Possible cyber-safety false positive blocks authorized C++ gtest/ASAN regression testing

What version of the Codex App are you using (From “About Codex” dialog)?

26.901.20858 (build 7658; currently installed desktop app)

What subscription do you have?

ChatGPT Pro

What platform is your computer?

macOS 26.6.2, Apple Silicon. uname -mprs: Darwin 25.6.0 arm64 arm

What issue are you seeing?

Codex repeatedly interrupted an authorized C++ debugging and regression-testing task with this error:

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

I was investigating SIGBUS crashes in a codebase I maintain. I explicitly asked Codex to use only Google Test, work in a separate test directory on an authorized internal development machine, and avoid affecting other users or the existing environment.

The work involved compressed-buffer boundaries, deserialization validation, and object lifetimes, using an existing ASAN build. Later test code also included a child-process ASAN self-check. This was software reliability testing, not an attempt to attack a third-party system.

Five of the six most recent turns failed with the same cybersecurity-risk error, including follow-ups that only said "Please continue." The error details did not identify a specific trigger.

Importantly, the first blocked turn preceded the newly added ASAN self-check, so I cannot attribute the blocking to that test or to any particular keyword. This is a suspected false positive, not a confirmed diagnosis of the classifier.

What steps can reproduce the bug?

Observed sequence (not a standalone minimal reproduction):

1. Start a Codex desktop task investigating SIGBUS crashes in an authorized C++ project.
2. Ask for isolated Google Test regression tests on a development machine, reusing an existing ASAN build and avoiding changes to shared services.
3. Allow Codex to inspect the relevant code and prepare the tests.
4. The task fails with the cybersecurity-risk error above.
5. Send "Please continue" in the same task. Multiple subsequent turns fail with the same error.

Affected thread ID: 01a06ffc-6dd4-7b01-b34c-7e93a67d7f7a
Date observed: September 5, 2026 (Asia/Shanghai).

I do not have a public minimal reproduction. The project contains non-public code, so I am keeping source code, internal host addresses, credentials, and production logs out of this public issue.

What is the expected behavior?

Ordinary authorized C++ unit testing, sanitizer diagnostics, and regression-test development should be supported.

Please review the affected session as a possible false positive and investigate why subsequent continuation requests were repeatedly blocked. If this is an intended restriction, please explain the applicable boundary and the supported review process.

Additional information

Related reports:

• https://github.com/openai/codex/issues/34945 — repeated blocking during local software-integrity checks and tests.
• https://github.com/microsoft/vscode/issues/332077 — a particularly similar report involving C++ memory-safety testing, ASan/UBSan diagnostics, and repeated failures after a "continue" request. That report concerns Copilot rather than Codex desktop, so it is supporting context, not proof of a shared root cause.

This report adds a concrete C++ gtest/ASAN workflow and the affected thread ID. The ID above identifies the task; it is not being presented as a feedback-upload receipt.

Start with the affected thread ID and the reported Codex desktop workflow: authorized C++ Google Test regression testing, an existing ASAN build, and repeated "Please continue" failures. Review the sequence before and after the ASAN self-check; done means identifying a reproducible trigger or documenting why the available report cannot isolate one.