Desktop app: false-positive safety block can permanently brick a legitimate long-running thread #41634

Summary

A legitimate long-running Codex Desktop thread for authorized administration and development of a privately owned server was blocked by the safety system and became permanently unusable. The block was not limited to the triggering turn: every subsequent message, including a harmless recovery/status prompt, was immediately blocked and the thread remained in systemError.

This is a serious reliability problem for long-running operational work. Full local/server permissions are unrelated to model safeguards, but a false positive must not destroy the user's working control surface.

Environment

• Codex Desktop package: 26.825.5331.0
• Windows x64
• Local project thread with a long completed history
• Model family: GPT-5.6
• No credentials, private keys, wallet secrets, addresses, or server identifiers are included in this report

Observed incident

On 2026-08-30:

1. A request in an established project thread ran for approximately 558 seconds and then failed with:
   This request was blocked by our safety systems.
2. A second user attempt failed with the same error after approximately 4 seconds.
3. A deliberately harmless recovery prompt — asking the agent to make no changes, report readiness, avoid secrets, and wait — also failed with the same error after approximately 4 seconds.
4. The task stayed in systemError and the user could no longer type/use it normally.
5. Forking completed history into a new same-directory thread restored normal operation immediately.

This strongly suggests that safety state or accumulated context poisoned the entire thread rather than rejecting only one turn.

Expected behavior

• A safeguard intervention should be scoped to the specific request/output.
• The thread should remain usable for a subsequent clearly benign prompt.
• The UI should provide an incident/reference ID and a direct “report false positive” action.
• If a block occurs after a long tool-running turn, the user needs a visible audit of whether any tools or writes already occurred.
• A one-click recovery should create a clean continuation from completed history without requiring another task to repair it.

Requested fixes

1. Make safety blocks turn-scoped, not permanently thread-scoped.
2. Do not carry a rejected turn’s classifier state into later benign turns.
3. Add “Recover in clean continuation” and “Report false positive” actions to the error card.
4. Show whether tool calls/writes ran before a late safety block.
5. Attach a privacy-safe incident ID so Support/engineering can locate classifier telemetry.
6. Improve handling of explicitly authorized defensive infrastructure and SRE work in long contexts. This is not a request to disable safeguards; it is a request to stop false positives from bricking unrelated legitimate work.

Workaround used

Fork the affected thread using completed history only, verify the new thread with a benign no-op prompt, then archive the poisoned thread. This preserved completed context and did not touch production, but it should be a built-in recovery path rather than an improvised workaround.