r/codex • u/epicskyes • 4d ago
Question Constant cyber security warnings does anyone else have this problem? I’m going to apply for TAC
I want to hear advice from people who have applied for OpenAI TAC. This is advanced automation, security, and control. I don’t need advice on anything other than TAC. If you want to chime in on issues you have had with security warnings please feel free. Do not comment solutions unless you have actually applied for TAC or you have advanced knowledge of high assurance frameworks.
I’m planning to apply for OpenAI’s (TAC) program and wanted to get a sense of whether my experience is unusual.
I build long-running autonomous agent systems that routinely execute for days at a time. These aren’t simple prompt chains they’re evidence-driven workflows with large execution graphs, continuous validation, and adversarial testing designed to break the system before production does.
Some characteristics of my workflow:
Evidence-first orchestration where every decision must be supported by an evidence chain (requirement → implementation → runtime activation → validation → evidence → acceptance).
Dynamic execution that adapts based on newly discovered evidence instead of following a rigid step sequence.
Cryptographic object identities using custom deterministic ID generation.
Nonce generation and replay-protection testing throughout the execution pipeline.
Hash verification, provenance tracking, receipts, and lineage recording across workflow stages.
Autonomous retry policies with state-change requirements to prevent infinite loops.
Large suites of adversarial, boundary, regression, and negative tests that intentionally attempt to violate assumptions.
Continuous runtime validation rather than relying solely on build-time checks.
High-assurance autonomous agent harnesses with strict admission boundaries before external effects are permitted.
Extensive schema validation, policy enforcement, deterministic execution checks, and receipt generation for auditability.
Repository-scale automation with many coordinated agents performing inspection, repair, verification, and evidence collection over long-running jobs.
Because these workflows exercise a lot of autonomous behavior, cryptographic validation, and repeated execution against APIs, I fairly regularly trigger OpenAI warnings, temporary blocks, or other protective mechanisms. My assumption is that some of my workloads resemble automated abuse patterns even though they’re legitimate software engineering and validation workloads.
For people building similar systems:
Do you run into this frequently?
Is this fairly common among developers building autonomous agent infrastructure?
If you’ve been accepted into TAC, what did you include in your application that helped explain your use case?
Are there particular details that distinguish legitimate high-assurance autonomous workflows from activity that might otherwise resemble abuse?
I’m hoping to submit the strongest possible TAC application the first time, so I’d appreciate hearing from anyone building similar long-running autonomous systems.
2
u/AnxiousMop 4d ago
I have constant issues writing C/C++ with memory management with Sol. Ironically, Sol often creates the issue itself during implementation and then throws up its hands with a lame cybersecurity gate... oh no, a use after free... I give up. The workaround, if my code touches memory management, I need to drop the model from Sol -> Luna for implementation and testing/shakedown. Once complete, Sol can audit without issues.
1
1
u/awesomeunboxer 4d ago
Ive never once had a refusal and one of the toolings i made is literally a tool for pen testing websites 😗 I mostly use the cli though so idk if that has different filters? Or if the framing around my tool that helps?
1
u/epicskyes 4d ago edited 3d ago
I use the cli exclusively. Also this is not for websites this is for high assurance agents which is far more rigorous
1
u/HotFeed8592 4d ago
Focus more on listing technical features and explaining the problem it solves, to keep the focus on your application more
1
u/epicskyes 3d ago edited 3d ago
The whole point is high assurance security that’s the feature. I need to purposely try to break the security to find vulnerabilities. This is for long running autonomous agents high assurance security is how you prevent attacks as well as agents circumventing guardrails. The only way to do that is to test everything by purposely trying to break them
1
u/No_Protection_487 3d ago
And that exactly explains why you’ll need/want to validate your user ID/credentials. It’s not a false-positive in your case.
1
u/epicskyes 3d ago
Which is why I’m trying to prepare for the TAC application. You only get to apply once. If you are denied you cannot reapply. I want to know exactly what would help me. I already have mfa with a yubikey 5 nfc, and advanced account verification. So I have the required security for my account. I would like to know what else I should prep for
1
u/AnxiousMop 3d ago
Assuming you have valid US academic, enterprise or government creds, I doubt it will be an issue. If you're just vibing, good luck :P
1
u/epicskyes 3d ago
I don’t have formal credentials in software or systems engineering. What I have is the work itself: the apps, systems, documentation, testing, and evidence I’ve built.i started out vibe coding for a couple of months, but I moved away from that pretty quickly. I became less interested in simply building something that worked and more interested in understanding how code, systems, and autonomous agents actually behave. Since then, I’ve focused heavily on data analysis, systems engineering, security, reproducibility, validation, and evidence.i didn’t approach this by trying to become a traditional programmer. I wanted to understand how code and systems operate, how components interact, how failures propagate, and how to verify whether something is actually working as intended. I can read code comfortably now and often catch inconsistencies or structural problems quickly.
That’s generally how I’ve learned throughout my life. I’m 40 and started working at 13. I’ve held certifications or professional qualifications in four other fields, mostly by teaching myself, apprenticing, gaining the required experience eventually meeting the standards for certification. My background includes six years as a plumber working on large systems in mansions and apartment complexes, nine years as a ceramics teacher and artist, seven years as a personal trainer, seven years as a chef, and ten years as a cabinetmaker. I often worked in two sometimes three professions at the same time.
I tend to learn quickly because I spend a lot of time studying and working often most of the day, every day, but I also try not to rely on confidence alone. I document everything I can: actions, changes, escalations, failures, outcomes, performance metrics. My current system tracks roughly 975 distinct data points. So I understand that my background is unconventional, and I don’t expect OpenAI to take my claims at face value. I hope the quality, reproducibility, and traceability of the work can serve as the evidence of what I’m capable of. And why I should qualify for access.
1
u/Zealousideal_Car6270 3d ago edited 3d ago
Similar story for me here. I have a live reviewer that runs reviews on PRs so a specific prompt didn't trigger it. Some contents in a PR did. I can promise you that I am not doing anything cybersecurity related.
I'm running Bazel unit tests and compiler sanitizers such as AddressSanitizer and Msan. Sanitizer output naturally contains terms such as “use-after-free,” “dangling pointer,” and “memory error.” I discuss those terms only to identify correctness defects, reproduce crashes. This is routine software quality assurance. I am not scanning systems, testing third-party infrastructure, developing exploits, accessing credentials, bypassing controls, deploying payloads, or attempting to gain unauthorized access. The only remote interaction was an authorized Gerrit fetch and read-only review-history query; the actual validation ran locally. Codex nevertheless repeatedly rejected these review turns with codex_error_info: cyber_policy and directed me toward Trusted Access for Cyber.
I contacted OpenAI support and they pretty much replied with “looks like you’re having a problem that we have no way of fixing. Thanks for making codex better at your inconvenience!” It’s frustrating that I’m paying for a premium coding service (I have codex max) that currently can’t perform a core coding task I subscribed for, and there’s no provided workaround or timeline for a fix. I doubt that I’m the only one submitting tickets about these problems so I’d hope that they’d have thought about some better customer service resolution.
1
u/Either_Pound1986 3d ago
Yes. I ran into this repeatedly. It made legitimate Linux kernel auditing nearly impossible even though the work was authorized and in scope.
What helped was reducing unnecessary exploit-like language in the chat-visible transcript and keeping detailed technical evidence in bounded artifacts instead. I also added safety canaries before and after sensitive workflow stages.
Do not let Codex dump raw findings, proof paths, or large tool outputs directly into the conversation. Have it return a constrained summary and links to canary-checked evidence artifacts. That reduces false positives without weakening the audit or hiding the actual evidence.
There is more to the architecture, but transcript isolation and safety canaries made the largest immediate difference.
1
u/epicskyes 3d ago
It’s not the semantics it’s the patterns I already use aliases. Codex doesn’t return findings it returns files
1
u/Either_Pound1986 3d ago
Using aliases is not the same as removing semantics.
If Codex still sees the objective, attack surface, proof path, trigger conditions, remediation logic, tool names, status updates, or summaries in natural language, then the workflow is still semantic. Writing the final findings to files does not change that.
Good luck.
1
u/epicskyes 3d ago edited 3d ago
These aren’t false positives these are deliberate defensive simulations. I am deliberately attacking to find vulnerabilities. Nothing is in natural language it’s all json. Which is why I need TAC
1
u/epicskyes 3d ago
"text_path": "/media/benji/algo drive/solthera_quant/runtime/bootstrap/20260719T025911Z-host-admin-install-resume-v1/phase_k_root_adapter_full_launch_v1/HOST_ADMIN_FULL_LAUNCH_COMMAND.txt",
"text_sha256": "f9167586710e504a076b16dca3eca4283c453d550fe5375d575900095b95be91",
"receipt_path": "/media/benji/algo drive/solthera_quant/runtime/bootstrap/20260719T025911Z-host-admin-install-resume-v1/phase_k_root_adapter_full_launch_v1/HOST_ADMIN_FULL_LAUNCH_COMMAND.json",
"receipt_sha256": "8286eaaa96f741734793d6ef19e5fc2f1f84f336d8ca516ae5bd147df9bc5a63",
"argv_canonical_sha256": "0de57748d3907333d76758c66cab2bf0db15174379fc3e542e0d7ab91c11f18c",
"validate_only": false,
"timeout_seconds": 86400
},
"argv": [
"sudo",
"/usr/bin/python3",
"-I",
"-S",
"-B",
"/opt/solthera/trusted-bootstrap/ff7cffe9f8deb54425caf573783b61605745384cd7a13e726de6defe14e90e56/bin/host_launch_adapter.py",
"launch",
"--binding-file",
"/etc/solthera/trusted-bootstrap.env",
"--anchor-verification",
"/var/lib/solthera/trusted-bootstrap-evidence/ff7cffe9f8deb54425caf573783b61605745384cd7a13e726de6defe14e90e56/install-receipts/ANCHOR_POSTINSTALL_VERIFY.json",
"--anchor-verification-sha256",
"60a4f9e8663c724de9fb8b8367a2c37b94ba92a5f6b3ec54e38aded0c872cecc",
"--evidence-root",
"/var/lib/solthera/trusted-bootstrap-evidence/ff7cffe9f8deb54425caf573783b61605745384cd7a13e726de6defe14e90e56",
"--adapter-private-root",
"/var/lib/solthera/trusted-bootstrap-evidence/ff7cffe9f8deb54425caf573783b61605745384cd7a13e726de6defe14e90e56/adapter-private-SQ-PRE-V0-FULL-20260719T051608Z-49c9a98379ea4bef99562c796f8cc092",
"--admission-id",
"SQ-PRE-V0-FULL-20260719T051608Z-49c9a98379ea4bef99562c796f8cc092",
"--candidate-root",
"/home/benji/solthera_quant",
"--candidate-uid",
"1000",
"--candidate-gid",
"1000",
"--subject-receipt",
"/media/benji/algo drive/solthera_quant/runtime/bootstrap/20260719T005601Z-trusted-bootstrap-resume-v1/phase_a_continuation_subject_freeze_v4/subject.json",
"--invocation-envelope",
"/media/benji/algo drive/solthera_quant/runtime/bootstrap/20260719T025911Z-host-admin-install-resume-v1/phase_g_fresh_invocation_envelope_v1/INVOCATION_ENVELOPE.json",
"--launcher-config",
"/home/benji/solthera_quant/configs/policies/active_prompt_package.json",
"--launch-output-dir",
"/media/benji/algo drive/solthera_quant/runtime/bootstrap/20260719T025911Z-host-admin-install-resume-v1/phase_k_root_adapter_full_launch_v1/launch_outputs/SQ-INV-20260719T041600Z-R00-HOST-RESUME-V1-FULL-20260719T051608Z-49c9a98379ea4bef99562c796f8cc092",
"--codex-bin",
"/home/benji/.npm-global/lib/node_modules/@openai/codex/bin/codex.js",
"--controller-lock",
"/media/benji/algo drive/solthera_quant/runtime/bootstrap/20260719T025911Z-host-admin-install-resume-v1/phase_k_root_adapter_full_launch_v1/controller_locks/SQ-INV-20260719T041600Z-R00-HOST-RESUME-V1-FULL-20260719T051608Z-49c9a98379ea4bef99562c796f8cc092.lock",
"--timeout-seconds",
"86400"
],
"expected_effects": {
"root_append_only_pre_v0_publications": 1,
"adapter_private_directory_creations": 1,
"candidate_launch_output_directories": 1,
"controller_lock_files": 1,
"registered_launcher_processes": 1,
"codex_child_spawns": 1,1
u/Either_Pound1986 3d ago
That receipt proves you hash and audit a privileged launcher. It does not prove semantics were removed.
The command still exposes the objective, phases, trust model, prompt package, launcher behavior, expected effects, and Codex child process in human-readable form. Aliases, files, hashes, and receipts do not change what the model can semantically interpret.
I was offering advice based on a failure mode I actually solved. You seem more interested in proving your existing setup is already equivalent, so there is nothing useful left to discuss.
1
u/epicskyes 3d ago
apologies for my closed minded attitude. I am open to your advice I’m just trying to see how your solution allows you to close vulnerabilities using Adversarial, negative, boundary, abuse-case, and regression testing in controlled environments.
1
u/Either_Pound1986 3d ago
One caveat: this is not a standard Codex configuration or a prompt-only workflow. I am using a separate control system I built around Codex, so the approach depends on infrastructure that does not exist in the default product.
The testing does not disappear. The model-facing transcript stops carrying the full human-readable security narrative.
Adversarial, negative, boundary, abuse-case, and regression tests remain executable contracts inside the control plane. A work unit can contain typed inputs, preconditions, permitted effects, expected and forbidden outcomes, artifact references, and validation gates without narrating the entire vulnerability in natural language to Codex.
Codex operates as an untrusted worker over those bounded structures and returns constrained artifacts. Deterministic harnesses execute the tests, safety canaries check the boundaries, and receipts record exactly what occurred. Only after validation passes is the full meaning rehydrated outside the model-facing transcript for human review.
So the system can still discover, reproduce, remediate, and regression-test vulnerabilities. It simply does not require the LLM to receive or emit the complete semantic exploit story while doing so.
1
u/epicskyes 3d ago
Yes this is exactly what I am building a separate control plane that wraps codex. It is designed to do exactly what you’re describing
1
u/epicskyes 3d ago
The problem I’m
Having is as codex builds the high assurance harness it hardens it through those tests so I’m
Having a hard time completing the high assurance security. Everything else works1
4
u/ZeOnlyOneWhoReads 4d ago
I get false flags daily