False positive — account flagged for “potentially high-risk cyber activity” and rerouted to GPT-5.2

Resolved 💬 5 comments Opened Feb 18, 2026 by Cmochance Closed Feb 20, 2026

💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

While using Codex normally, my account started showing this notice:
“Your account was flagged for potentially high-risk cyber activity… this request was routed to...". I believe this is a false positive. I have not performed any unauthorized security testing, intrusion, exploitation, or malicious activity. My usage is standard software development work on a single device with multiple local client(codex cli, codex desktop and zed), and that is properly authorized. I do not want to submit any photo/ID verification materials, please check carefully and release my limits as soon as possible.

View original on GitHub ↗

5 Comments

github-actions[bot] contributor · 6 months ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

#12159
#12158
#12156
#12155
#12160

Powered by Codex Action

crosschainer · 6 months ago

Don't do KYC. Many including me were hit with this, they will have to get rid of this.

Cmochance · 6 months ago

I reviewed the suggested duplicates. This issue appears different because of the different using stage .
Please keep this issue open. Uploaded feedback thread ID: 019c6ecd-088a-7722-8231-5299577ffa01

Cmochance · 6 months ago

Don't do KYC. Many including me were hit with this, they will have to get rid of this.

Thanks for the suggestion. I agree that requiring KYC here is a very poor decision: it raises serious privacy concerns and creates significant security risks around identity data.

etraut-openai contributor · 6 months ago

Thanks for the bug report. We're continuing to tune our cyber safety classifiers to make them more accurate. You can read more about this here. If you see this again in the future and believe it's a false positive (i.e. you aren't doing anything related to cybersecurity), please use the /feedback slash command and choose "Safety Check" to report it. That will help us further tune our checks.