Over three months, Microsoft Defender sent 217 files from one developer’s Windows PC to Microsoft for analysis. Garrett Stimpson, who found the uploads, counted 201 builds of the same Go test program among them, and most of the remaining sixteen were other programs Stimpson had written and never released. No prompt appeared for any of them.
Stimpson wrote up the discovery in a careful account of catching Defender at it, and the tone is closer to a lab notebook than a complaint. The uploads happened under a setting that Microsoft ($MSFT) documents openly, called Send safe samples automatically, and it is on by default. Nothing was hidden in the usual sense; it was simply never put in front of the person whose files were leaving.
That leads to a narrower question than whether antivirus software should talk to its maker. Who decides what leaves a developer’s machine, when the decision was made once, in advance, by a box nobody remembers ticking? The logs give an answer that is a little uncomfortable and also fairly ordinary: the default decides, every time, including for files that did not exist when anyone agreed to it.
How a Traffic Meter Found the Uploads
Stimpson found the uploads while chasing something mundane, a lagging connection. Stimpson had built a Windows tray tool called Hodometer to track network traffic by process and by destination, and an AI agent was using it to sort through connections. Across about one hundred hours, Microsoft programs accounted for less than 5 percent of downloads and uploads, which looks unremarkable on its face.
The per-process view changed the picture. One program, MpCmdRun.exe, the command-line utility behind Defender, sent 224 megabytes to Microsoft’s Azure storage in a single day. It moved in bursts of roughly 28 megabytes a minute, with very little coming back. Windows’s own per-app usage records put the thirty-day total at 2.8 gigabytes, about 80 percent of everything the PC uploaded to Microsoft in that period.
From there the trail ran through the logs Windows writes for itself. Defender’s operational log records the file name and hash of every submission under Event 2050. The support log showed the sequence behind one of them: a test binary matched a low-confidence signature, Defender asked the cloud for a verdict, and the cloud answered with an address to upload the file to.
Albert Rutherford’s Tools of Systems Thinkers offers a rule that explains why the meter mattered: “Use measurable things as elements.” Rutherford contrasts a level of sadness, which can be tracked, with a general mental state, which cannot. A system can’t be reasoned about until you choose parts of it that can be counted, because a vague condition gives you nothing to compare from one day to the next.
Unease about telemetry is a mental state. Plenty of developers have it, and it rarely leads anywhere, because “Windows talks to Microsoft too much” cannot be tested. Bytes per process per destination can be tested. Once Stimpson had that element, the question turned from a mood into a ledger with 217 rows, each carrying a file name and a date.
The measurement cuts both ways, and that is part of its value. A fifteen-minute capture in the same investigation showed Microsoft destinations accounting for under one megabyte of 343 megabytes of traffic. Measured honestly, most of Windows was quiet. The thing worth attention was one process doing one job very diligently.
What Send Safe Samples Automatically Decides
Defender’s reasoning is easy to reconstruct, and it is not sinister. An antivirus product learns about new threats by examining files it has never seen. A file with no reputation, a weak match against a known threat, and no history across Microsoft’s customers is the sort of thing a scanner should want to look at closely. Sending it to the cloud for deeper analysis is how one infected machine ends up protecting the next million.
Microsoft describes the setting in those terms. Its documentation lists example file types such as .exe, .dll, .bat, and .scr, and Stimpson concedes that the list is illustrative. Even a Python script that Defender pulled from the Recycle Bin and uploaded in August does not clearly break the stated policy. Microsoft also says that turning the setting off gives up block at first sight, the feature that pauses a suspicious new file until the cloud weighs in.
The trouble is what a development machine looks like to that logic. Every compile produces a new binary with a new hash. Of the 217 submissions, Stimpson counted 216 distinct hashes, and on the busiest day Defender sent seventy-five files. To a reputation system, a programmer at work resembles a factory turning out unknown executables all afternoon, which is the very thing the system was built to examine.
An architecture firm offers a useful comparison. Picture a building whose security desk photocopies every unfamiliar document that passes through the lobby and sends the copy to head office for review. For a firm that mostly receives mail, the desk rarely touches anything sensitive. For a firm that spends all day drafting new plans, almost every document is unfamiliar, so the desk ends up copying the drawings the firm most wants to keep private.
The parts map closely. The lobby is the network connection, the unfamiliar document is a fresh build with no reputation, head office is Microsoft’s cloud, and the desk’s standing instruction is the default. Nobody at the desk is snooping. The rule was written for a building full of incoming mail, and a development machine is a building full of drafts.
So the setting fires most often on the files a developer most wants to keep private. Stimpson’s objection is precise: “I object to uploading my unreleased builds under that default.” The word doing the work there is “unreleased.” The same file is a sample to Defender and a work in progress to its author, and both descriptions are accurate.
Peter Hollins, in Mental Models, recommends settling on a default choice up front for decisions you cannot make in time. A default chosen in advance, Hollins argues, will already fit what you wanted, so you can live with whatever happens. That advice works well for a person setting defaults for themselves.
It works differently when one company sets a default for every Windows PC that ships. The requirements a default fits are the setter’s, and Microsoft’s default fits Microsoft’s requirements well. A security vendor wants as many unknown files as possible, as early as possible, from as many machines as possible. A developer with an unreleased product wants control over which builds leave the building, and the default was never written with that person in mind.
A Choice Made Once Never Finishes Choosing
Defaults last, and Robert Cialdini’s Influence explains part of the reason. Once a person has settled a question, Cialdini writes, consistency offers “a very appealing luxury”: no more weighing pros and cons, and no more fresh decisions. You do whatever is consistent with the earlier choice and move on to something else.
That luxury is why most people never revisit a privacy setting. A choice made during Windows setup, or never consciously made at all, becomes the settled position, and every later file is handled by it without a second thought. Nobody is deceived in this; it is the ordinary economy of attention. The setting does the thinking so the person does not have to.
Stimpson’s logs show something stranger. On October 28, Stimpson ran a command setting sample submission to never send, and Event 5007 recorded the change at 5:56 p.m. At 7:53 that evening, another 5007 event recorded the setting flipping back to automatic. No uploads were logged during those two hours, and twenty-five more were logged after the setting returned.
Stimpson is candid about the limits of the evidence: “I don’t know what changed it back.” The logs that could have named the responsible process had already rotated out. A quick scan started under Stimpson’s own account nine seconds after the reversal, and a click somewhere in Windows Security is one plausible explanation. It would be unfair to read malice into a reset nobody can trace.
Even so, the reversal shows something true about defaults. Cialdini’s luxury rests on the idea that the settled decision belongs to the person who enjoys not thinking about it. Here the settled position had a direction of its own. A user could change it, and the system could drift back toward its original choice, so the decision was never fully the user’s to settle.
Privacy settings are usually pictured as a single decision, made or declined once. In practice Send safe samples automatically decides again for every new file, which on a development machine means dozens of times a day. Consent given at setup becomes a standing grant that covers files written months later, by a person who never saw the question.
That standing grant matters more as the files change character. A setting designed with downloaded installers in mind now meets machines that generate their own code constantly, from compilers, from scripts, and increasingly from AI agents writing and running test programs. Stimpson’s 201 builds of one Go test program are the sort of output that kind of loop produces.
Both parties here describe the same file accurately. The default picked one description, once, and then applied it without comment to thousands of decisions that nobody actually made.
Where Builds Could Go Next
A standing grant that covers files nobody has written yet may not survive the way developers now work. As development machines go on producing fresh, unrecognized binaries every hour, Microsoft could offer separate defaults for build folders and for downloaded files, with Defender asking before a compiled program leaves the machine. Defender already lets users exclude folders from scanning, so the parts for that distinction exist.
Developers, for their part, may come to treat a per-process traffic meter the way they treat a debugger: a normal tool that sits open during work, rather than a forensic instrument pulled out after something feels wrong. Hodometer’s per-process view is what turned a vague suspicion into 217 rows. A later version of that habit could be a meter that flags any upload of a file from a project folder as it happens.
Microsoft would gain from that visibility too. A developer who can see which builds went out, and why, is more likely to leave cloud protection on than one who discovers 217 uploads after the fact and switches everything off. The likelier long-run outcome is that sample submission becomes something the user watches happen and approves, rather than something a checkbox decided once in the past.
Protection That Has to See
Underneath all of this sits a fact about protection that no setting can remove. A scanner that learns from samples has to see unfamiliar files, and the most unfamiliar files on any machine are the ones its owner has just made. The protection and the privacy concern are aimed at the same objects, which is why neither side can simply win.
Stimpson accepts that trade openly: “On a development machine, I want control over which builds leave the PC.” The same sentence goes on to acknowledge that changing the setting gives up part of Defender’s protection. That is the honest shape of the choice, and it deserves to be made by the person who owns the builds.
Cialdini’s luxury of not thinking is real, and most people should enjoy it for most files. Downloads, email attachments, and installers are where cloud analysis earns its place, and few people want a question every time one arrives. The decision worth surfacing is the narrower one: a file the user created, about to leave the machine.
Asking at that moment costs a second of attention. Settling it once at setup costs control over every build that follows, including the ones written by tools the user has not installed yet. A checkbox can consent to the files you have, but only a question can consent to the ones you have not written yet.
Sources
Hollins, Peter. Mental Models.
“I caught Microsoft Defender uploading my unreleased software without asking.” garrettstimpson.ca.
PhD, Robert B. Cialdini. Influence.
Rutherford, Albert. Tools of Systems Thinkers.
Leave a Reply