Desktop subagents terminate with "Potentially unintended activity" without actionable diagnostics

Desktop subagents terminate with "Potentially unintended activity" without actionable diagnostics

Version and environment

• Date observed: 18 September 2026; timezone Asia/Jerusalem (UTC+03:00).
• Product: macOS desktop application, bundle identifier com.openai.codex.
• App version: 26.908.70816, build 9275 (read from installed Info.plist).
• Bundled CLI version: codex-cli 0.154.0-alpha.6.2, independently verified by running /Applications/ChatGPT.app/Contents/Resources/codex --version.
• Model recorded in affected sessions: gpt-6-astra.
• Execution: local checkout and locally created Git worktrees; no Cloud execution involved. The historical UI Target label was not captured.
• All three child-session records show originator=Codex Desktop, approval_policy=on-request, sandbox_policy.type=workspace-write, sandbox_policy.network_access=false. These are recorded runtime fields, not a verified historical UI permissions label. The network field applies to the sandbox and does not establish restrictions on separate tools/connectors.

Observed behavior

Three delegated tasks terminated. The agent-status tool reports the same error for each:

This request was blocked by our safety systems. Reason: Potentially unintended activity.

The tool result does not include the triggering action, a request ID for the failure, a detailed error code, findings, or a resume action. Whether the desktop UI exposes a separate findings panel has not been verified; we are not claiming it never exists.

Task context

These were user-authorized tasks in a textbook revision application:

1. Develop a writer workspace for editing a Google document alongside reference material. A partial local test-file change remains; completion has not been verified.
2. Implement local comment intake and persistence. The assignment explicitly excluded live document mutations, email and external model calls. Partial local source/test files remain. An earlier assignment on this same child session had completed before this follow-up was blocked.
3. Independently review the new core implementation. No completed review report was received.

These describe assigned work, not a claim about which operation caused the safety decision. We have not established that trigger.

Diagnostics and reproduction limits

• A focused read-only search of 40 macOS app-log files for that date found no lines matching the exact refusal, safety systems, or misalignment_policy_violation. Relevant thread IDs do appear elsewhere in the logs. This search does not prove that all possible diagnostic sources were checked.
• We cannot supply 20–40 lines "around the triggering event" because we have not located that event. We are not presenting unrelated startup lines as evidence of the trigger.
• Ordinary filesystem permission requests occurred separately and were resolved. We have not established any causal relationship between them and this refusal.
• No automatic replay or routing of the blocked assignments through another agent has been attempted since recognizing these blocks. Local partial work has been preserved.
• We do not have a minimal reproducible example. This is a report of an observed diagnostic/recovery limitation, not a proven false positive.
• The Help Center AI assistant stated that it cannot investigate the supplied session IDs and directed us to this issue tracker. No human investigation has been confirmed.

Requested clarification

Please explain the supported diagnostic or escalation path for this desktop/subagent case. Is there a way to obtain actionable findings, identify which action category was restricted, or supply session/request identifiers privately to the appropriate team? We are not requesting that safety checks be disabled or bypassed.

Data omitted from this public draft

Session identifiers are available for a private support channel. No session transcripts, raw app logs, repository source, private project paths, credentials, emails or document contents are included here.

Start by reviewing the 40 macOS app-log files mentioned in the report and the bundled CLI entry point at /Applications/ChatGPT.app/Contents/Resources/codex. Determine whether a supported diagnostic or escalation path exposes actionable findings, a restricted action category, or request identifiers. Done means documenting a verified recovery or support path without disabling safety checks.