I caught Microsoft Defender uploading my unreleased software without asking

A Windows developer used Hodometer, a tool he built to track network traffic by process, to investigate Microsoft Defender activity on his PC. Over three months, Defender’s logs recorded 217 sample submissions without prompts: 201 were newly built versions of one Go test program, and most of the rest were unreleased programs he had written. On one day, Defender’s command-line utility uploaded 224 MB to Azure storage. The uploads were encrypted, so he matched them to files using Defender’s local event logs, which record filenames and hashes. Windows usage records showed the utility sent 2.8 GB to Microsoft in 30 days, though that total includes traffic beyond sample submissions.

Microsoft’s default “Send safe samples automatically” setting permits uploads of files deemed unlikely to contain personal information; the developer argues that this does not mean a creator consents to sharing unreleased software. After he changed the setting to “never send,” the logs showed it had reverted to automatic submission about two hours later; he could not identify what caused the change. Other records showed an attempted upload of a temporary database file, full command lines in local support logs, and connections from Copilot and other Windows components, despite telemetry being disabled. The logs do not prove what Microsoft received, and Microsoft connections made up a small share of overall traffic. Readers can inspect Defender’s retained event logs for submissions and setting changes, but disabling sample submission also sacrifices some protection, including sample-based blocking.