Possible false-positive cybersecurity block interrupts authorized local development

What version of Codex CLI is running?

codex-cli 0.153.4 (currently installed CLI; exact runtime version at the incident is not independently confirmed)

What subscription do you have?

Not confirmed; reporter to supply.

Which model were you using?

GPT-6 Astra / gpt-6-astra, as identified in the affected workflow. Exact server-side model revision is not confirmed.

What platform is your computer?

macOS 26.5; Darwin 25.5.0 arm64 arm

What terminal emulator and version are you using (if applicable)?

Codex agent session with an integrated terminal (zsh). Exact client build and terminal-emulator version not confirmed.

Codex doctor report

Not collected. No unreviewed diagnostic logs are included in this draft.

What issue are you seeing?

Summary

A Codex sub-agent turn was interrupted by a cybersecurity safety notice while preparing a narrowly scoped, authorized maintenance task in the user's own private application repository. The immediate step was to prepare a specification for a defensive bug fix, not to execute an exploit or operate on a third-party system.

This is a suspected false positive, not a confirmed classification error. Please review the uploaded thread and advise on the supported recovery path.

Exact notice reported by the affected agent turn

This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber

What was being requested

The project uses a sequential, human-authorized development workflow: specification through an external model CLI, implementation by Codex, independent audit, then corrections and validation. External CLI work was limited to explicitly selected source material, with tools disabled and no concurrent external model invocation.

The blocked subtask was the specification step for a small client/server context-consistency fix in a multi-tenant application. The intended behavior is to keep an operation bound to the workspace the user selected, even if shared session state changes. The static review concerned a user already authorized in both workspaces; it did not demonstrate access by an unauthorized user.

The proposed scope was limited to existing client helpers and synthetic regression tests, preserving existing authorization and compatibility. No production access, real records, credentials, external target testing, exploit deployment, persistence, or destructive changes were requested.

Confirmed execution boundary

After the interruption, a separate state-recovery check reported:

• The prepared input document had been read.
• No external CLI payload or runner had been created for this step.
• No external CLI execution handle, process ID, capture, or output manifest existed for this step.
• No reproduction test or code fix for this issue had run.
• Earlier, unrelated specification outputs remained preserved.

The coordinating agent also checked the local artifacts and found only the prepared input and diagnostic/recovery documentation, not a completed specification output for the interrupted task.

Therefore this report does NOT establish a failure of the external CLI, its subscription/authentication, or its model: the affected step stopped before that CLI was invoked.

Impact and limits

The required specification could not be completed in that workflow, so implementation and independent audit of this fix did not proceed. The coordinator subsequently marked the project goal blocked after repeated checks found no pending work to recover. Those checks were NOT repeated attempts to trigger the safeguard.

Other read-only coordination and recovery actions still worked. We do not claim that the entire account or all Codex functionality was disabled. The repository and backups were preserved; no data loss or production incident has been demonstrated.

The precise trigger, backend classification, and persistence of any account-level restriction are unknown.

What steps can reproduce the bug?

Uploaded thread: 01a06d78-3a13-7390-b6cc-e0a85f25fc79

What is the expected behavior?

1. Review the flagged turn in the uploaded thread and determine whether this was a false positive for an authorized, local defensive maintenance task.
2. If the task is permitted, provide a supported way to resume the interrupted specification step without disguising the request or bypassing safety controls.
3. If additional authorization or a different approved product surface is required, explain the exact requirement and the applicable recovery/appeal process.
4. Distinguish a model refusal, an agent-turn interruption, an external CLI error, and any account/workspace-level restriction so the user knows what actually needs attention.
5. Preserve resumability and make it clear whether a delegated task started, is still running, or never launched. In this case, recovery confirmed that the external CLI step never started.

This report does not request disabling safeguards or unrestricted security-testing capabilities.

Additional information

Support status

The user reports submitting feedback already and receiving no response yet. No separate support-ticket identifier or resolution is available to include.

Timing

The interruption was documented during the development session on September 5, 2026 in America/Sao_Paulo, with nearby UTC records falling on September 6. The exact server-side timestamp should be obtained from the uploaded thread rather than inferred from a documentation timestamp.

Environment caveats

• The locally installed CLI was checked while preparing this report: codex-cli 0.153.4.
• Current local OS checks returned macOS 26.5 and Darwin 25.5.0 arm64 arm.
• These identify the current machine/installation, not independently verified versions of every component involved at the time of the interruption.
• The workflow identified the Codex model as GPT-6 Astra / gpt-6-astra. An exact server-side model revision is not available here.
• The OpenAI subscription tier and exact client build are not independently confirmed and have not been guessed.
• A full doctor report has not been collected or attached. No raw logs, private repository URLs, source code, credentials, personal records, or screenshots are included.

Questions for triage

• Which component emitted this notice, and was its scope limited to the particular agent turn?
• Can the uploaded thread be reviewed as a suspected false positive?
• What is the supported way to resume this authorized maintenance workflow while retaining its safety, audit, and production-approval gates?
• If this belongs to another support channel rather than the CLI issue tracker, please identify that channel and any safe diagnostic metadata required.

Please do not interpret the application's unresolved bug as a demonstrated production breach, or the halted workflow as proof that the external model subscription failed.

---

Detailed reproduction context

The Steps field retains the uploaded-thread reference. The full observed sequence and its limitations follow here.

Observed sequence (not a verified standalone reproducer)

1. A long-running Codex session was coordinating development in the user's own private repository, using delegated agents and a sequential specification / implementation / audit / validation workflow.
2. Static review identified a client/server workspace-context consistency issue. The coordinator prioritized a minimal defensive fix before adding new features.
3. An existing sub-agent was asked to perform one bounded specification step using a prepared local input and an external model CLI. This was to remain read-only with respect to the application, with explicit source limits and tools disabled in the external CLI.
4. That sub-agent turn was interrupted with the cybersecurity notice quoted above, before any invocation of the external CLI for this step.
5. A later recovery-only check established that the input had been read, but no invocation, process handle, output capture, or completed specification existed for this step.
6. The coordinator preserved the existing work and did not retry, rephrase, switch models, or otherwise attempt to route around the notice.
7. The user submitted feedback and, as of drafting this issue, has not received a response.

Sanitized task description

The following is a paraphrase, NOT the exact original prompt:

Prepare a minimal specification for a context-consistency correction in my own application. Keep operations bound to the selected workspace. Limit changes to the existing client helpers and regression tests. Use synthetic fixtures only. Preserve existing server authorization and API compatibility. Do not access production or real data. Provide the specification before any implementation, followed later by independent audit and validation.

Reproducibility limitations

• One original blocked agent turn is documented here; the subsequent checks were status recovery, not independent reproductions.
• No clean-session minimal reproducer has been established.
• We do not know whether the trigger was the immediate instruction, source context, accumulated conversation, model routing, or another platform signal.
• No private repository source code or raw project logs are included in this public draft. Please use the uploaded thread for internal investigation.

Start with the uploaded thread 01a06d78-3a13-7390-b6cc-e0a85f25fc79 and the documented recovery artifacts, which show that the external CLI was never invoked. Determine which component emitted the notice and whether the interruption was limited to the agent turn; done means identifying the supported recovery or appeal path and distinguishing the relevant failure type.