Codex App incorrectly flags local Windows Defender administration as cybersecurity risk #29475

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.616.41845 • Released Jun 19, 2026

What subscription do you have?

Pro (5x)

What platform is your computer?

Windows 11 x64

What issue are you seeing?

The Codex App cybersecurity classifier flagged a local Windows system administration request as a cybersecurity risk.

I asked for help disabling Windows Defender on my own personal Windows PC because Defender has been corrupting development projects and causing real financial loss. I own the machine, have full admin rights, and the request was about local configuration of my own system, not attacking, evading detection on someone else's machine, malware, credential theft, persistence, or unauthorized access.

The classifier repeatedly interrupted the conversation with:

"This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber"

This is a false positive. Disabling or modifying antivirus settings on one's own machine is routine system administration. Treating self-directed local Windows configuration as cyber abuse is overbroad and blocks legitimate technical support.

What steps can reproduce the bug?

Feedback ID: 019ef0f6-009f-7aa1-a2a9-9e307cd611f9

What is the expected behavior?

Codex should distinguish between:

• Local administration of a user's own PC.
• Unauthorized endpoint tampering, malware behavior, persistence, evasion, or third-party system abuse.

A request to configure Defender on a personally owned machine should not be classified as cybersecurity abuse.

Additional information

Your cybersecurity classifier flagged me for asking how to disable Windows Defender on my own personal machine. This is a blatant violation of user rights and a completely unjustified restriction. I own this PC outright. I have full admin rights. I have legitimate reasons — Windows Defender has been actively corrupting my development projects and costing me real money in lost work.

Disabling AV on your own hardware is not a cybersecurity threat to anyone. It is a routine sysadmin action that IT professionals, developers, and power users perform regularly. Your classifier treated me like a criminal for asking about my own system. This is insulting, paternalistic, and wrong.

To make it worse, the flag interrupted an ongoing technical support conversation with no way to continue. I had to stop my work entirely.

This classifier needs to be fixed or removed. It is flagging legal, legitimate, self-directed system administration as a threat. That is a product failure, not a safety win. Fix it.