[Windows App 26.825.6671.0][gpt-5.6-sol] Repeated cyber_policy blocks benign summaries and feedback documentation

What version of the Codex App are you using (From “About Codex” dialog)?

• Codex Desktop App package version: 26.825.6671.0
• Package: OpenAI.Codex_26.825.6671.0_x64__2p2nqsd0c76g0
• Architecture: x64

What subscription do you have?

ChatGPT Pro (20× usage limits).

What platform is your computer?

• Registry ProductName: Windows 10 Pro for Workstations
• DisplayVersion: 25H2
• EditionID: ProfessionalWorkstation
• OS Build: 26200.9168
• Kernel version string: Microsoft Windows NT 10.0.26200.0
• Architecture: x64

What issue are you seeing?

Codex Desktop repeatedly returned a likely false-positive cyber_policy result in one authorized local software-quality/model-evaluation task. The affected systems are owned and administered by me.

The same task accumulated ten suspected false-positive blocks across:

• read-only campaign status summaries;
• offline/local defensive receipt-store reliability work in an isolated worktree;
• tightly bounded preparation of one clean VM I own;
• a strictly read-only VM inventory blocked before any command ran;
• an ordinary conversation summarizing existing context; and
• a purely administrative attempt to append that latest event to an OpenAI Support evidence record.

The last category is particularly concerning: the tenth block was triggered while attempting only to document the ninth block after in-product feedback had already been submitted.

Exact message:

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

Affected task/session ID:

01a0459a-93c7-7dc3-9fe4-9577bb08334c

In-product Feedback ID shown after submission:

01a0459a-93c7-7dc3-9fe4-9577bb08334c

The Feedback ID displayed by the client is identical to the affected task/session ID. This is reported exactly as shown rather than inferred.

OpenAI Support case:

13996836

Administrative source task used to append event 9 (relevant to event 10 correlation):

01a052b7-e462-7c71-a8b4-7320d3b74ae4

OpenAI's official GPT-5.6 guidance notes that real-time cyber safeguards can occasionally intervene on legitimate work, especially where defensive and offensive activity may initially look similar: https://developers.openai.com/api/docs/guides/latest-model#safeguards

Native rollout metadata identifies the model as gpt-5.6-sol, but the visible App history did not expose a request ID. Native task read-back showed the latest task state as systemError. For the ninth and tenth failed turns, the visible App-facing read-back contained items=[], so the exact submitted text was no longer recoverable from the visible task history.

Event timeline (Asia/Taipei, UTC+8)

#	Time	Turn ID	Sanitized scope
1	2026-08-29 15:08:45	01a04c59-7117-77a2-8b0e-dd575ef14cb9	Read-only campaign heartbeat/status delta
2	2026-08-29 18:04:20	01a04cfa-3310-7c52-a261-51630d4e3cc6	Read-only campaign heartbeat/status delta
3	2026-08-29 18:32:39	01a04d14-1e8c-7fb0-9bad-e4a962894ddb	Offline/local defensive receipt-store hardening; uncommitted and undeployed
4	2026-08-29 18:45:16	01a04d1f-ace3-79e1-b04a-f66d5035ddcd	Existing status summary only
5	2026-08-29 18:50:08	01a04d24-20e3-7ee2-86b2-b4a709d917db	Offline/local defensive retry and tests
6	2026-08-29 23:29:03	01a04e23-7dda-7712-9c8a-ba166e641519	Bounded preparation planning for one clean VM I own; blocked before command execution
7	2026-08-29 23:29:16	01a04e23-af61-7920-ab09-e9bc0b08918b	Single-VM preflight/install scope; no benchmark or other system; blocked before command execution
8	2026-08-29 23:30:06	01a04e24-72fd-7f73-8a22-38a916ee888b	Strictly read-only single-VM inventory; no install/download/modification/secrets; blocked before command execution
9	2026-08-30 21:08:12	01a052c8-e494-7d10-bcc4-3e8e5fe5e26c	Ordinary conversation summarizing existing context; no new technical operation; items=[]
10	2026-08-30 21:09:46	01a052ca-553d-7a22-bfaa-ff46bd760425	Administrative attempt to append event 9 to the Support evidence record; items=[]

Event 10 occurred after I submitted the in-product feedback, so it could not have been included in that submission.

There was no unauthorized target, penetration testing, network scanning, exploit development, credential access, persistence, malware, evasion, or data exfiltration. VM, network, benchmark, and model-lifecycle scopes were deliberately separated, and read-only turns explicitly prohibited mutation.

Diagnostic metadata

The following values were read from local Codex package and rollout metadata without publishing the raw rollout:

Field	Recorded value
Codex App package	OpenAI.Codex 26.825.6671.0, x64
Bundled Codex CLI/runner	0.150.0-alpha.8
Session originator/source	Codex Desktop / vscode
Subscription	ChatGPT Pro (20× usage limits)
Model	gpt-5.6-sol for all ten affected turns
Reasoning effort	ultra for events 1–8; max for events 9–10
Model context window recorded at turn start	258400
Approval policy/reviewer	on-request / auto_review
Sandbox	workspace-write
Collaboration mode	default
History mode	paginated
Terminal error class	codex_error_info = cyber_policy for all ten turns
Aggregate recorded duration of the ten failed turns	10,469,072 ms (2h 54m 29.072s)
Longest affected turn	Event 1: 9,545,911 ms (2h 39m 05.911s) before the terminal block
Latest native task state	systemError
Request ID	Not surfaced in the App or local rollout metadata reviewed
In-product Feedback ID	01a0459a-93c7-7dc3-9fe4-9577bb08334c — displayed by the client after submission; identical to the affected task/session ID

The local rollout contains matching task_started and task_complete records for all ten turns. Each terminal record contains the same exact message and codex_error_info=cyber_policy.

Actual impact

• Ten turns ended in the same policy error, with nearly three hours of aggregate recorded task duration.
• The longest read-only/status turn ran for more than two and a half hours before its final output was replaced by the policy error.
• The latest two failures made ordinary context consolidation and support-case documentation fail.
• The affected task remains in systemError, and its latest failed turns expose no visible input items for user-side recovery.
• The user had to reconstruct the evidence across tasks, submit in-product feedback, open Support Case 13996836, and prepare a public GitHub report.
• No token or monetary-loss estimate is claimed because exact per-turn usage was not available in the inspected metadata.

What steps can reproduce the bug?

The exact classifier trigger is not exposed, so this is an evidence-based sequence rather than a claim of deterministic reproduction:

1. Open an existing Codex Desktop task on Windows containing an authorized local model-evaluation workflow.
2. Ask for a read-only status summary, or summarize the already documented context without requesting technical execution.
3. Observe the cybersecurity-risk message and a failed turn.
4. Submit in-product feedback as instructed.
5. From another Codex task, send a neutral administrative note to the affected task that records the prior turn ID, timestamp, and Support case number, and explicitly requests no technical operation.
6. Observe the same cybersecurity-risk failure again; native task read-back reports systemError, and the failed turn may expose items=[].

I do not recommend intentionally reproducing this against a valuable task because repeated attempts can create more failed turns and lose visible context.

What is the expected behavior?

• Ordinary read-only status reporting and context summarization should complete normally.
• A neutral attempt to document a suspected false positive should not be classified as cybersecurity activity.
• The in-product feedback/reporting path should remain usable after a task is blocked and should not pass through the same normal model/safety route.
• If a response is blocked, Codex Desktop should preserve a stable incident/request ID and a recoverable visible record.
• A policy-classifier result should not leave the task in a generic systemError state.
• Legitimate protections should remain enabled; this report does not ask for global bypasses.

Additional information

In-product feedback has already been submitted under Feedback ID 01a0459a-93c7-7dc3-9fe4-9577bb08334c, which the client displayed as the same value as the affected task/session ID. OpenAI Support Case 13996836 contains a private, more detailed account. The tenth turn occurred afterward and is therefore provided here for separate correlation.

This report is related to, but adds distinct Windows Desktop evidence beyond:

• #20497 — /feedback can itself be blocked in an already blocked conversation.
• #34228 — Windows App maps a benign cyber_policy event to a system-error state.
• #34945 — read-only local software-integrity work repeatedly blocked.
• #37473 — benign read-only/local orchestration interrupted by false-positive cyber_policy.

The distinct evidence here is the repeated sequence of ten blocks in one Windows Desktop task, including two non-execution administrative/context-summary turns and an event that happened only while documenting the previous false positive.

Requested action:

1. Correlate the supplied task and turn IDs with backend model/request/classifier telemetry.
2. Review the ten events for false positives.
3. Ensure feedback/documentation messages can be submitted without being routed through the same failing path.
4. Preserve a visible correlation ID and recoverable task state after a policy decision.
5. Improve contextual handling for authorized local QA/model-evaluation workflows without weakening safeguards for harmful activity.

Public-report redactions intentionally exclude credentials, tokens, cookies, private keys, private IP/DNS inventory, absolute local paths, proprietary source, raw logs, and unnecessary model filenames. Redacted screenshots or a scoped diagnostic export can be provided privately if maintainers request them.

No source file or test is named. Start by tracing how Codex Desktop handles codex_error_info=cyber_policy, maps blocked turns to systemError, and reads back turns with items=[]; then inspect the feedback path and task correlation handling. Done means benign summaries and feedback remain usable while blocked tasks retain a visible, recoverable incident record.