False "Cyber Abuse" Policy Flag for Legitimate Reverse Engineering Work

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #29208
• #29475
• #29676

Powered by Codex Action

same, even though aleady verified by codex

Worthwhile to note, I got no indication of this in the terminal. I only received this as an email.

Of course it went through the normal appeals process.....

Thank you for reaching out to OpenAI Support. After carefully reviewing your account, we are upholding our decision to issue a warning to your access. We will no longer consider additional requests to appeal this case.

I received the same authenticated, email-only “Cyber Abuse” warning on 2026-07-27. There was no in-product incident notice, and the email provided no event timestamp, session/thread/request ID, prompt, output, command, tool action, target, specific policy subsection, or corrective action.

After reviewing my recent activity, I found no malware development, phishing, credential theft, unauthorized access, unsolicited security testing, malicious scanning, spam, deception, or safeguard circumvention. The relevant work was routine, authorized administration of systems I own or control: access hardening, credential rotation, remote administration, DNS/mail-security configuration, storage recovery, and controlled deployment planning.

OpenAI’s Cyber Safety documentation acknowledges that legitimate or non-cyber activity can be flagged and says classifiers are still being calibrated:
https://learn.chatgpt.com/docs/cyber-safety

I am using the private appeal channel for account-specific review and am intentionally not posting my email address, case reference, private thread data, or appeal token here.

Product requests:

• Include a stable private incident ID, timestamp, affected surface, and specific policy subsection in every warning.
• Provide a private description of the triggering prompt, output, command, tool action, or usage signal.
• Distinguish classifier rerouting from an account-standing warning or enforcement action.
• Add a first-class “Report false positive” action to every Codex surface.
• Provide a human-review path and state clearly whether the account remains in good standing.

A warning that identifies only a broad category gives a legitimate user no actionable way to understand or correct the alleged problem.

Same thing happened to me. Built an export feature for my own internal SaaS – synthetic data, isolated environment, migration purpose. Request went through fine, got the code, finished the task. Next day at noon – warning for "Cyber Abuse" out of nowhere.

Appealed with full context. They replied with a generic "we uphold the decision" and zero explanation of what triggered it or how to avoid it. No more appeals.

Classic GPT-5.6 automated overreach. Delayed flagging, zero transparency, and they don't care about context. Happening to a lot of devs since this summer.