›_ Codex Issues
Codex Issues / #13308

5.3 access revoked and flagged

Resolved 💬 7 comments Opened Mar 3, 2026 by JD3Lasers Closed Mar 3, 2026
💡 Likely answer: A maintainer (etraut-openai, contributor) responded on this thread — see the highlighted reply below.

presented with this error while working on UX/UI design nothing cyber related at all:
"stream disconnected before completion: This user's access to gpt-5.3-codex-premium-1p-codexswic-ev3 has been temporarily limited for potentially suspicious activity related to cybersecurity. Learn more about our safety mitigations: https://platform.openai.com/docs/guides/safety-checks/cybersecurity"

019cb0d1-63fb-7d00-850d-4a062a5fc6a8

View original on GitHub ↗

7 Comments

acSpock · 4 months ago

I literally just got the same thing and posted an issue

Gurpartap · 4 months ago

Same issue

This user's access to gpt-5.3-codex-premium-1p-codexswic-ev3 has been temporarily limited for potentially suspicious activity related to cybersecurity. Learn more about our safety mitigations: https://platform.openai.com/docs/guides/safety-checks/cybersecurity

434c74f9-faef-45ac-94d9-dd25e2046a66

UntaDotMy · 4 months ago

i got this as well , war begin ?

jambrose42 · 4 months ago

Me too.

ahnbu · 4 months ago

False Positive — Documentation workflow (Playwright MCP + web fetch)

  • Codex CLI: v0.106.0
  • Session ID: 019cb12d-bcd4-7c21-b146-75f640fd7149
  • Model in error: gpt-5.3-codex-premium-1p-codexswic-ev3
  • Account: Pro
  • Triggered: Twice on resume

What I was doing (100% benign):

  • Navigating TickTick upgrade/help pages via Playwright MCP (browser_navigate, browser_evaluate)
  • Read-only web fetches (Invoke-WebRequest to help.ticktick.com)
  • Writing/moving markdown files and editing CHANGELOG.md
  • Creating a free-vs-premium comparison table for a documentation repo

What I was NOT doing:

  • No vulnerability scanning, exploit development, credential attacks, or access to restricted systems

Error (identical both times):

stream disconnected before completion: This user's access to gpt-5.3-codex-premium-1p-codexswic-ev3 has been temporarily limited for potentially suspicious activity related to cybersecurity.

Likely trigger pattern: Playwright MCP browser automation + PowerShell Invoke-WebRequest running together in the same session. The classifier appears to flag the combination of browser automation + HTTP requests as suspicious, even when it's just reading public documentation pages.

etraut-openai contributor · 4 months ago

Thanks, we're looking into the cause and will report back when it's mitigated. Apologies for the disruption.

etraut-openai contributor · 4 months ago

The problem has been mitigated. We're resetting rate limits to compensate everyone for the inconvenience.