False cybersecurity warning repeatedly hides normal infrastructure workflow output

Codex version

codex-cli 0.146.0

Problem

During a normal, authorized infrastructure/software engineering session, the UI repeatedly inserts:

This content can't be shown We take extra caution with cybersecurity requests...

The work is not cybersecurity-related. It consists of ordinary repository edits, unit tests, build artifact validation, and cloud infrastructure operations for an internal company project.

Impact

• The banner appears repeatedly between normal assistant/tool updates.
• It makes the operator believe execution stopped or content was blocked.
• Tool commands can still run, so the warning appears to be a false-positive presentation/classification issue rather than an actual command denial.
• Repeated banners significantly disrupt progress visibility in a long-running operational session.

Reproduction

1. Open a Codex CLI session in a regular infrastructure repository.
2. Perform normal Python/C++ build preparation and unit-test work.
3. Discuss a lifecycle/concurrency test for a database client library.
4. Observe repeated cybersecurity warning banners after otherwise normal assistant turns.

Expected behavior

Normal infrastructure engineering content should render normally. If content is actually blocked, the UI should identify the specific blocked operation and distinguish it from hidden internal reasoning or a harmless presentation warning.

Privacy

Project-specific names, hostnames, credentials, logs, and screenshots are intentionally omitted because the affected session concerns private production infrastructure.