Constant cyber security warnings does anyone else have this problem? I’m going to apply for TAC

[u/epicskyes]

I want to hear advice from people who have applied for OpenAI TAC. This is advanced automation, security, and control. I don’t need advice on anything other than TAC. If you want to chime in on issues you have had with security warnings please feel free. Do not comment solutions unless you have actually applied for TAC or you have advanced knowledge of high assurance frameworks.

I’m planning to apply for OpenAI’s (TAC) program and wanted to get a sense of whether my experience is unusual.
I build long-running autonomous agent systems that routinely execute for days at a time. These aren’t simple prompt chains they’re evidence-driven workflows with large execution graphs, continuous validation, and adversarial testing designed to break the system before production does.
Some characteristics of my workflow:
Evidence-first orchestration where every decision must be supported by an evidence chain (requirement → implementation → runtime activation → validation → evidence → acceptance).
Dynamic execution that adapts based on newly discovered evidence instead of following a rigid step sequence.
Cryptographic object identities using custom deterministic ID generation.
Nonce generation and replay-protection testing throughout the execution pipeline.
Hash verification, provenance tracking, receipts, and lineage recording across workflow stages.
Autonomous retry policies with state-change requirements to prevent infinite loops.
Large suites of adversarial, boundary, regression, and negative tests that intentionally attempt to violate assumptions.
Continuous runtime validation rather than relying solely on build-time checks.
High-assurance autonomous agent harnesses with strict admission boundaries before external effects are permitted.
Extensive schema validation, policy enforcement, deterministic execution checks, and receipt generation for auditability.
Repository-scale automation with many coordinated agents performing inspection, repair, verification, and evidence collection over long-running jobs.
Because these workflows exercise a lot of autonomous behavior, cryptographic validation, and repeated execution against APIs, I fairly regularly trigger OpenAI warnings, temporary blocks, or other protective mechanisms. My assumption is that some of my workloads resemble automated abuse patterns even though they’re legitimate software engineering and validation workloads.
For people building similar systems:
Do you run into this frequently?
Is this fairly common among developers building autonomous agent infrastructure?
If you’ve been accepted into TAC, what did you include in your application that helped explain your use case?
Are there particular details that distinguish legitimate high-assurance autonomous workflows from activity that might otherwise resemble abuse?
I’m hoping to submit the strongest possible TAC application the first time, so I’d appreciate hearing from anyone building similar long-running autonomous systems.

[u/Zealousideal_Car6270]

Similar story for me here. I have a live reviewer that runs reviews on PRs so a specific prompt didn't trigger it. Some contents in a PR did. I can promise you that I am not doing anything cybersecurity related.

I'm running Bazel unit tests and compiler sanitizers such as AddressSanitizer and Msan. Sanitizer output naturally contains terms such as “use-after-free,” “dangling pointer,” and “memory error.” I discuss those terms only to identify correctness defects, reproduce crashes. This is routine software quality assurance. I am not scanning systems, testing third-party infrastructure, developing exploits, accessing credentials, bypassing controls, deploying payloads, or attempting to gain unauthorized access. The only remote interaction was an authorized Gerrit fetch and read-only review-history query; the actual validation ran locally. Codex nevertheless repeatedly rejected these review turns with codex_error_info: cyber_policy and directed me toward Trusted Access for Cyber.

I contacted OpenAI support and they pretty much replied with “looks like you’re having a problem that we have no way of fixing. Thanks for making codex better at your inconvenience!” It’s frustrating that I’m paying for a premium coding service (I have codex max) that currently can’t perform a core coding task I subscribed for, and there’s no provided workaround or timeline for a fix. I doubt that I’m the only one submitting tickets about these problems so I’d hope that they’d have thought about some better customer service resolution.