CircleCI Agent for Windows
CircleCI Agent (circleci-agent.exe) is the Windows background service that communicates with CircleCI to fetch build jobs, report status, and manage workspaces. It is installed with CircleCI and runs during active builds.
circleci-agent.exe is the Windows component of CircleCI's local agent runtime. It runs as a background process to poll the CircleCI service, receive build jobs, manage workspace data, and report status back to CircleCI. It is installed with CircleCI or via the CircleCI CLI on Windows, and is expected to run during active projects.
The agent authenticates with CircleCI using a token, opens a TLS channel to CircleCI's API, and pulls job steps for execution by a local runner. It writes artifacts to C:\CircleCI\Workspace and cleans up on completion.
circleci-agent.exe is a legitimate CircleCI component designed to run locally on Windows to execute CI jobs fetched from CircleCI. When installed from official CircleCI sources, it runs under the system or service context, uses standard Windows permissions, and integrates with Windows Defender or other AV scanners. If found on machines where CircleCI isn’t installed or from unofficial sources, it can be flagged, so always verify the source path and digital signature. Regular updates from CircleCI reduce risk and ensure integrity.
circleci-agent.exe is not a virus when obtained from CircleCI’s official distribution and installed as part of the CircleCI Agent. Like any executable, it can be repurposed if tampered with, so confirm the signer, path, and hash values to avoid false positives. If you did not install CircleCI, or the executable resides in an unfamiliar directory, treat it as suspicious and isolate the host until verification is complete.
Red Flags: If the file is missing a valid signature, located outside CircleCI directories, or exhibits unexpected network activity, stop the agent, quarantine the host if needed, and verify against CircleCI distribution channels.
Reasons it's running:
It is the CircleCI Agent executable that runs local CI jobs, fetches steps, and uploads results during builds.
Typically in C:\Program Files\CircleCI, or a CircleCI-provided directory depending on the installer.
Yes, by stopping the service and setting startup type to Manual or Disabled in Services.
Check the file path, verify the digital signature, hash value, and run a malware scan.
It may be updating, checking for jobs, or waiting for network responses; check CircleCI status and agent logs.