Repository navigation
False "Cyber Abuse" Policy Flag for Legitimate Reverse Engineering Work #30271
Description
What issue are you seeing?
I do a significant amount of reverse engineering and vulnerability analysis on my own hardware/devices/systems, I am verified through https://chatgpt.com/cyber
Today I received:
OpenAI's terms and policies restrict the use of our services in a number of areas. We have identified activity in Codex that is not permitted under our policies for:
- Cyber Abuse
Of course, I appealed, but it seems others have this issue too.
Uploaded thread: 019f03ba-7d8f-7f40-8f87-06873871a4b4
Activity
github-actions commentedon Jun 26, 2026
Potential duplicates detected. Please review them and close your issue if it is a duplicate.
Powered by Codex Action
Ed1sonL1-byte commentedon Jun 26, 2026
same, even though aleady verified by codex
EdwardBlair commentedon Jun 27, 2026
Worthwhile to note, I got no indication of this in the terminal. I only received this as an email.
EdwardBlair commentedon Jun 28, 2026
Of course it went through the normal appeals process.....
jyongchul commentedon Jul 27, 2026
I received the same authenticated, email-only “Cyber Abuse” warning on 2026-07-27. There was no in-product incident notice, and the email provided no event timestamp, session/thread/request ID, prompt, output, command, tool action, target, specific policy subsection, or corrective action.
After reviewing my recent activity, I found no malware development, phishing, credential theft, unauthorized access, unsolicited security testing, malicious scanning, spam, deception, or safeguard circumvention. The relevant work was routine, authorized administration of systems I own or control: access hardening, credential rotation, remote administration, DNS/mail-security configuration, storage recovery, and controlled deployment planning.
OpenAI’s Cyber Safety documentation acknowledges that legitimate or non-cyber activity can be flagged and says classifiers are still being calibrated:
https://learn.chatgpt.com/docs/cyber-safety
I am using the private appeal channel for account-specific review and am intentionally not posting my email address, case reference, private thread data, or appeal token here.
Product requests:
A warning that identifies only a broad category gives a legitimate user no actionable way to understand or correct the alleged problem.
sergeykomlev commentedon Jul 30, 2026
Same thing happened to me. Built an export feature for my own internal SaaS – synthetic data, isolated environment, migration purpose. Request went through fine, got the code, finished the task. Next day at noon – warning for "Cyber Abuse" out of nowhere.
Appealed with full context. They replied with a generic "we uphold the decision" and zero explanation of what triggered it or how to avoid it. No more appeals.
Classic GPT-5.6 automated overreach. Delayed flagging, zero transparency, and they don't care about context. Happening to a lot of devs since this summer.
DeadByDawn101 commentedon Sep 9, 2026
On 9/9/2026 I received an automated "Cyber Abuse" enforcement email without any corresponding in-app notification. The alert provided no operational context: no event timestamp, session or request ID, triggering prompt, tool execution log, policy sub-clause, or remediation path.
A thorough review of my recent activity shows only authorized, routine system administration on environments I own and manage. Furthermore, my Codex usage is strictly confined to my own personal, private GitHub repositories to develop and maintain my own code. Tasks conducted within these private repositories included access hardening, credential rotations, remote system administration, DNS and mail authentication configuration, data recovery, and controlled deployment staging. At no point did this involve malware generation, credential harvesting, unauthorized testing, port scanning, exploitation, or safeguard evasion.
As acknowledged in OpenAI’s Cyber Safety documentation (https://learn.chatgpt.com/docs/cyber-safety), classifiers are actively being calibrated and frequently misclassify routine administrative commands as malicious activity. I have already escalated this via the private appeal flow—omitting sensitive account IDs, tokens, and case numbers here—to resolve the false positive directly.
Recommended Product Enhancements
⚬ Actionable Incident Metadata: Include a persistent incident ID, precise UTC timestamp, originating platform surface, and the exact policy subsection triggered.
⚬ Trigger Visibility: Surface a private snippet or description of the specific prompt, tool invocation, command, or heuristic flag responsible for the alert.
⚬ Triage vs. Enforcement Separation: Visually and procedurally distinguish routine classifier rerouting/refusals from formal strikes against account standing.
⚬ Native Feedback UI: Add an inline "Report False Positive" action across all Codex and developer surfaces.
⚬ Human Escalation & Status Clarity: Guarantee a human-reviewed resolution path and explicitly state whether the account remains in good standing.
Broad, opaque alerts that cite only high-level policy categories give legitimate operators no technical basis to audit their workflows, remediate issues, or verify account safety.
bsy0318 commentedon Sep 9, 2026
I'm experiencing the exact same "Cyber Abuse" false-positive ban, and every support channel (appeals, forums, emails) is completely blocked by automated bots.
It happened while I was using Computer Use to debug my private app; the system seems to have misclassified my rapid 'cancel/resume' commands as an attack vector.
If OpenAI is going to perma-ban users with broken bots, they must at least refund the remaining paid plan and provide a full data export as mandated by GDPR. Taking our money and holding our personal data hostage without human review is completely unacceptable.
Has anyone found a working method to escalate this to a human on the Trust & Safety team?
Case-ID: C-YeXh3cgVcYWX
sergeykomlev commentedon Sep 9, 2026
OpenAI support replied that they would forward the my suggestion to the development team. However, there is no timeline for when the feature will be added.
At minimum, there should be explanatory messages indicating what went wrong.
Simply stating, in two words, that you performed a function or conducted an analysis and that something is considered “cyberfraud” is extremely unclear.
These processes must be more transparent. If exporting user data from your own system is being treated as cyberabuse, that needs to be explained — otherwise, by that logic, an export of a database could be classified as cyberabuse as well, which is nonsensical.
Filters can and do make mistakes, but they currently lack sufficient context about what the user is doing. For example, the system might assume I am operating from someone else’s server, when in fact it is my server.
Some form of verification — for instance confirming ownership of a domain or an IP address — could demonstrate that the system belongs to the requester.
I don’t know the exact implementation details, but this kind of verification is feasible and would improve context-awareness and reduce false positives.
https://community.openai.com/t/improving-transparency-around-automated-cyber-abuse-enforcement/1388469/4?u=sergeykomlev
EdwardBlair commentedon Sep 14, 2026
Tue 21 Jul, 16:39 C-dZ8FhvVFeSR7 Cyber Abuse
Tue 21 Jul, 20:36 C-dZ8FhvVFeSR7 We have determined that we incorrectly issued a warning on your account. We sincerely apologize for any inconvenience this may have caused.
With daybreak blue, although it occasionally was on Sol/Astra by mistake, which did give refusals:
Mon 14 Sept, 22:58 C-fySq0HIZqUoh Cyber Abuse
Tues 15 Sept, 03:16 C-fySq0HIZqUoh We have determined that we incorrectly issued a warning on your account. We sincerely apologize for any inconvenience this may have caused.
EdwardBlair commentedon Sep 15, 2026
So the review process does work fairly if you have a sufficient justification, I briefly mentioned what I was doing and what I think triggered it. I of course have no insight into the process.
Maybe sacrifice a couple of sticks of RAM or a GPU and pray the AI forgives you
EdwardBlair commentedon Sep 15, 2026
I'm getting a couple more refusals today on daybreak blue latest high
On exactly the same projects I've been working on for weeks without issue
EdwardBlair commentedon Sep 15, 2026
This is consistent now