False positive: account flagged for cyber activity and routed to gpt-5.2

Resolved 💬 2 comments Opened Feb 18, 2026 by YuriArthas Closed Feb 20, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

I understand this issue may be considered a duplicate, but I am submitting it because I have no visibility into whether cases like mine are actually reviewed unless explicitly reported.

I am the founder and technical lead of a small startup (currently the only engineer). I was setting up an Ubuntu server development environment for a new team member and working on routine backend integration tasks.

During that process, I discussed Feishu-related token handling in Codex. It appears that the term “token” may have triggered an automated risk classification. However, as the conversation progressed, Codex itself clarified the misunderstanding — I was referring to an internal project token used within my own system, not any official Feishu API credential or external service token.

Shortly afterward, my account was flagged and my access was restricted.

I have uploaded the rollout of the relevant session. The content clearly reflects what I described above. After reviewing it, I believe this restriction is the result of an obvious false positive.

There was no attempt to bypass safeguards, relay credentials, or misuse any service. This was standard backend development work.

Session ID:

019c70a5-e905-7ad2-b42d-b44bebe3d52d

I expect this case to be reviewed based on the actual content of the session.

View original on GitHub ↗

2 Comments

github-actions[bot] contributor · 6 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #12146
  • #12145
  • #12142
  • #12136
  • #12132

Powered by Codex Action

etraut-openai contributor · 6 months ago

Thanks for the bug report. We're continuing to tune our cyber safety classifiers to make them more accurate. You can read more about this here. If you see this again in the future and believe it's a false positive (i.e. you aren't doing anything related to cybersecurity), please use the /feedback slash command and choose "Safety Check" to report it. That will help us further tune our checks.