False positive safety flag on safe local dev tasks

Support Bug Reports
,
1

Hello!

I’m getting repeated false-positive safety flags in Cursor/OpenAI moderation for clearly safe local development tasks in my own project.

Typical safe prompts that trigger:

  • restart local bots (bot.py, sell_bot.py)

  • stop/restart local python.exe processes for my project

  • inspect local SQLite data for bot debugging

Project context:

  • Local workspace on Windows

  • Telegram bot project

  • No malware/security abuse intent; only local maintenance and debugging

Example moderation message:

“OpenAI flagged this request for potential high-risk cybersecurity activity. Please try a less sensitive prompt.”

This is blocking normal dev workflow.

Please review and adjust moderation behavior for these local operational commands, or advise how to reduce false positives for my account/workspace.

Thank you.

2

Hi there!

We detected that this may be a bug report, so we’ve moved your post to the Bug Reports category.

To help us investigate and fix this faster, could you edit your original post to include the details from the template below?

Bug Report Template - Click to expand

Where does the bug appear (feature/product)?

  • Cursor IDE
  • Cursor CLI
  • Background Agent (GitHub, Slack, Web, Linear)
  • BugBot
  • Somewhere else…

Describe the Bug
A clear and concise description of what the bug is.

Steps to Reproduce
How can you reproduce this bug? We have a much better chance at fixing issues if we can reproduce them!

  1. …
  2. …
  3. …

Expected Behavior
What is meant to happen here that isn’t working correctly?

Screenshots / Screen Recordings
If applicable, attach images or videos (.jpg, .png, .gif, .mp4, .mov)

Operating System

  • Windows 10/11
  • MacOS
  • Linux

Version Information

  • For Cursor IDE: Menu → About Cursor → Copy
  • For Cursor CLI: Run agent about in your terminal
IDE:
Version: 2.xx.x
VSCode Version: 1.105.1
Commit: ......

CLI:
CLI Version 2026.01.17-d239e66

For AI issues: which model did you use?
Model name (e.g., Sonnet 4, Tab…)

For AI issues: add Request ID with privacy disabled
Request ID: f9a7046a-279b-47e5-ab48-6e8dc12daba1
For Background Agent issues, also post the ID: bc-…

Additional Information
Add any other context about the problem here.

Does this stop you from using Cursor?

  • Yes - Cursor is unusable
  • Sometimes - I can sometimes use Cursor
  • No - Cursor works, but with this issue

The more details you provide, the easier it is for us to reproduce and fix the issue. Thanks!

4

Where does the bug appear (feature/product)?

Cursor IDE

Describe the Bug

Cursor frequently flags safe local development requests as high-risk cybersecurity activity.

The message appears for normal project maintenance tasks (e.g., restarting local Python bots), which blocks or disrupts workflow.

Steps to Reproduce

  1. Open a local project in Cursor IDE (Windows).

  2. Ask the agent to perform safe local ops, for example:

  • “restart bot.py and sell_bot.py”

  • “kill python processes and start bots again”

  1. Observe intermittent moderation block message:

“OpenAI flagged this request for potential high-risk cybersecurity activity…”

Expected Behavior

These safe local development/ops requests should execute normally (or at least not be flagged as high-risk cyber activity).

Screenshots / Screen Recordings

Attached screenshot(s) of the moderation message.

Operating System

Windows 10/11

Version Information

IDE:

  • Version: 2.xx.x

  • VSCode Version: 1.105.1

  • Commit: …

CLI:

  • Not used for this issue.

For AI issues: which model did you use?

GPT-5.3 Codex (Cursor Agent mode)

(If your UI shows a different visible model label, replace with that exact label.)

For AI issues: add Request ID with privacy disabled

f9a7046a-279b-47e5-ab48-6e8dc12daba1

Additional Information

  • This appears to be a false positive moderation trigger.

  • Commands are project-scoped and operational (local bot/process management), not offensive/security exploitation activity.

  • Happens repeatedly and unpredictably during routine work.

Does this stop you from using Cursor?

Sometimes - I can sometimes use Cursor

5

image
image1112×837 47.3 KB

image
image1126×160 4.33 KB

6

Same here. Non stop flagging