False positive cyber-abuse classification during personal job-application workflow

Resolved 💬 5 comments Opened Jul 3, 2026 by jingyi-zhao-01 Closed Jul 5, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

codex-cli (vscode extension): 0.142.5
Date observed: 2026-07-03.

What subscription do you have?

Pro

What platform is your computer?

Linux 7.0.14-arch1-1 x86_64

What issue are you seeing?

I received a cyber-abuse-style account warning during a benign job-application workflow (scan job posts -> tailor docs -> draft outreach), and subsequent Codex actions were blocked.

Observed behavior:

  • Workflows include web page access and document/tool automation for personal job-referral preparation.
  • No harmful content was generated, and no policy-violating payloads were intentionally sent.
  • The session was interrupted with a warning and safety block.
  • The account-level block affected productivity and provided little actionable reason.

If available, paste full error text:

<img width="1131" height="999" alt="Image" src="https://github.com/user-attachments/assets/07e4a5e6-9445-47b2-9359-1b26d65d2ea9" />

What steps can reproduce the bug?

  1. Run a benign, benignly automated Codex workflow for public hosted jobs processing and draft creation.
  2. Open external job-related pages and generate outbound draft content using the same session.
  3. Repeat over multiple iterations in one session.
  4. Trigger: Codex indicates a cyber-abuse / safety block.

Please include if available:

  • Not Applicable

What is the expected behavior?

  • Benign developer workflows should either proceed or explicitly ask for escalation before strict enforcement.
  • The warning should include a concrete reason and minimal reproducible cause.
  • Block scope should be thread/session-scoped when possible, not account-wide.
  • Provide a clear recoverable path and a recovery/appeal hint without forcing user churn.

Additional information

Impact:

  • Blocks normal, non-malicious job-application automation in a recurring workflow.
  • Adds manual overhead and reduces conversion speed for time-sensitive referrals.

Suggested fix:

  • Improve safety observability so users can see why a warning is raised.
  • Add recoverable action path for verified false positives.

View original on GitHub ↗

5 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #30271
  • #29676

Powered by Codex Action

goyiii44545-gif · 1 month ago

asians get racism against them, wow didnt expected that

I hope your ban get lifted

atleast they dont take as muh money as claude takes so you are good

try email support@openai.com you may have a chance

jingyi-zhao-01 · 1 month ago

I appealed and it's lifted, I will try to look if I can integrate telemetry with codexcli and migrate high risk path to native agent

jingyi-zhao-01 · 1 month ago

Closed, openai confirmed its false positive

sergeykomlev · 29 days ago

Same thing happened to me. Built an export feature for my own internal SaaS – synthetic data, isolated environment, migration purpose. Request went through fine, got the code, finished the task. Next day at noon – warning for "Cyber Abuse" out of nowhere.

Appealed with full context. They replied with a generic "we uphold the decision" and zero explanation of what triggered it or how to avoid it. No more appeals.

Classic GPT-5.6 automated overreach. Delayed flagging, zero transparency, and they don't care about context. Happening to a lot of devs since this summer.