Desktop: routine maintenance and explanatory follow-up fail with Trusted Access notice on GPT-5.6 Sol

What version of the Codex App are you using (From “About Codex” dialog)?

Desktop version 26.825.51511, build 7377, verified from the installed application metadata (bundle identifier com.openai.codex; installed app name is ChatGPT).

Bundled executable: codex-cli 0.151.0-alpha.7.2.

What subscription do you have?

Account details omitted for privacy.

What platform is your computer?

macOS 26.6.2, Apple Silicon.

What issue are you seeing?

An existing routine repository-maintenance task becomes unable to continue and displays a Trusted Access / cybersecurity notice. An explanatory follow-up asking why Trusted Access is required also fails.

The selected model is 5.6 Sol High, not a specialist Cyber model. The following non-identifying configuration is confirmed in local session metadata:

{
  "model": "gpt-5.6-sol",
  "effort": "high",
  "approval_policy": "never",
  "sandbox_policy": {
    "type": "danger-full-access"
  }
}

The UI shows:

We couldn’t complete this request
Some cybersecurity requests are subject to additional safeguards. Visit Trusted Access to verify your identity and enable access.

The task is recorded as systemError. Three inspected attempts have status failed and the same error message:

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

For these failures, additionalDetails is null. The available error record does not identify the triggering operation, underlying error code, or whether the notice originated in a model-service decision, client error handling, or another failure path.

The notice is an observed symptom, not a confirmed root-cause diagnosis. The visible task is routine maintenance; please investigate the actual failure path rather than assuming the notice establishes an appropriate cybersecurity policy block. A false positive and an incorrectly mapped error are possibilities, not established explanations.

What steps can reproduce the bug?

Observed sequence, not yet a minimal independent reproduction:

1. Work on routine repository maintenance in the desktop app using 5.6 Sol High and Full access.
2. Ask the assistant to continue after earlier file edits.
3. The assistant checks repository state. Visible commands include git status --short --branch, git rev-parse HEAD, and git show --stat --oneline HEAD.
4. The task fails and shows the Trusted Access notice.
5. Ask why Trusted Access is required when using the selected general-purpose model.
6. The task again fails without a normal answer and displays the same notice.

The commands are visible context, not established triggers. Token/context-window usage at failure was not captured.

What is the expected behavior?

• Routine authorized repository maintenance should continue when permitted, and an explanatory follow-up should receive a useful answer.
• If the failure is a cybersecurity policy decision, provide accurate, actionable diagnostics within appropriate disclosure limits.
• If it is a different service/client/runtime failure, preserve its actual category rather than presenting an unrelated Trusted Access requirement.
• Distinguish model selection, local execution permissions, and any applicable service-side access requirements. Using a general-purpose model or Full access is not being proposed as a way to override safeguards.

Additional information

Related reports found before filing:

• #34780 concerns Windows with restricted sandbox networking and automatic approval review. This case concerns macOS with danger-full-access and approval_policy: never, without an observed approval escalation.
• #34236 concerns repeated notices and a failed Trusted Access verification flow. No failed identity-verification attempt is established in this case.

Please investigate whether the cyber notice is the correct classification or an error-reporting defect, and identify a supported recovery path.

For privacy, this report omits session/turn identifiers, timestamps and timezone, account/subscription information, project details, filesystem paths, screenshots, and conversation transcripts.

Start by reproducing the desktop task sequence with GPT-5.6 Sol High, Full access, danger-full-access, and approval_policy never, then inspect how failed tasks with systemError are classified and displayed. Compare the behavior with related issues #34780 and #34236. Done means the failure preserves its actual category, provides useful diagnostics or recovery guidance, and does not mislabel routine maintenance without evidence.