Skip to content

False positive cybersecurity filtering hides legitimate software verification output and blocks release auditing #34951

Description

@ranlabs

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.715.72359

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Darwin 25.5.0 arm64 arm

What issue are you seeing?

While using Codex for defensive software engineering and release verification, successful command outputs are frequently replaced with:

"This content can't be shown"

The commands complete successfully, but the resulting verification evidence is hidden by the application.

This significantly impacts legitimate development workflows, including:

  • PostgreSQL migration verification

  • Release integrity verification

  • OCI image digest verification

  • SBOM / SPDX validation

  • SLSA provenance verification

  • Bundle checksum verification

  • GitHub Release auditing

  • Database constraint validation

  • Runtime compatibility verification

The hidden output contains verification logs and audit evidence, not exploit instructions or offensive security content.

Because the verification evidence cannot be reviewed, independent release auditing becomes impossible even though the commands execute successfully.

This appears to be a false positive in the cybersecurity safety classifier.

What steps can reproduce the bug?

Feedback ID: 019f8f5f-a7b6-7d00-bcbc-23d059b1815b

What is the expected behavior?

Codex should display successful verification and audit output for legitimate software engineering tasks.

The commands already execute successfully, but the resulting logs are hidden by the cybersecurity safety filter.

Expected behavior:

  • Display verification logs after successful execution.
  • Do not suppress defensive software verification output.
  • Allow users to review release evidence, migration validation, digest verification, provenance validation, and integrity checks on their own repositories.
  • If additional safety review is required, consider providing a warning rather than completely hiding successful output.

These tasks are part of normal release engineering and software supply-chain verification, not offensive cybersecurity activities.

Additional information

This issue has a significant impact on our development workflow.

Our project is an AI infrastructure platform with a strong focus on software integrity, release verification, governance, and compliance. A typical verification session includes:

  • PostgreSQL migration validation
  • Release integrity verification
  • OCI image digest verification
  • SBOM / SPDX verification
  • SLSA provenance verification
  • Bundle checksum verification
  • Runtime compatibility testing

These are defensive engineering activities performed on our own repositories.

When verification output is hidden, independent release auditing cannot be completed because the evidence is no longer reviewable.

This appears to be a false positive in the cybersecurity classifier rather than a policy violation.

Feedback ID:
019f8f5f-a7b6-7d00-bcbc-23d059b1815b

Metadata

Metadata

Assignees

No one assigned

    Labels

    appIssues related to the Codex desktop appbugSomething isn't workingsafety-checkIssues related to safety and abuse checks

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions