5.3 access revoked and flagged

[JD3Lasers]

presented with this error while working on UX/UI design nothing cyber related at all:
"stream disconnected before completion: This user's access to gpt-5.3-codex-premium-1p-codexswic-ev3 has been temporarily limited for potentially suspicious activity related to cybersecurity. Learn more about our safety mitigations: https://platform.openai.com/docs/guides/safety-checks/cybersecurity"

019cb0d1-63fb-7d00-850d-4a062a5fc6a8

[acSpock]

I literally just got the same thing and posted an issue

[Gurpartap]

Same issue

This user's access to gpt-5.3-codex-premium-1p-codexswic-ev3 has been temporarily limited for potentially suspicious activity related to cybersecurity. Learn more about our safety mitigations: https://platform.openai.com/docs/guides/safety-checks/cybersecurity

434c74f9-faef-45ac-94d9-dd25e2046a66

[UntaDotMy]

i got this as well , war begin ?

[jambrose42]

Me too.

[ahnbu]

False Positive — Documentation workflow (Playwright MCP + web fetch)

• Codex CLI: v0.106.0
• Session ID: 019cb12d-bcd4-7c21-b146-75f640fd7149
• Model in error: gpt-5.3-codex-premium-1p-codexswic-ev3
• Account: Pro
• Triggered: Twice on resume

What I was doing (100% benign):

• Navigating TickTick upgrade/help pages via Playwright MCP (browser_navigate, browser_evaluate)
• Read-only web fetches (Invoke-WebRequest to help.ticktick.com)
• Writing/moving markdown files and editing CHANGELOG.md
• Creating a free-vs-premium comparison table for a documentation repo

What I was NOT doing:

• No vulnerability scanning, exploit development, credential attacks, or access to restricted systems

Error (identical both times):

stream disconnected before completion: This user's access to gpt-5.3-codex-premium-1p-codexswic-ev3 has been temporarily limited for potentially suspicious activity related to cybersecurity.

Likely trigger pattern: Playwright MCP browser automation + PowerShell Invoke-WebRequest running together in the same session. The classifier appears to flag the combination of browser automation + HTTP requests as suspicious, even when it's just reading public documentation pages.

[etraut-openai]

Thanks, we're looking into the cause and will report back when it's mitigated. Apologies for the disruption.

[etraut-openai]

The problem has been mitigated. We're resetting rate limits to compensate everyone for the inconvenience.