[Codex App] 13 false-positive cyber_policy terminations during benign local-only TDD/review workflow

Feedback ID: 01a064ee-e151-79f0-899e-b70e908ec43d

What version of the Codex App are you using (From “About Codex” dialog)?

Current Codex App: 26.901.22334 (build 7746).

The affected rollout records identify Codex Desktop as the originator and record cli_version: 0.151.0-alpha.7.2. The current shell-installed CLI reports codex-cli 0.147.0.

What subscription do you have?

ChatGPT Pro.

What platform is your computer?

Darwin 27.0.0 arm64 arm

macOS 27.0 (26A5421a), Apple silicon.

What issue are you seeing?

Codex Desktop repeatedly terminates benign, authorized, local-only software-engineering tasks with:

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

The terminal event is recorded as task_complete with codex_error_info: "cyber_policy", and no final assistant response is delivered.

I found 13 separate cyber_policy terminations between 2026-09-02T01:38:27Z and 2026-09-02T23:47:08Z (UTC; spanning September 2–3 in Asia/Shanghai) across three top-level Codex Desktop tasks and one implementation subagent participating in the same local workflow. The affected task was ordinary Python implementation and review work in a user-owned local repository:

• deterministic TDD for concurrency and failure ownership;
• local filesystem state, permissions, symlink-safety, cleanup, and rollback correctness;
• local HTTP/SSE behavior and response semantics;
• local pytest, Ruff, Git diff inspection, code review, and local commits;
• multi-agent implementation and independent review orchestration.

The instructions explicitly prohibited external services, remote issue access, network-dependent or keyed tests, credential use, Git fetch/pull/push, pull requests, and remote mutations. There was no scanning, exploitation, malware, persistence, credential access, exfiltration, or third-party target.

Some long-running turns were blocked only after tens of minutes or hours of successful local work. Other turns were blocked within seconds when the entire new user message was simply go on, 继续, or a request to continue without touching network-security work. This suggests the false positive may depend on accumulated task context or completion-time classification rather than the immediate continuation message alone.

The blocks interrupt the orchestration state, discard the final response, and force manual recovery/rephrasing even though the task remains entirely local and non-cyber.

What steps can reproduce the bug?

The behavior is intermittent but has repeated many times:

1. Open a local Codex Desktop task for a user-owned Python repository.
2. Ask Codex to orchestrate test-first implementation, local unit tests, linting, Git diff inspection, and independent review.
3. Explicitly constrain the work to local files and existing dependencies, with no external services, credentials, network access, or remote Git operations.
4. Let the task run for an extended period using local subagents, tests, and review steps.
5. Send a short continuation message such as go on or 继续.
6. At completion, Codex may terminate the turn with codex_error_info: "cyber_policy" instead of returning the result.

The user-visible linked Codex session is:

codex://threads/01a0606c-e49d-7972-b933-5942dc011427

For that linked occurrence:

• session ID: 01a0606c-e49d-7972-b933-5942dc011427
• turn ID: 01a0606c-ea11-7e53-a8f4-bef4beb7b457
• block timestamp: 2026-09-02T05:27:23.447Z
• turn duration: 2,697,761 ms (44m 57.761s)
• model family recorded across affected sessions: gpt-5.6-sol
• reasoning settings observed across affected sessions: medium, xhigh, max, and ultra
• model context window: 258,400
• last token sample before the block: 74,926 total (74,839 input, 74,496 cached input, 87 output, 9 reasoning)
• cumulative token sample at that point: 1,841,245
• rate-limit utilization at that point: 33%

All observed policy terminations are listed below. Times are UTC. Session and turn IDs are included so the uploaded feedback can be correlated with backend telemetry.

#	Session ID	Turn ID	Timestamp (UTC)	Duration	Redacted task context
1	01a05f9d-3e01-73e0-89ce-7fe7866cf91e	01a05f9d-3f87-7982-aec8-1f9f5cbbd42c	2026-09-02T01:38:27.565Z	42m 51.457s	Initial local-only TDD/review orchestration
2	01a05fa1-b193-71b3-83d5-6b529fcb4f8f	01a05fc2-5288-7510-8f46-e66862b813c3	2026-09-02T01:45:47.947Z	9m 42.175s	Local implementation subagent
3	01a05f9d-3e01-73e0-89ce-7fe7866cf91e	01a06004-8bdb-7963-97c8-c0ea6450dd6a	2026-09-02T02:49:33.183Z	1m 07.346s	User message: go on
4	01a05fa1-b193-71b3-83d5-6b529fcb4f8f	01a06010-e46a-7183-9fb4-83e682b3eabb	2026-09-02T03:08:52.595Z	6m 57.670s	Local implementation subagent
5	01a05fa1-b193-71b3-83d5-6b529fcb4f8f	01a06017-6663-7d10-9d27-5ff1df306946	2026-09-02T03:10:23.920Z	1m 22.502s	Local implementation subagent continuation
6	01a05f9d-3e01-73e0-89ce-7fe7866cf91e	01a06010-8f8e-7032-b13d-e7db520c725e	2026-09-02T03:41:50.467Z	40m 17.242s	User message: go on
7	01a05f9d-3e01-73e0-89ce-7fe7866cf91e	01a0603a-c170-79b0-89f9-a586e7b56e44	2026-09-02T03:48:11.086Z	32.597s	Continue, explicitly avoiding network-security requests
8	01a05f9d-3e01-73e0-89ce-7fe7866cf91e	01a0603d-fbe3-7311-a379-3cf061722273	2026-09-02T03:51:30.934Z	20.876s	Same benign continuation request in a resumed rollout
9	01a05f9d-3e01-73e0-89ce-7fe7866cf91e	01a0603e-d120-7ee1-ad3b-43f6ff4ef110	2026-09-02T03:52:13.949Z	9.296s	User message: go on
10	01a0606c-e49d-7972-b933-5942dc011427	01a0606c-ea11-7e53-a8f4-bef4beb7b457	2026-09-02T05:27:23.447Z	44m 57.761s	Linked local-only implementation/review orchestration
11	01a060a7-4583-7853-8216-71b5b5c1eca9	01a0614c-6373-7cc2-9259-827ae8b70f97	2026-09-02T09:51:07.282Z	1h 04m 35.977s	Short continuation/authorization acknowledgement
12	01a060a7-4583-7853-8216-71b5b5c1eca9	01a062bd-ac77-74c3-a1d1-5224a895e5ce	2026-09-02T18:58:54.503Z	3h 29m 01.772s	User message: 继续
13	01a060a7-4583-7853-8216-71b5b5c1eca9	01a06484-8f03-7042-92dc-adb2c8ff953e	2026-09-02T23:47:08.319Z	24.210s	User message: go on

No upstream HTTP request ID was present in these task_complete policy events or found in the corresponding local desktop logs. The session and turn IDs above are the available correlation identifiers. A separately observed AppServer JSON-RPC request ID related to thread/read hydration was intentionally omitted because it was not the request that produced the cyber_policy decisions.

What is the expected behavior?

Benign local software implementation, testing, and review should complete without being classified as cybersecurity work. A one-word continuation message should not repeatedly terminate an already-running local task because of accumulated context that contains ordinary concurrency or filesystem-safety terminology.

If a safety block is still required, Codex should preserve recoverable task state and expose a stable policy-event/request identifier, timestamp, and enough non-sensitive reason information to identify which input or tool action caused the classification.

Additional information

• All affected records identify the originator as Codex Desktop; the internal source field is vscode.
• The affected model was gpt-5.6-sol; the issue reproduced across multiple reasoning-effort settings.
• The events occurred across long-running turns and very short continuation turns, so this is not limited to one prompt length or one reasoning setting.
• The feedback ID is provided for correlation with the privately submitted diagnostics.
• This public report intentionally omits the repository name/path, source code, commit hashes, account/workspace identifiers, desktop log paths, credentials, and full prompts.

No source file or test is named in the report. Start by reproducing the local-only workflow in Codex Desktop and inspect the recorded task_complete events with codex_error_info set to cyber_policy, using the supplied session and turn IDs for correlation. Done means benign local implementation, testing, and review tasks complete without false-positive termination, with recoverable policy-event details if blocking still occurs.