Security researcher NightmareEclipse has released a proof-of-concept called BigDiskBuster that prevents Microsoft Defender Antivirus from installing platform and security intelligence updates. It does not disable Defender, but could leave it relying on outdated malware definitions, reducing its ability to detect newly identified threats.

The tool reportedly interferes with updates by temporarily filling available disk space with hidden files, then releasing it after the installation fails; it also restricts access to Microsoft’s Malicious Software Removal Tool. NightmareEclipse claims it works on all supported Windows versions, although this has not been independently verified and the proof-of-concept is reportedly buggy. The release is the latest in an ongoing dispute with Microsoft over the researcher’s publication of Windows vulnerabilities, some of which have since been patched or exploited.