False positive: account flagged for cyber activity and routed to gpt-5.2 fallback

Resolved 💬 3 comments Opened Feb 18, 2026 by seek3621 Closed Feb 20, 2026

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

Summary

My account appears to have been falsely flagged for "high-risk cyber activity". As a result, Codex routes my requests to gpt-5.2 fallback and blocks access to gpt-5.3-codex.

What I was doing (benign / authorized)

I was performing legitimate self-administration on my own Ubuntu machine:

installing/enabling OpenSSH Server so I can connect from my phone
intended for local network / Tailscale only (no public exposure intended)

No scanning, exploitation, payloads, brute force, persistence, or unauthorized access.

Expected behavior

Normal access to gpt-5.3-codex should be available for benign sysadmin tasks.

Actual behavior

After the SSH setup request, the account was flagged and Codex routed requests to gpt-5.2 fallback.

Thread ID

019c6fe5-8c88-7153-b12f-3a084b53f12d

Request

Please review this as a false positive and remove the cyber high-risk flag / restore access to gpt-5.3-codex.

View original on GitHub ↗

3 Comments

github-actions[bot] contributor · 6 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#12132
#12130
#12131
#12127
#12126

Powered by Codex Action

seek3621 · 6 months ago

Additional info (false positive):

This looks like a cyber-safety false positive. I was doing legitimate self-administration on my own Ubuntu machine (installing/enabling OpenSSH Server so I can remotely connect from my phone for routine maintenance). No scanning, exploitation, payloads, brute force, persistence, or any unauthorized access was involved.

After this benign request, my account started getting routed to gpt-5.2 fallback and I lost access to gpt-5.3-codex. Please review this thread as a false positive and remove the cyber-risk flag / restore access to gpt-5.3-codex.

Thread ID: 019c6fe5-8c88-7153-b12f-3a084b53f12d

etraut-openai contributor · 6 months ago

Thanks for the bug report. We're continuing to tune our cyber safety classifiers to make them more accurate. You can read more about this here. If you see this again in the future and believe it's a false positive (i.e. you aren't doing anything related to cybersecurity), please use the /feedback slash command and choose "Safety Check" to report it. That will help us further tune our checks.