GPT-6 Astra: HTTP 422 cyber-risk rejection during local heap-OOM debugging

[kondv]

Type: Bug

Copilot CLI Version: 1.0.84-5
OS Version: Windows 11 x64
Model: gpt-6-astra

Summary

While debugging Copilot CLI's own JavaScript heap OOM, a request to gpt-6-astra failed with HTTP 422 and a message telling me to join Trusted Access for Cyber.

The task was local crash reproduction and memory analysis, not security testing.

Steps to Reproduce

No minimal prompt or deterministic reproducer yet. The observed workflow was:

1. Use an interactive CLI session with gpt-6-astra.
2. Analyse local Node.js OOM reports and work on a local crash reproducer.
3. A subsequent model request fails with the error below.

Actual Behaviour

The CLI reports:

Execution failed: 422 This content was flagged for possible cybersecurity risk. If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program: https://chatgpt.com/cyber (Request ID: ...)

The session log records session.error, errorType: "query" and statusCode: 422. The request fails instead of returning an answer.

The error does not identify which part of the conversation was flagged.

Expected Behaviour

Routine local crash debugging should not require security-work authorisation. A suspected false positive should have a clear reporting path, with the CLI distinguishing a service policy rejection from a normal assistant response.

Notes

• One observed rejection. I have not reduced it to a standalone prompt or reproduced it on the latest CLI.
• The log confirms an HTTP 422 policy response, not which backend component made the decision or which input triggered it.
• This is separate from the stream-truncation failures: the service returned an explicit rejection here.

Impact

An ordinary debugging request is blocked with a security-work message that does not explain what needs correcting.