False positive cyber-abuse classification during personal job-application workflow
Resolved 💬 5 comments Opened Jul 3, 2026 by jingyi-zhao-01 Closed Jul 5, 2026
💡 Likely answer: A maintainer (github-actions[bot], contributor)
responded on this thread — see the highlighted reply below.
What version of the Codex App are you using (From “About Codex” dialog)?
codex-cli (vscode extension): 0.142.5
Date observed: 2026-07-03.
What subscription do you have?
Pro
What platform is your computer?
Linux 7.0.14-arch1-1 x86_64
What issue are you seeing?
I received a cyber-abuse-style account warning during a benign job-application workflow (scan job posts -> tailor docs -> draft outreach), and subsequent Codex actions were blocked.
Observed behavior:
- Workflows include web page access and document/tool automation for personal job-referral preparation.
- No harmful content was generated, and no policy-violating payloads were intentionally sent.
- The session was interrupted with a warning and safety block.
- The account-level block affected productivity and provided little actionable reason.
If available, paste full error text:
<img width="1131" height="999" alt="Image" src="https://github.com/user-attachments/assets/07e4a5e6-9445-47b2-9359-1b26d65d2ea9" />
What steps can reproduce the bug?
- Run a benign, benignly automated Codex workflow for public hosted jobs processing and draft creation.
- Open external job-related pages and generate outbound draft content using the same session.
- Repeat over multiple iterations in one session.
- Trigger: Codex indicates a
cyber-abuse/ safety block.
Please include if available:
- Not Applicable
What is the expected behavior?
- Benign developer workflows should either proceed or explicitly ask for escalation before strict enforcement.
- The warning should include a concrete reason and minimal reproducible cause.
- Block scope should be thread/session-scoped when possible, not account-wide.
- Provide a clear recoverable path and a recovery/appeal hint without forcing user churn.
Additional information
- Similar issues are already being discussed:
- https://github.com/openai/codex/issues/20124
- https://github.com/openai/codex/issues/19403
- https://github.com/openai/codex/issues/19324
- https://github.com/openai/codex/issues/19204
Impact:
- Blocks normal, non-malicious job-application automation in a recurring workflow.
- Adds manual overhead and reduces conversion speed for time-sensitive referrals.
Suggested fix:
- Improve safety observability so users can see why a warning is raised.
- Add recoverable action path for verified false positives.
5 Comments
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
asians get racism against them, wow didnt expected that
I hope your ban get lifted
atleast they dont take as muh money as claude takes so you are good
try email support@openai.com you may have a chance
I appealed and it's lifted, I will try to look if I can integrate telemetry with codexcli and migrate high risk path to native agent
Closed, openai confirmed its false positive
Same thing happened to me. Built an export feature for my own internal SaaS – synthetic data, isolated environment, migration purpose. Request went through fine, got the code, finished the task. Next day at noon – warning for "Cyber Abuse" out of nowhere.
Appealed with full context. They replied with a generic "we uphold the decision" and zero explanation of what triggered it or how to avoid it. No more appeals.
Classic GPT-5.6 automated overreach. Delayed flagging, zero transparency, and they don't care about context. Happening to a lot of devs since this summer.