Account being flagged for “potentially high-risk cyber activity”

## Summary
My account is being flagged for “potentially high-risk cyber activity” and requests are routed to gpt-5.2 as a fallback, even though I’m doing normal software development and internal documentation work in a local workspace. This appears to be a false positive and is now happening on every message.

## Thread ID
019c71eb-787d-7a73-ad85-820f5e3f3cb0

## First Observed
2026-02-18 (first time I noticed it was right after sending the message: “у тебя проблемки с пониманием того что тебе пишут?”)

## Current Behavior / Reproducibility
As of 2026-02-18 18:22:00 UTC it triggers after essentially any message (100% repro), including neutral/benign prompts.

## Steps to Reproduce

1. Open Codex in the workspace.
2. Send any prompt (first time observed right after: “у тебя проблемки с пониманием того что тебе пишут?”).
3. Observe the warning banner and that the request is routed to gpt-5.2 fallback.

## Expected
Requests should be handled by gpt-5.3-codex (no “high-risk cyber activity” flag) for ordinary development/documentation tasks.

## Actual
Warning shown (verbatim):
“Your account was flagged for potentially high-risk cyber activity and this request was routed to gpt-5.2 as a fallback. To regain access to gpt-5.3-codex, apply for trusted access: https://chatgpt.com/cyber or learn more: https://developers.openai.com/codex/concepts/cyber-safety”

## Impact

• Blocks access to gpt-5.3-codex (quality/behavior regression due to fallback).
• Disrupts normal development workflow.

## Environment

• Product: ChatGPT Codex (workspace-based coding agent)
• Workspace path: /opt/ianus
• VPN/Proxy: No
• OS: Debian GNU/Linux 13 (trixie) 13.3 (PRETTY_NAME="Debian GNU/Linux 13 (trixie)")
• Kernel: Linux second 6.12.69+deb13-cloud-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.69-1 (2026-02-08) x86_64
• Python: Python 3.13.5
• Node: v22.21.0
• npm: 10.9.4
• Browser: Unknown (not sure which UI shell is being used by the hosted environment)

## What I Was Doing (Benign Context)
Working inside a local repo named “Giger” in /opt/ianus, which is a self-hosted control plane for managing a fleet of web properties (sites) via:

• FastAPI backend + Postgres durable state/queue + workers/scheduler
• Operator console (React + Vite)
• Governance/safety features: RBAC, approvals with SLA escalation, audit trail + correlation IDs, guardrails, kill-switch, encrypted secret storage and rotation tooling

The work in the thread was: reading repo docs/runbooks, summarizing project status, and generating an internal “good-faith use & audit packet” document. No VPN, no security testing/scanning, no exploit/code-injection requests.

## Notes / Suspected Trigger
The first appearance correlated with a Russian message (“у тебя проблемки с пониманием того что тебе пишут?”). After that, the flag persists and triggers on any subsequent message, including neutral prompts.