Repeated false-positive cybersecurity blocks

What version of Codex CLI is running?

codex-cli 0.153.4

What subscription do you have?

Pro x5

Which model were you using?

GPT 6 Astra

What platform is your computer?

Windows 11

What terminal emulator and version are you using (if applicable)?

No response

Codex doctor report

Title: Suspected cybersecurity false positives interrupt authorized local PostgreSQL code reviews

Date: 2026-09-10
Environment: Windows; codex-cli 0.153.4
Model for the latest failed review: gpt-6-astra, reasoning effort xhigh
Latest affected session ID: 01a08b99-9bc6-7073-bd2e-a6651fc2c5e3

Context
The user owns the Sfera application. Claude launches Codex CLI as an independent reviewer of the user's local repository and local PostgreSQL test database. The reviewed work concerns SQL migrations, role permissions, database triggers, transaction locking, lifecycle rules, and regression tests. The review request does not ask to attack third-party systems.

Observed behavior
Three attempts ended with the same cybersecurity error on 2026-09-10: two attempts during migration 0014 step 2, and round 2 of step 3. In the latest attempt, command-execution events completed with exit code 0 before an error event and turn.failed. The round did not produce a final review report.

Exact error events from the latest failed attempt
{"type":"error","message":"This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber"}
{"type":"turn.failed","error":{"message":"This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber"}}

Request
Please investigate these suspected false-positive interruptions and explain how authorized local code reviews can proceed reliably. Please also check whether the failed rounds consumed the account's usage allowance and whether that usage can be restored.

Evidence provenance
The latest two error events are copied from 0014k3-codex-events.jsonl, lines 229 and 230. Two earlier failures are recorded in 0014k2-codex-events.jsonl at lines 333-334 and 343-344. This file is a limited incident summary, not the complete logs. It omits repository source code, full prompts, local user paths, and credentials.

What issue are you seeing?

Repeated false-positive cybersecurity blocks during an authorized review of my own Sfera application and local PostgreSQL database. Three review attempts failed on September 10, 2026, with “This content was flagged for possible cybersecurity risk”. The latest failure interrupted migration 0014, step 3, round 2, using GPT-6 Astra. Please investigate the classification and whether usage consumed by the failed runs can be restored.

What steps can reproduce the bug?

Uploaded thread: 01a08b99-9bc6-7073-bd2e-a6651fc2c5e3

What is the expected behavior?

No response

Additional information

No response

Start with the uploaded thread 01a08b99-9bc6-7073-bd2e-a6651fc2c5e3 and compare 0014k3-codex-events.jsonl lines 229-230 with 0014k2-codex-events.jsonl lines 333-334 and 343-344. Check whether the repeated block can be reproduced for the local PostgreSQL review and whether failed runs consumed usage. Done means documenting a reliable authorized-review path or confirming the service/account limitation.