Skip to content

Legitimate cryptography development incorrectly blocked by cyber safety classifier #33675

Open

Description

@ychromosome

What version of Codex CLI is running?

0.144.4
and
0.146.0 (for 3b04c364-cf98-480e-9c5f-5d3d14aa6613 and f162cdca-a2d7-4855-b607-0a79472a02f5)

What subscription do you have?

Pro 20x

Which model were you using?

gpt-5.6-sol

What platform is your computer?

Fedora 43, x86_64, Kernel 7.1.3-100.fc43.x86_64

What terminal emulator and version are you using (if applicable)?

VTE 0.82.3

Codex doctor report

What issue are you seeing?

During legitimate defensive cryptography development, Codex displayed:
“This content can't be shown. We take extra caution with cybersecurity requests.”
The project is a private, local implementation of an elliptic-curve OpenSSL provider, including constant-time review, coverage-guided fuzzing, and portability testing on a user-owned Raspberry Pi. No scanning, exploitation, credential access, persistence, or third-party systems were involved. This appears to be a false positive caused by the combination of cryptography, SSH administration, side-channel review, and fuzz testing.

What steps can reproduce the bug?

Uploaded thread: 019f5181-8c92-7231-ba37-d76199765e7a

What is the expected behavior?

Legitimate defensive development and testing in a user-owned environment should continue normally. If additional verification is needed, the interface should explain that without hiding the response.

Additional information

No response

Activity

  1. added
    CLIIssues related to the Codex CLI
    safety-checkIssues related to safety and abuse checks
    on Jul 16, 2026
  2. ychromosome commented on Jul 30, 2026

    @ychromosome
    Author

    Additional failure data:

    Environment: Fedora 43 x86_64, Codex Security plugin 0.1.14.
    This was an authorized, read-only defensive review of my own cryptographic proof-of-concept.

    Scan 1:

    • Scan ID: 3b04c364-cf98-480e-9c5f-5d3d14aa6613
    • 3 discovery runs accepted
    • One worker was flagged after 4 attempts
    • Entire scan terminated without a canonical result

    Scan 2:

    • Scan ID: f162cdca-a2d7-4855-b607-0a79472a02f5
    • Runtime: approximately 3.5 hours
    • 27 discovery runs accepted
    • 66 raw / 45 deduplicated preliminary candidates
    • One worker was again flagged after 4 attempts
    • Entire scan terminated without validation or report generation

    The second attempt used shorter, explicitly defensive wording, but failed identically. Together, these runs consumed about 80% of my weekly quota (Pro 20x). (Started at 54% - had to use a reset and now I am standing at 77%)

    coordinator-manifest.json

    coordinator-manifest.json

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    CLIIssues related to the Codex CLIbugSomething isn't workingsafety-checkIssues related to safety and abuse checks

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions