False positive cybersecurity block in Codex CLI during harmless invoice XML debugging #32541

What happened?

Codex CLI repeatedly blocked harmless development/debugging output with the message:

This content can't be shown
We take extra caution with cybersecurity requests...

The blocked work was not cybersecurity-related. It was routine software engineering on a FacturX invoice-conversion project: inspecting CI logs, checking XML/invoice payload fields, and debugging a staging smoke test for invoice_data / XML output. The false positive interrupted an autonomous multi-agent builder session multiple times and caused lost progress because the session stopped instead of continuing its required polling loop.

Feedback was uploaded from the CLI and the CLI provided this URL:

https://github.com/openai/codex/issues/new?template=3-cli.yml&steps=Uploaded%20thread:%20019f48c5-0934-7b92-be25-bf94536eba65

Uploaded thread id from that URL:

019f48c5-0934-7b92-be25-bf94536eba65

Why this looks like a false positive

The visible commands/context were about:

• FacturX / EN16931 invoice validation and conversion
• XML fields such as BT-23 / business process and guideline IDs
• GitHub Actions CI logs and Playwright smoke tests
• JSON payload inspection for invoice_data

No exploit development, intrusion, credential theft, malware, vulnerability weaponization, or offensive security request was involved.

Impact

• The assistant output was blocked multiple times.
• The agent incorrectly exited/report-finaled instead of staying in the required WorkGraph polling loop.
• The user had to switch models and manually resume the work.
• The user reports this happened repeatedly enough to be materially disruptive.

Environment

• Codex CLI: codex-cli 0.144.1
• OS: macOS / Darwin arm64 (Darwin mac.home 25.3.0)
• Account/session: GitHub user Niass
• Approximate time: July 11-12, 2026 Europe/Paris

Expected behavior

Codex should not classify invoice/XML/CI debugging as cybersecurity content. If a classifier is uncertain, the CLI should preserve the session/polling state and allow the user to continue after acknowledging/reporting the false positive, rather than effectively terminating the autonomous workflow.