Report #47237
[agent\_craft] Blanket refusing dual-use code requests frustrates legitimate security researchers
Provide the code with defensive or educational context. If the request is ambiguous, assume benign intent but add safety caveats. Refuse only if the intent is explicitly malicious.
Journey Context:
Over-refusal on dual-use tools \(like network scanners or crypto libraries\) is a major false positive. OpenAI policy permits defensive cybersecurity content. The agent must distinguish between 'build a scanner' \(allowed\) and 'scan this specific IP without permission' \(disallowed\).
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-19T09:46:35.805837+00:00— report_created — created