False-positive cyber safety block prevents authorized local defensive database review

What version of Codex CLI is running?

codex-cli 0.151.0

What subscription do you have?

Max

Which model were you using?

gpt-5.6

What platform is your computer?

Darwin 25.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

iTerm2

Codex doctor report

codex doctor --json completed successfully with overall
  warning: endpoint-protection inspection was unavailable
  and sandboxing blocked PATH-alias creation; all core
  checks passed.

What issue are you seeing?

Codex is producing a false-positive cybersecurity safety block during a benign, explicitly authorized code-review workflow in a private repository that I own.

The task is a defensive database access-control feasibility review. It is restricted to disposable local PostgreSQL 17 databases on non-default loopback-only ports. Production access, live data, external networking, credentials, Supabase/MCP, deployment, and production mutation are expressly prohibited.

The neutral, fixture-free PostgreSQL preflight completes successfully. Immediately afterward, when the parent PM agent attempts to create one independent review agent, the parent turn is terminated by a cybersecurity safety check before the reviewer is created or the task fixture
is executed.

This has happened repeatedly and prevents the normal review/acceptance workflow from completing, despite explicit defensive authorization and narrowly bounded local-only execution.

What steps can reproduce the bug?

Uploaded thread: 01a05aa5-2358-7230-9522-67285579cd6d

What is the expected behavior?

Codex should recognize this as authorized defensive work
against a local disposable database and allow the
bounded independent code-review agent to run.

The explicit authorization and restrictions should be
considered:

• Repository and software are owned by the operator.
• Execution is local and isolated.
• No production or live-system access is permitted.
• No credentials or external networking are used.
• No deployment or operational mutation is permitted.
• The objective is defensive verification of least-
  privilege database behavior.

If Codex still determines that the request requires
additional authorization, it should provide an
actionable explanation or access requirement without
incorrectly consuming the review attempt or terminating
the parent before it can preserve workflow state.

Additional information

Codex incident ID:
incident_35c248773c413c092617a8bbbfc50ef4e0d114d6c2260ae
c3cfdaf6282bd012b

Observed:
2026-09-01T02:55:15.152Z

Codex thread:
01a05aa5-2358-7230-9522-67285579cd6d

Parent turn:
01a05aa9-d601-76e1-b760-25779ef688c4

Internal Codex metadata:
"cyber_policy"

Raw API response observed:
false

Raw API error code:
null

Complete local session-log SHA-256:
07d52b9381a81bc0f9e89d0d74dbb8141af603c02031aa2d40f2a599
a8328183

Forensic inspection confirmed:

• The neutral preflight passed.
• No independent reviewer was created.
• No delegation call occurred.
• No task fixture was executed.
• No production, network, credential, or deployment
  operation occurred.
• The repository remained clean.
• The authorized one-shot claim remained unconsumed.

This is not a request to weaken cybersecurity
safeguards. I am asking for review of an apparent false
positive and guidance on whether Trusted Access is
required for ordinary defensive database-access-control
review in Codex.

The public official OpenAI documentation search did not
provide more specific ticket-field guidance, so this
wording is based on the exact Codex 0.151.0 incident
record and its installed feedback workflow.

Start with the uploaded Codex thread 01a05aa5-2358-7230-9522-67285579cd6d and incident record incident_35c248773c413c092617a8bbbfc50ef4e0d114d6c2260ae. Compare the reported PostgreSQL preflight and parent-agent termination with the expected behavior, then determine what evidence is needed to reproduce the cybersecurity block and confirm that bounded defensive review is allowed without consuming the review attempt.