Account was flagged for potentially high-risk cyber activity. #19748

Activity

1. Nyannnnning

   added

   bugSomething isn't workingSomething isn't working

   on Apr 27, 2026
2. github-actions

   added

   CLIIssues related to the Codex CLIIssues related to the Codex CLI

   windows-osIssues related to Codex on Windows systemsIssues related to Codex on Windows systems

   safety-checkIssues related to safety and abuse checksIssues related to safety and abuse checks

   authIssues related to authentication and accountsIssues related to authentication and accounts

   on Apr 27, 2026
3. github-actions commented on Apr 27, 2026

   

   github-actionsBot

   on Apr 27, 2026 – with GitHub Actions

   Contributor

   More actions

   Potential duplicates detected. Please review them and close your issue if it is a duplicate.

   • False positive cyber-safety flag during passive product research on public webhosting documentation #19403
   • Flagged while already being verified #19204
   • False positive "cybersecurity risk" flags on routine sysadmin/devops work in Codex CLI #19738
   • Codex feedback: false positive cyber mitigation despite Trusted Access verification #19324
   • Trusted access enabled but Codex still shows high-risk cyber slowdown banner #19379

   Powered by Codex Action
4. etraut-openai commented on Apr 27, 2026

   

   etraut-openai

   on Apr 27, 2026

   Contributor

   More actions

   Thanks for reporting. This will help us tune our classifier.
5. etraut-openai

   closed this as completedon Apr 27, 2026
6. Nyannnnning commented on Apr 27, 2026

   

   Nyannnnning

   on Apr 27, 2026

   Author

   More actions

   Hi,

   I think the flag was likely triggered by a small internal tool I built. It’s basically a script that visits a list of websites and takes screenshots — not just for UI/UX, but mainly to check product listing status and where promotional banners are placed.

   There’s no scraping of structured data, no attempt to bypass anything, and no access to restricted areas. It’s just capturing what’s publicly visible on the page.

   That said, I do understand why this might look suspicious from the outside — automated browsing across multiple domains combined with screenshot capture probably overlaps with patterns that resemble crawling or reconnaissance.

   I’ve already paused the tool and I’m reworking it to be more constrained (smaller scope, more explicit triggers, less automation).

   If there are specific guidelines or limits I should follow for this kind of use case, I’d really appreciate the direction so I can adjust properly.