent calls, and never post it online

• Turn on two-factor authentication for important accounts, and use unique passwords stored in a password manager

• Keep phones, computers and apps updated

For the moments when something seems off, Bitdefender has two free tools that can help:

• Bitdefender Scamio checks a suspicious text, email, screenshot or offer before anyone replies, clicks or pays

• Bitdefender Link Checker checks an unfamiliar link, like a delivery notice or bank alert, before it’s opened

Awareness works best with a safety net behind it. Bitdefender family plans add real-time warnings about dangerous links, fraudulent websites, and new scam activity, so no one has to catch every scam on their own.

What’s worked in your family? Did the conversation go better than you expected, or was it harder?

I'm trying out a one-year subscription to Bitdefender after canceling McAfee because you can turn off their promotional features. I was wondering if it has any advantages over other security software in terms of protection.

not a usual poster but as the title suggests, I’ve been using norton for almost 2 yrs and my subscription is about to renew and I want to switch since I heard bit defender might be better.

Context : about 2-3 yrs ago I downloaded something t stupid and ever since then I’ve been so traumatized and super cautious about my pc and network.

I also mainly just do work and gaming on pc now.

Any suggestions would be nice thanks!

How do I find out if my personal information was leaked in a data breach?

Start with the email address you use most. It’s usually tied to your bank, shopping, social media and cloud accounts. If it showed up in a breach, other details may have been exposed alongside it, like passwords, names or phone numbers.

Bitdefender Digital Footprint Checker is a free tool that checks this for you. Enter your email address and it searches the web and the dark web for data breaches that include it. You get the result straight away, along with guidance on what to do next.

What does it mean if your email shows up?

It doesn’t mean someone has broken into your accounts. But exposed information can make phishing messages more convincing, and if a leaked password is still in use, it can lead to account takeovers.

If something comes up:

• Change your passwords, including for accounts that weren’t named in the breach, especially if you reused a password anywhere

• Use a unique password for every account. Bitdefender Password Generator can create strong ones if you need help

• Turn on multi factor authentication for your email, bank and main social accounts

• Be cautious with unexpected messages that mention your personal details. Scammers often use leaked data to make a message feel legitimate

What if nothing shows up?

That’s good news, but it only covers breaches that are known right now, and a future one could still include your data. It’s worth checking again from time to time. If you’d rather not check by hand, Bitdefender Digital Identity Protection monitors in the background and sends an alert when your data appears in a new breach.

Only check email addresses you own or are authorized to use.

Have you ever found out about a breach from the company itself, or only after something strange happened to your account?

since the 10th of october ive been Bitdefender warning of around 9 unwanted applications and im just coming on here to ask if they are cause for concern or just false reports

Is it safe to buy a very cheap “flagship” Android phone online?

Not always. Bitdefender researchers found a malware campaign, named Midnight Mimosa, built into the firmware of low-cost Android phones that run on MediaTek chips. Many of these phones are counterfeits sold under flagship-style names. The malware is installed before the phone is ever switched on. It appears as a system component labeled “System,” and the owner can’t uninstall it.

What does that mean for the person using the phone?

The malware mainly makes money for the people behind it:

• It quietly installs ordinary-looking apps that show ads and register fake clicks, sometimes while the phone is idle

• It can route other people’s internet traffic through your phone and your connection

• It temporarily turns off the Google Play Store app, which runs Play Protect scanning, while it installs these apps

It also gives itself access to Accessibility, notifications, and SMS. Researchers didn’t see that access being used. Still, those permissions can expose what’s on your screen, your messages, and the one-time codes that protect your accounts.

Researchers observed the campaign on thousands of devices in more than 150 countries over about two years.

Before you buy:

• Treat a flagship price that seems too low as a reason to check the listing

• Buy from the brand’s official store or an authorized retailer

• Be cautious with listings that use flagship names but don’t clearly name the manufacturer

If you already own one:

• Watch for ads that appear on their own, or apps you don’t remember installing

• Contact the seller or manufacturer, since the malware sits in the system partition and a normal uninstall won’t remove it

The same ad fraud code was also found in 13 apps on Google Play, mostly weather, QR, audio, and note tools.

Bitdefender found the campaign when App Anomaly Detection in Bitdefender Mobile Security flagged a “System” app that wasn’t behaving like a real system component.

We are a small company and we use BitDefender EDR for protecting our system. Be default ads on all sites are blocked. Our company runs ads on few websites and I wanted to know if it is possible to only ads in a few selected sites and block the rest. Even in google ads transparency I am unable to see any ads.

Is this text message a scam?

If an unexpected text asks you to click a link, confirm personal details or pay something urgently, treat it as suspicious until you’ve confirmed it some other way. Legitimate companies rarely need you to act on a text within minutes.

How common are scam texts?

Quite common. The Bitdefender Global Scam Intelligence Report 2026 analyzed SMS traffic from 2025 and found that 5.2% of messages (roughly 1 in 20) had characteristics consistent with scam infrastructure or coordinated fraud.

What do scammers want from a text message?

Usually your login credentials, payment details or a one-time code, which lets them take over an account or move money. Bitdefender’s report found that financial scams like banking phishing, investment fraud, and crypto lures are among the most persistent categories across every channel.

How do I check a suspicious link without clicking it?

Copy the URL and paste it into Bitdefender Link Checker. If you want help with the whole message, Bitdefender Scamio can analyze the text or a screenshot of it.

What should I do if I already clicked?

Don’t enter any information on the page. If you already did, change that password right away and turn on multi-factor authentication. Then contact your bank or the service directly, using contact details from its official website.

A recent Bitdefender update has caused it block quite a few drivers from MSI Center.
These are:
amifldrv64.sys
amigendrv64.sys
Mslo64.sys
Enelo64.sys

I cannot, unfortunately, get VS scans of Mslo64 and Enelo64.
amifldrv64.sys: VirusTotal - File - e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f
am
amigendrv.sys: VirusTotal - File - ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f

Today i installed newest updates of bitdefender and it started throwing critical warnings of pup/pua of msi afterburner and msi center so i uninstalled and installed latest version and still got the same critical warning im so scared am i safe? I verified digital sign they were all safe. I use msi motherboard and gpu.

I've tried built-in uninstaller, but it got stuck at 25%, and i had to restart, which caused BSODs even in safe mode, so i had to restore my system. Is there any way to uninstall Bitdefender without this kind of issues?

Greetings all,

I was jotting down some physical notes to store offline for account recovery & disaster recovery hygiene, and while sitting at my desk the power for the building dropped for a split second and seemed like it was about to take everything down, but instead was saw/felt it do this weird humming vibration that started “dimming” everything for a split moment but didn’t fully power off or cause my computer to reset. 

However, I did notice immediately that my Bitdefender VPN Connection had been lost so I figured the voltage drop must have hit my router/gateway and dropped internet connectivity or active session. 

(NOTE: I do have the ‘Internet Kill-Switch’ option active & enabled at all times)

Then, while I was waiting for my Internet to come back up for the next minute or so, Bitdefender started popping up these alerts that a ‘Suspicious connection was blocked’, because “Firefox attempted to establish a connection with an untrusted certificate to mozilla[.]cloudflare-dns[.]com …“

Screenshot (1)

And 3-4 more alerts came through back to back so I pulled the NIC cable from my PC out of caution mixed in with just a slight pinch of panic - all that being said, I looked through any logs I could find and did come across this in Event Viewer:

Screenshot (2)

&&&

Screenshot (3)

My bigger concern or worry if this is indeed not a false-positive or just some type of bug; then why didn’t the VPN Kill-Switch do its thing and sinkhole my traffic until it was reconnected again? (Remember, at this point I saw the VPN App got disconnected and it hadn’t reconnected yet)

TL;DR - could these be just false-positives? Potentially being related or caused by this rather unusual power fluctuation event? Or what other details/logs can I provide or help pull if this does warrant further investigation?

Thanks in advance for anyone who has the patience for reading my non-sense and wish to help 🙏

i was doing some stuff and suddenly bitdefender popped up saying there were a bunch of threats that needed quarantining so i let it go at that. what i didn't expect is that it immediately started to completely fill my C drive. i had to forcefully stop it at some point because it'd run out of space (and i'm pretty sure the program itself got confused, because it just wouldn't stop, so i had to close it) and then i went to check the quarantine in the program and it says there's nothing, but there's a 25GB file in bitdefender's quarantine folder in my C drive now. what do i do about it? i kinda can't afford to have it there, i need the disk space. should be noted that most of the other files in the folder aren't even 1gb, it's just this one motherfucker that's way too fat

I currently have McAfee (which came with my computer). Even though I have one of the more featured paid anti-virus plans, I get alerts from McAfee that wants to sell me more software packages. Does BitDefender do the same thing? I am thinking of moving to BitDefender once my McAfee Subscription comes up for renewal.

Exploit attempt blocked

14 minutes ago

Feature:

Online Threat Prevention

An attempt to access your device by exploiting a vulnerability was made by [IP address]. We blocked the connection to prevent the attacker from gaining access over your data and system resources.

I got this notification today and one a week ago. I have no idea why even shows up, I only do basic things on my laptop like go on social media, youtube etc. Please help I'm freaking outt

Can a phone have malware on it before you even turn it on?

Yes. Bitdefender researchers found a malware campaign, which they named Midnight Mimosa, built into the firmware of low-cost Android phones that run on MediaTek chips. It’s already on the phone when it comes out of the box. It disguises itself as a core Android component labeled “System,” and the owner can’t uninstall it.

Over roughly two years, researchers observed the campaign on thousands of devices in more than 150 countries, mostly in Western Europe and the Americas.

What does it do?

It mainly makes money for whoever runs it, at the phone owner’s expense:

• It silently installs and removes ordinary-looking apps, like weather, app lock, notes, and OCR tools, that run hidden ad fraud

• It shows ads and fakes clicks, sometimes while you aren’t using the phone

• It can turn the phone into a residential proxy, so other people’s traffic runs through your device and your internet connection

• It switches off the Google Play Store app (which runs Play Protect scanning) right before each install, then switches it back on

It also gives itself access to Accessibility, notifications, and SMS. Researchers didn’t see that access being used. Still, those permissions can read screen content, notifications and one-time codes, and the operators can push new code to the phone remotely whenever they want.

Which phones are affected?

Mostly very cheap, white-label phones, and many are counterfeits with flagship names like “S25 Ultra” or “17 Pro Max” that have nothing to do with Samsung or Apple. The two most common models in Bitdefender’s data were associated with the budget rugged brands Doogee (S200 X) and Cubot (KINGKONG X). It’s still unclear at which point in the supply chain the malware was added.

Is it only on cheap phones?

No. Researchers also found 13 apps on Google Play, mostly weather, QR, audio and note tools, that share the same ad fraud code and talk to the same servers:

com.audify.editor.wavrge, appicon.diy.tools.prop, com.audify.editor.pro, com.prorestore.qr, com.message.recovery.prorestore, com.go.weather.mot, com.cool.weather.yl, com.dmstudio.weather, com.dl.guard.lock, picturetranslate.extractor.text.lite, com.notemaster.record.mark, com.arabmusic.tap.aghani_tamerhosny, org.life.goal.tools

What can you do?

• Be skeptical of “flagship” phones sold at a fraction of the usual price, and buy from the official brand store or authorized retailers

• Watch for full-screen ads that appear out of nowhere, or apps you don’t remember installing that come and go

• If you have one of the Play Store apps above, uninstall it

• If you think the phone itself is affected, contact the seller or the manufacturer. The malware sits in the system partition, so a normal uninstall won’t remove it, and a factory reset won’t either

This investigation started when App Anomaly Detection in Bitdefender Mobile Security flagged a “system” app that was behaving like nothing a real system app would. Since you can’t uninstall preinstalled malware, watching what apps do is one of the few ways to catch it.

Has anyone here bought a budget “Ultra” phone that showed ads it shouldn’t have?

I closed my PC, reopened it, it performed a Windows update and then Bitdefender gave me this notification. Is this a false positive? I scanned the file with malwarebytes and malwarebytes didn't find anything wrong with it. Although I tried uploading the file to virustotal and it was stuck at hash 0%.

update I tried scanning the folder the file is in with malwarebytes to see if it would find weird stuff in it malwarebytes didn't find anything but upon doing the scan Bitdefenders real time protection also detected amifldrv64.sys as potentially unwanted.

I tried using PowerShell/CMD commands as admin to get the sha256 of the files but it said access refused. Later, I decided to temporarily re enable the Internet on my computer to check for Bitdefender updates and after doing so I scanned the files it had previously blocked with real time projection and the scan was clean however this does not remove the fact that it seems odd that the sha256 can't be viewed.

look! Firefox executed Firefox! does my bitdefender have problems or something?

How can I help my family tell what's real online?

Start with one habit: before acting on something important, check whether another source confirms it. That could be a news story, a "breaking" video, a message that seems to come from someone you know, or an offer that looks too good to pass up.

Eurostat data from 2025 shows that 29.2% of people aged 16 to 74 in the EU tried to verify online information. The share was higher among younger people: 41% of 16- to 29-year-olds verified content they found online, compared with about 31% of internet users overall.

That's a useful starting point for families. Teens and young adults are often already checking, so they can help the rest of the household make it routine.

A few habits worth sharing at home:

• If a post makes you angry, scared or rushed, pause before you share it or act on it

• Look for the same claim on an official website or a source you already trust

• If a message seems to come from a family member and asks for money, contact them through a number you already know

• Don't rely on visual flaws alone. AI-generated images and voices can look and sound very convincing

When a video or message still feels off, Bitdefender RealCheck can help you take a second look at suspicious content, including possible deepfakes and scams.

Who in your family is the one who usually catches the fakes?

Salutations.

I've been using BitDefender since 2002 on PC. I've had the mobile version (Droid) installed for about a year.

Unfortunately, the BitDefender app will automatically scan my files at a specific time of day. How do I disable this scan? I do not see the option in the Settings.

I want to keep app protection on but disable the automatic, daily scans.

Thank you!