Codex users are getting "Cyber Abuse" warnings for security-reviewing their own code.

An r/OpenAI thread documents an account warning from a user who says they only use Codex for coding, appeal rejected and warning upheld (r/OpenAI). A commenter at 71 upvotes reports the identical email, appealed on the grounds that security assessment is part of app development, and got an apology the next day. Astra shipped September 3 as OpenAI's first model rated Critical for cybersecurity capability under its Preparedness Framework. This looks like the enforcement layer that shipped alongside it producing false positives on ordinary security work, with an appeals process that reverses on the second try.