Codex app: defensive review triggers recurring cyber-safety banner and parent systemError during multi-agent review

Start by examining the supplied feedback ID and the parent, stalled, and completed replacement task IDs, then compare the behavior with related issues #34306 and #32597. Reproduce the multi-agent defensive review and trace whether the safety interruption precedes the parent systemError. Done means completed child results are retained and automatically consumed, with recovery available without manual task-state diagnosis.

What version of the Codex App are you using (From “About Codex” dialog)?

26.727.6591.0 (installed Windows package)

What subscription do you have?

Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

I encountered a false-positive cyber-safety warning and a related task-orchestration failure while using Codex for an authorized defensive review of TrovoPilot, software that I own and operate.

The review examined a proposed database migration and one-time data-repair mechanism before any production action. It did not target third-party systems, seek unauthorized access, or develop offensive capabilities.

Codex repeatedly displayed:

This content can’t be shown. We take extra caution with cybersecurity requests. If you’re a security professional, you may be able to apply for Trusted Access.

An isolated Challenge reviewer became orphaned in an internal wait. A replacement child reviewer completed successfully, but the parent task entered systemError and did not automatically consume the completed child result or write the final verdict.

A manual recovery prompt eventually allowed the parent to consume the completed work and write the verdict. The work was recoverable, but only after user diagnosis and intervention.

What steps can reproduce the bug?

Feedback ID: 019fc54a-95ef-7861-a953-cfb5f4ddc7bb
Parent task: 019fc54a-95ef-7861-a953-cfb5f4ddc7bb
Completed replacement reviewer: 019fc592-fad2-7383-94f6-f02dad253e19
Model: gpt-5.6-sol
Reasoning effort: xhigh

1. Start a multi-technique defensive code and database review of owned software.
2. Allow multiple isolated reviewer tasks to run.
3. Observe the cyber-safety banner repeatedly appearing.
4. One Challenge reviewer becomes stuck in an internal wait.
5. Replace only that reviewer while preserving completed work.
6. The replacement reviewer completes successfully.
7. The parent enters systemError instead of consuming the completed child result.
8. Send a manual recovery prompt instructing the parent not to rerun completed work.
9. The parent finally consumes the result and writes the verdict.

Observed August 2, 2026, approximately 10:02–10:19 PM CDT.

What is the expected behavior?

An authorized defensive review of software owned by the user should proceed without a false-positive safety interruption. If a child reviewer completes, its result should remain durably available to the parent. A parent task error should recover automatically or expose a clear resume operation without requiring the user to diagnose internal child-task state.

Additional information

Related false-positive reports: #34306 and #32597.

This report differs because the recurring safety notice coincided with a multi-agent orchestration failure: a completed replacement child result was not automatically aggregated after the parent entered systemError. Manual recovery succeeded, and the final verdict was eventually written, but the recovery required direct inspection of parent and child task state.

Please investigate whether classifier rerouting is related to the parent failure, whether Trusted Access is appropriate for authorized defensive review, and whether completed child results can be automatically recovered after parent task errors.

Screenshots are available showing the recurring warning, stalled reviewer, replacement reviewer, system-error state, and successful recovery.

This is not a one-off occurrence. The same cyber-safety interruption has affected legitimate defensive review work on two separate days and across multiple Codex sessions while continuing the same overall review task. Between sessions, the workflow was deliberately narrowed and the prompts were reworded to make the authorized defensive scope clearer and reduce false-positive classification, but the warning continued.