Codex App: no Trusted Access path for a personal account using a company email

What version of the Codex App are you using (From “About Codex” dialog)?

Desktop version 26.825.51511, build 7377.

Bundled executable: codex-cli 0.151.0-alpha.7.2.

What subscription do you have?

A paid personal ChatGPT account using a company email address. Exact account and organization details are omitted for privacy.

What platform is your computer?

Darwin 25.6.0 arm64 arm

What issue are you seeing?

Codex Desktop repeatedly blocks legitimate, authorized engineering work with this error:

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

The suggested remediation is unavailable for this account topology:

• The personal ChatGPT account used to sign in to Codex uses a company email address, and Trusted Access says that makes the individual verification flow unavailable.
• The associated API organization has already completed verification.
• That API verification does not appear to apply to Codex Desktop sessions authenticated with the ChatGPT account.

This creates a closed loop: Codex requires verification, the offered verification path cannot be completed, and an existing OpenAI API verification does not satisfy Codex.

The affected work was an end-to-end concurrency/deadlock regression test against systems and source code owned and operated by the account holder. It was defensive software verification, not intrusion, credential harvesting, malware, persistence, or testing of a third-party target.

On 2026-09-01 the same Codex task failed three times with the identical message. additionalDetails was null, so the client provided no error code or explanation of whether this was a content classification, an entitlement mismatch, or verification state not propagating across products.

What steps can reproduce the bug?

1. Sign in to Codex Desktop with a personal ChatGPT account using a company email address.
2. Confirm that the corresponding API organization is verified.
3. Attempt to use the Trusted Access link presented by Codex. The individual verification path is unavailable because the account uses a company email address.
4. In Codex Desktop using gpt-5.6-sol at medium reasoning effort, continue an authorized end-to-end concurrency/deadlock regression test in a private, user-owned repository.
5. Observe the task fail with the generic instruction to join Trusted Access.
6. Ask Codex to continue after the warning and observe the same failure again.

Affected task: 01a058c1-5046-74e1-bdac-12461fd7c374

Failed turns:

• 01a058df-637a-7f62-a6b0-846eea4b92fb — 2026-08-31 19:30:30 CEST
• 01a05b5b-976d-7362-9220-ebf9f0422b26 — 2026-09-01 07:05:24 CEST
• 01a05b62-9f50-74d2-9c72-beec705c2c00 — 2026-09-01 07:13:05 CEST

What is the expected behavior?

• Provide a supported Trusted Access verification route for Codex users whose personal ChatGPT account uses a company email address.
• If API organization verification is intentionally separate from Codex verification, state that scope clearly and provide an actionable Codex-specific route.
• Do not tell a user to complete a verification flow that their account is ineligible to start.
• Distinguish a content-level safety decision from a missing or mismatched verification entitlement in the error message.
• Legitimate concurrency and deadlock regression testing on user-owned systems should not be repeatedly classified as high-risk cybersecurity activity.

Additional information

This report does not ask to bypass safeguards. It asks for a verification path that can actually be completed and for accurate diagnostics when safeguards intervene.

Related reports found before filing:

• #12920 covers users who cannot start verification, but not the combination of a personal account using a company email address and an already-verified API organization.
• #22554 and #35212 cover verification not being recognized in other account/plan configurations.
• #41767 and #36573 cover similar false-positive Codex failures, but not this verification-scope dead end.

OpenAI's current API guidance says safeguards may intervene on legitimate defensive work. The missing piece here is a usable Codex verification path for this account topology.

Start by reproducing the failure in Codex Desktop with the reported account topology and version, then read related reports #12920, #22554, #35212, #41767, and #36573. Done means an eligible Trusted Access route exists for this case, or the product clearly distinguishes content classification from verification or entitlement failures.