You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Skip to the end if you just want the 'What to do for Wayland'
Introduction
Modern antivirus software is one of the most important security controls on any computer. It protects against known malware through signature scanning, detects previously unseen threats through behavioural analysis, and monitors files and processes in real time.
Unfortunately, the very techniques that make modern antivirus products effective also create problems for legitimate software—particularly development tools, automation frameworks, system administration utilities, and database platforms.
This often surprises users. The immediate reaction is frequently:
"If antivirus doesn't like it, surely the software should just be rewritten."
In many cases, that simply isn't possible.
The software is behaving exactly as it was designed to behave. The behaviour is necessary to perform its intended function, even though that behaviour resembles techniques used by malware.
As a result, almost every major antivirus vendor provides mechanisms for creating exclusions or exceptions. These are not intended as a way to "turn off security," but as a controlled method of telling the security software:
"I know this application. I trust it. Allow it to perform its legitimate work."
Understanding why these exclusions exist requires understanding how modern antivirus products operate.
Two Different Problems
Although users often refer to them collectively as "antivirus issues," there are actually two very different classes of problems.
The first concerns behavioural detection.
The second concerns real-time file scanning.
They have different causes, different symptoms, and different solutions.
Behavioural Detection (Advanced Threat Detection)
Traditional antivirus products relied almost entirely on signatures.
If a file matched a known malicious signature, it was blocked.
Modern malware evolves too quickly for this approach to be sufficient.
Today's security products therefore include behavioural engines. Bitdefender's Advanced Threat Defense (ATD), Microsoft Defender's Behaviour Monitoring, CrowdStrike Falcon, SentinelOne, and many others continuously watch what running programs do rather than simply examining what they contain.
Typical monitored behaviours include:
creating executable files
downloading code
launching child processes
modifying protected directories
injecting code into other processes
altering registry startup entries
performing privilege escalation
creating scheduled tasks
rapidly modifying many files
communicating with external services
dynamically loading code
Individually, none of these activities necessarily indicates malware.
However, when enough suspicious actions occur together, the behavioural engine concludes that the process resembles malicious software and intervenes.
This is exactly how products detect previously unknown ("zero-day") malware.
Unfortunately, legitimate software often performs exactly the same actions.
Why Legitimate Software Looks Suspicious
Many modern developer tools deliberately perform actions that are almost indistinguishable from malware.
Examples include:
software installers
package managers
language runtimes
IDEs
build systems
remote administration tools
deployment frameworks
virtualization software
AI development tools
automation frameworks
These applications routinely:
download executable code
verify signatures
unpack archives
generate binaries
replace existing executables
launch helper processes
communicate over encrypted connections
modify configuration files
interact with protected operating system APIs
From the perspective of a behavioural detection engine, these activities are not inherently different from those performed by sophisticated malware.
The difference lies in intent, which is extremely difficult for automated systems to determine.
Why the Software Cannot Simply Be Changed
A common suggestion is:
"Why don't the developers rewrite the software so antivirus doesn't detect it?"
This sounds reasonable until one considers what the software actually does.
Suppose an application is designed to:
generate source code
compile programs
execute helper processes
update itself
install dependencies
manipulate repositories
launch interpreters
modify project files
These activities are the entire purpose of the application.
Removing them would not make the application "more compatible."
It would simply make it incapable of performing its intended job.
This is particularly true for development environments such as Wayland Core and similar AI-assisted coding tools.
Their purpose is to automate software development.
Automating software development necessarily involves creating files, modifying code, executing compilers, launching tools, downloading dependencies, and coordinating multiple processes.
These are exactly the behaviours that advanced malware also performs.
The overlap is unavoidable.
The Role of Exclusions
This is why enterprise security products provide behavioural exceptions.
Rather than disabling security globally, administrators identify trusted software and instruct the security product not to apply behavioural heuristics to those specific executables.
Security remains active for every other application on the system.
Only the known, trusted software is exempt.
This approach maintains both usability and security.
Real-Time File Scanning
The second category of antivirus problems has nothing to do with behavioural detection.
Instead, it results from real-time scanning of file activity.
Whenever a program opens, creates, modifies, renames, or deletes a file, the antivirus driver intercepts the request.
Before the operating system allows the application to continue, the antivirus may:
inspect the file
compute hashes
decompress archives
examine metadata
compare signatures
perform heuristic analysis
submit cloud lookups
Only after these operations complete is the application allowed to continue.
Most of the time, users never notice this delay.
For workloads involving thousands or millions of files, however, the overhead becomes significant.
File Locks and Performance
Real-time scanning frequently requires temporary access to the file being examined.
Depending on the antivirus implementation, this can briefly delay other applications attempting to access the same file.
Although modern antivirus software typically uses sharing modes that minimise disruption, applications may still experience:
increased latency
retry loops
delayed file availability
transient sharing violations
slower build performance
These effects become increasingly noticeable during workloads involving rapid file creation and deletion.
Development Workloads
Software development generates enormous amounts of temporary data.
Typical activities include:
object files
intermediate build outputs
compiler caches
package caches
dependency extraction
generated documentation
temporary source trees
container layers
A large build may create hundreds of thousands of files.
Scanning every one of these provides very little additional security while substantially increasing build times.
For this reason, many organisations exclude:
build directories
compiler caches
package caches
dependency caches
from real-time scanning.
Database Servers
One of the best-known examples is Microsoft SQL Server.
Microsoft explicitly publishes antivirus exclusion guidance for SQL Server because database engines exhibit many of the same characteristics.
SQL Server continuously:
creates files
extends database files
truncates files
writes transaction logs
modifies memory-mapped files
creates backup files
maintains temporary databases
Real-time scanning of database files can produce:
severe performance degradation
database stalls
backup delays
blocking
timeout errors
For this reason, administrators commonly exclude:
MDF files
NDF files
LDF files
TempDB
backup directories
They are not disabling antivirus.
They are preventing interference with a workload that has well-understood behaviour.
The same principle applies to Oracle Database, PostgreSQL, EnterpriseDB, and other enterprise database platforms.
AI Development Platforms
Modern AI development environments are another excellent example.
These systems routinely:
download multi-gigabyte model files
unpack archives
generate Python environments
compile extensions
execute interpreters
update packages
manage repositories
Each operation may create thousands of files.
If every file operation is intercepted and scanned, performance can degrade dramatically.
Some package managers have been observed spending more time waiting for antivirus scanning than actually writing files.
Why Behavioural Detections Still Matter
The existence of false positives does not mean behavioural detection is ineffective.
On the contrary, behavioural analysis is one of the most effective methods for detecting previously unseen malware.
The challenge is that legitimate administrative and development tools frequently resemble malware because they perform many of the same technical operations.
This creates an unavoidable balance between security and productivity.
Best Practice
The objective should never be to disable antivirus entirely.
Instead:
keep behavioural detection enabled
create exceptions only for trusted software
exclude only well-understood build or data directories
avoid broad exclusions such as an entire system drive
regularly review exclusions
digitally sign internally developed software where practical
ensure exclusions are documented and approved
This preserves security while allowing trusted applications to perform their intended function efficiently.
Conclusion
Antivirus exclusions are not an admission that security software is flawed.
They are recognition that sophisticated software sometimes performs sophisticated operations.
Development environments, automation frameworks, AI tooling, database servers, package managers, and administrative utilities often perform activities that closely resemble malware because the underlying technical mechanisms are the same.
Rather than weakening security, carefully targeted exclusions allow trusted software to operate correctly while maintaining protection across the remainder of the system.
The key is precision: exclude only what is necessary, understand why the exclusion exists, and review those decisions over time. Properly managed, antivirus exclusions are not a security compromise—they are an essential part of running complex software reliably.
What this means for Wayland - and How to Configure AV
What AV real-time scanning virus signature scanning looks like for Wayland Development Tasks
If you are running a development task you will see the AI have troubles writing files because 'something' has the file locked. The AI will then start looking for what processes are getting in the way. On windows this will be AV programs like Windows Defender and also tools like DropBox or Onedrive (these generally don't cause an issue but if they ever did you would just move your project files to a folder not replicated by these tools).
What Behavioral Detection (Advanced Threat Detection) looks like for Wayland Development Tasks
When you start doing a lot of development work, you will eventually run a score of too many 'suspicious' activity - and Wayland will be killed. The Wayland executables and all files written will be moved to a quarantine location (most common) or be deleted. You may then see a notice from your antivirus program that it has 'protected' you from a rogue program. This is what a BitDefender 'detection' and quarantine looks ilke:
What to do for Wayland
Add Behavioral Exclusions for wayland.exe, wayland-core.exe and any official Wayland helper executables or services. My recommend exclusions:
c:\program files\wayland\
c:\users\ <USER_NAME> \appdata\roaming\wayland\wayland-core-overrides\win32-x64\wayland-core.exe
(Replace <USER_NAME> with your actual username.)
Add Real-time antivirus scanning exclusions for your project folder(s). I suggest just setting the parent path for your projects
Bonus Bitdefender Issue - Its Firewall may decide to firewall the Wayland Core with no warning
If you start getting failure errors for ever LLM engine request, and cannot to an Wayland Core update, it may be because the Firewall module of BitDefender has decided to prevent Wayland Core from accessing the network.
The first time you open an application with network access, Bit Defender creates an ALLOW firewall rule to let it out. To then prevent access it just needs to disable that rule. With no warning (Why THANKS BitDefender). This is how it should look when traffic ie allowed:
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Skip to the end if you just want the 'What to do for Wayland'
Introduction
Modern antivirus software is one of the most important security controls on any computer. It protects against known malware through signature scanning, detects previously unseen threats through behavioural analysis, and monitors files and processes in real time.
Unfortunately, the very techniques that make modern antivirus products effective also create problems for legitimate software—particularly development tools, automation frameworks, system administration utilities, and database platforms.
This often surprises users. The immediate reaction is frequently:
In many cases, that simply isn't possible.
The software is behaving exactly as it was designed to behave. The behaviour is necessary to perform its intended function, even though that behaviour resembles techniques used by malware.
As a result, almost every major antivirus vendor provides mechanisms for creating exclusions or exceptions. These are not intended as a way to "turn off security," but as a controlled method of telling the security software:
Understanding why these exclusions exist requires understanding how modern antivirus products operate.
Two Different Problems
Although users often refer to them collectively as "antivirus issues," there are actually two very different classes of problems.
The first concerns behavioural detection.
The second concerns real-time file scanning.
They have different causes, different symptoms, and different solutions.
Behavioural Detection (Advanced Threat Detection)
Traditional antivirus products relied almost entirely on signatures.
If a file matched a known malicious signature, it was blocked.
Modern malware evolves too quickly for this approach to be sufficient.
Today's security products therefore include behavioural engines. Bitdefender's Advanced Threat Defense (ATD), Microsoft Defender's Behaviour Monitoring, CrowdStrike Falcon, SentinelOne, and many others continuously watch what running programs do rather than simply examining what they contain.
Typical monitored behaviours include:
Individually, none of these activities necessarily indicates malware.
However, when enough suspicious actions occur together, the behavioural engine concludes that the process resembles malicious software and intervenes.
This is exactly how products detect previously unknown ("zero-day") malware.
Unfortunately, legitimate software often performs exactly the same actions.
Why Legitimate Software Looks Suspicious
Many modern developer tools deliberately perform actions that are almost indistinguishable from malware.
Examples include:
These applications routinely:
From the perspective of a behavioural detection engine, these activities are not inherently different from those performed by sophisticated malware.
The difference lies in intent, which is extremely difficult for automated systems to determine.
Why the Software Cannot Simply Be Changed
A common suggestion is:
This sounds reasonable until one considers what the software actually does.
Suppose an application is designed to:
These activities are the entire purpose of the application.
Removing them would not make the application "more compatible."
It would simply make it incapable of performing its intended job.
This is particularly true for development environments such as Wayland Core and similar AI-assisted coding tools.
Their purpose is to automate software development.
Automating software development necessarily involves creating files, modifying code, executing compilers, launching tools, downloading dependencies, and coordinating multiple processes.
These are exactly the behaviours that advanced malware also performs.
The overlap is unavoidable.
The Role of Exclusions
This is why enterprise security products provide behavioural exceptions.
Rather than disabling security globally, administrators identify trusted software and instruct the security product not to apply behavioural heuristics to those specific executables.
Security remains active for every other application on the system.
Only the known, trusted software is exempt.
This approach maintains both usability and security.
Real-Time File Scanning
The second category of antivirus problems has nothing to do with behavioural detection.
Instead, it results from real-time scanning of file activity.
Whenever a program opens, creates, modifies, renames, or deletes a file, the antivirus driver intercepts the request.
Before the operating system allows the application to continue, the antivirus may:
Only after these operations complete is the application allowed to continue.
Most of the time, users never notice this delay.
For workloads involving thousands or millions of files, however, the overhead becomes significant.
File Locks and Performance
Real-time scanning frequently requires temporary access to the file being examined.
Depending on the antivirus implementation, this can briefly delay other applications attempting to access the same file.
Although modern antivirus software typically uses sharing modes that minimise disruption, applications may still experience:
These effects become increasingly noticeable during workloads involving rapid file creation and deletion.
Development Workloads
Software development generates enormous amounts of temporary data.
Typical activities include:
A large build may create hundreds of thousands of files.
Scanning every one of these provides very little additional security while substantially increasing build times.
For this reason, many organisations exclude:
from real-time scanning.
Database Servers
One of the best-known examples is Microsoft SQL Server.
Microsoft explicitly publishes antivirus exclusion guidance for SQL Server because database engines exhibit many of the same characteristics.
SQL Server continuously:
Real-time scanning of database files can produce:
For this reason, administrators commonly exclude:
They are not disabling antivirus.
They are preventing interference with a workload that has well-understood behaviour.
The same principle applies to Oracle Database, PostgreSQL, EnterpriseDB, and other enterprise database platforms.
AI Development Platforms
Modern AI development environments are another excellent example.
These systems routinely:
Each operation may create thousands of files.
If every file operation is intercepted and scanned, performance can degrade dramatically.
Some package managers have been observed spending more time waiting for antivirus scanning than actually writing files.
Why Behavioural Detections Still Matter
The existence of false positives does not mean behavioural detection is ineffective.
On the contrary, behavioural analysis is one of the most effective methods for detecting previously unseen malware.
The challenge is that legitimate administrative and development tools frequently resemble malware because they perform many of the same technical operations.
This creates an unavoidable balance between security and productivity.
Best Practice
The objective should never be to disable antivirus entirely.
Instead:
This preserves security while allowing trusted applications to perform their intended function efficiently.
Conclusion
Antivirus exclusions are not an admission that security software is flawed.
They are recognition that sophisticated software sometimes performs sophisticated operations.
Development environments, automation frameworks, AI tooling, database servers, package managers, and administrative utilities often perform activities that closely resemble malware because the underlying technical mechanisms are the same.
Behavioural detection engines cannot perfectly distinguish intent.
Likewise, real-time file scanning inevitably introduces overhead when monitoring high-volume file activity.
Rather than weakening security, carefully targeted exclusions allow trusted software to operate correctly while maintaining protection across the remainder of the system.
The key is precision: exclude only what is necessary, understand why the exclusion exists, and review those decisions over time. Properly managed, antivirus exclusions are not a security compromise—they are an essential part of running complex software reliably.
What this means for Wayland - and How to Configure AV
What AV real-time scanning virus signature scanning looks like for Wayland Development Tasks
If you are running a development task you will see the AI have troubles writing files because 'something' has the file locked. The AI will then start looking for what processes are getting in the way. On windows this will be AV programs like Windows Defender and also tools like DropBox or Onedrive (these generally don't cause an issue but if they ever did you would just move your project files to a folder not replicated by these tools).
What Behavioral Detection (Advanced Threat Detection) looks like for Wayland Development Tasks
When you start doing a lot of development work, you will eventually run a score of too many 'suspicious' activity - and Wayland will be killed. The Wayland executables and all files written will be moved to a quarantine location (most common) or be deleted. You may then see a notice from your antivirus program that it has 'protected' you from a rogue program. This is what a BitDefender 'detection' and quarantine looks ilke:
What to do for Wayland
(Replace <USER_NAME> with your actual username.)
Bonus Bitdefender Issue - Its Firewall may decide to firewall the Wayland Core with no warning
If you start getting failure errors for ever LLM engine request, and cannot to an Wayland Core update, it may be because the Firewall module of BitDefender has decided to prevent Wayland Core from accessing the network.
The first time you open an application with network access, Bit Defender creates an ALLOW firewall rule to let it out. To then prevent access it just needs to disable that rule. With no warning (Why THANKS BitDefender). This is how it should look when traffic ie allowed:
All reactions