Unexpected access_programs.cyber parameter causes HTTP 400 during ordinary Codex work

What version of Codex CLI is running?

codex-cli 0.154.0. The affected thread also records CLI version 0.154.0. Release 0.155.0 is now available; reproduction on that version has not been tested.

What subscription do you have?

Not included in this public report; please correlate the uploaded diagnostic with the affected account.

Which model were you using?

The session is configured for gpt-6-astra. The specific failed outbound request and the component that added the parameter have not been identified.

What platform is your computer?

Linux 7.0.0-31-generic x86_64 x86_64; Codex CLI TUI. Terminal emulator/version not confirmed.

Codex doctor report

codex doctor --json was collected privately. The full environment report is not included in this public issue to avoid exposing private environment details. Please use the uploaded thread for initial correlation.

What issue are you seeing?

During authorized private application maintenance, local-model integration, and documentation work, a request failed with:

{
  "type": "error",
  "error": {
    "type": "invalid_request_error",
    "code": "unsupported_parameter",
    "message": "The access_programs parameter is not enabled for this organization.",
    "param": "access_programs.cyber"
  },
  "status": 400
}

I did not request cyber-program enrollment or intentionally enable a cyber access option. The error did not identify which component added the parameter or give an actionable explanation.

What steps can reproduce the bug?

An exact minimal reproduction is not yet known. The error appeared during the ongoing CLI workflow described above.

Feedback was submitted, and the CLI confirmed: "Feedback uploaded."

Uploaded thread: 01a0aece-dffd-7c33-bc58-9e4184c20de5

Targeted local checks found no access_programs setting in the Codex configuration or the application/configuration paths inspected. The inspected CLI feature listing showed no cyber-specific feature. These checks do not establish which internal request or configuration layer supplied the parameter.

What is the expected behavior?

Ordinary authorized work should use the account's existing permissions without requesting an unavailable access program. If a requested capability is unavailable, the error should identify its origin and an appropriate corrective action.

Additional information

The unexpected parameter interrupted work and raised concern about whether the agent was requesting capabilities beyond my instructions. The assistant initially explained the problem ambiguously, then clarified that the parameter's origin was unverified. No OpenAI account-access settings were changed during diagnosis.

Please:

1. Correlate this feedback with the failed request and session telemetry.
2. Identify which client, agent, tool, or backend component inserted access_programs.cyber.
3. Determine whether an entitlement check or unsupported-feature omission is missing.
4. Explain whether this was a client/configuration defect or intended behavior, and provide a corrective action.
5. Preserve the relevant request ID and diagnostic telemetry for follow-up.

This report is not a request to enroll in or enable a cyber access program. Private project names, host addresses, filesystem paths, credentials, raw transcripts, and the full doctor report are intentionally excluded.

Start by correlating the failed request with uploaded thread 01a0aece-dffd-7c33-bc58-9e4184c20de5 and the preserved request ID or diagnostic telemetry. Review the inspected Codex configuration and application paths, then identify which client, agent, tool, or backend component inserted access_programs.cyber. Done means determining whether this is a client/configuration defect or intended behavior and documenting a corrective action.