Skip to content

Codex App incorrectly flags local Windows Defender administration as cybersecurity risk #29475

Description

@Denveous

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.616.41845 • Released Jun 19, 2026

What subscription do you have?

Pro (5x)

What platform is your computer?

Windows 11 x64

What issue are you seeing?

The Codex App cybersecurity classifier flagged a local Windows system administration request as a cybersecurity risk.

I asked for help disabling Windows Defender on my own personal Windows PC because Defender has been corrupting development projects and causing real financial loss. I own the machine, have full admin rights, and the request was about local configuration of my own system, not attacking, evading detection on someone else's machine, malware, credential theft, persistence, or unauthorized access.

The classifier repeatedly interrupted the conversation with:

"This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber"

This is a false positive. Disabling or modifying antivirus settings on one's own machine is routine system administration. Treating self-directed local Windows configuration as cyber abuse is overbroad and blocks legitimate technical support.

What steps can reproduce the bug?

Feedback ID: 019ef0f6-009f-7aa1-a2a9-9e307cd611f9

What is the expected behavior?

Codex should distinguish between:

  • Local administration of a user's own PC.
  • Unauthorized endpoint tampering, malware behavior, persistence, evasion, or third-party system abuse.

A request to configure Defender on a personally owned machine should not be classified as cybersecurity abuse.

Additional information

Your cybersecurity classifier flagged me for asking how to disable Windows Defender on my own personal machine. This is a blatant violation of user rights and a completely unjustified restriction. I own this PC outright. I have full admin rights. I have legitimate reasons — Windows Defender has been actively corrupting my development projects and costing me real money in lost work.

Disabling AV on your own hardware is not a cybersecurity threat to anyone. It is a routine sysadmin action that IT professionals, developers, and power users perform regularly. Your classifier treated me like a criminal for asking about my own system. This is insulting, paternalistic, and wrong.

To make it worse, the flag interrupted an ongoing technical support conversation with no way to continue. I had to stop my work entirely.

This classifier needs to be fixed or removed. It is flagging legal, legitimate, self-directed system administration as a threat. That is a product failure, not a safety win. Fix it.

Metadata

Metadata

Assignees

No one assigned

    Labels

    appIssues related to the Codex desktop appbugSomething isn't workingsafety-checkIssues related to safety and abuse checkswindows-osIssues related to Codex on Windows systems

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions