openai / openai/codex

Cybersecurity false positives block work in our own repo and leave important threads unusable

Open
#42,940 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

app bug safety-check session
Dominant language
Rust
Stars
125k
Forks
19.4k
PR merge metrics
PR metrics pending

Description

What issue are you seeing?

I’m repeatedly hitting the “This content can’t be shown” cybersecurity warning while working on our own repository in the Codex desktop app. The banner directs me to apply for Daybreak.

There are two problems:

  1. Apparent false positives during authorised repository work. The sensitivity is interrupting legitimate development in a repository we own.
  2. The thread cannot recover afterward. Even when I try to abandon the flagged task and redirect the conversation to other work, I cannot get the thread moving again. An important conversation with accumulated project context is now effectively unusable.

The second problem is particularly serious. Whatever the decision on an individual request, users need a supported way to skip that request and continue permitted work without sacrificing the entire conversation.

Observed sequence

  1. Work in an established conversation on our own repository.
  2. Encounter the cybersecurity warning repeatedly.
  3. Attempt to skip the task that triggered it and change direction.
  4. Remain unable to resume useful work in that thread.

Expected behaviour

  • Better calibration to reduce false positives during legitimate development and maintenance.
  • A blocked request should leave the conversation recoverable.
  • Users should be able to abandon the flagged operation and continue unrelated, permitted work.
  • The warning should provide a practical recovery and false-positive reporting route. A Daybreak application link does not resolve the immediate loss of access to an existing workflow.

This is an unacceptable failure mode for a tool used for sustained engineering work. Please investigate both the detection sensitivity and the inability to recover an affected conversation.

Environment and evidence

  • Codex desktop app on macOS.
  • The warning shown in my screenshot reads:

This content can’t be shown

We take extra care with some cybersecurity requests. If you’re doing authorized security work, apply for Daybreak to get broader access.

Related report: #42906.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Start by reproducing the warning and failed recovery sequence in the Codex desktop app on macOS, then compare the behavior with related report #42906. Done means an authorized-work false positive can be reported and a blocked request can be abandoned without making the conversation unusable.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, rust
Domain
desktop, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.