Codex Now Encrypts Multi-Agent Prompts, Breaking Local Auditability

A recent change to OpenAI's Codex CLI encrypts the prompts exchanged between parent agents and sub-agents when using Sol or Terra models. The result: users can no longer inspect what tasks their agents are delegating to each other.

What Changed#

PR #26210 implemented encryption for MultiAgentV2 communications in Codex. When you spawn a sub-agent or send a message between agents, the system now stores only InterAgentCommunication.encrypted_content. The clear-text content field remains empty.

Previously, all prompts were stored in plain text in your local session data. You could browse the logs to see exactly what your parent agent instructed the child agent to do. Now that data is encrypted with keys only OpenAI can decrypt.

This affects three operations in the experimental multi_agent_v2 feature:

• spawn_agent - creating new sub-agents
• send_message - inter-agent communication
• followup_task - continuation requests

Luna model users appear unaffected.

What HN Is Saying#

The Hacker News discussion (80+ points, 30+ comments) surfaced concerns about transparency and debugging.

The debugging problem is immediate. As one commenter explained: "Traditionally, your agent would send a text prompt to the sub-agent, then it goes off doing its work. In the logs/session data, the clear-text prompt would be there, so if I want to see what's happening, I just browse the data. Now if you browse the data, it's all encrypted content that can only be decrypted by OpenAI."

The enterprise concern follows naturally. One user wrote: "If we can't audit agents... only providers can... it's clear we are on a path to enterprise only has access to these tools." For teams that need to understand what their AI systems are doing - for compliance, debugging, or safety - invisible agent chatter is a problem.

The API pooling theory offers a possible motivation. One commenter noted Chinese black market resellers stopped working the day this shipped - the same gray-market relay economy that resells API tokens at up to 97% off. If OpenAI is trying to prevent unauthorized API pooling and data harvesting, encrypting the wire protocol makes that harder.

The competition angle also surfaced. Users speculated OpenAI may be protecting how their multi-agent orchestration works from being reverse-engineered. As one put it: "Quite obviously they're afraid of letting other providers see how they handle the whole multi-agent management stuff."

The Title Confusion#

Several commenters initially misread the HN title ("Codex starts encrypting prompts, uses ciphertext for inference") as implying homomorphic encryption - computing on encrypted data without decrypting it. That would be technically impressive but computationally infeasible at LLM scale.

The reality is simpler: prompts are encrypted client-side before being sent to sub-agents, then decrypted server-side for actual inference. The user just cannot see the clear-text locally.

The GitHub Issue#

Issue #28058 on the Codex repository documents the problem and proposes a solution: maintain encrypted delivery for transport while adding a separate non-encrypted audit field for the readable task text. This would preserve both security and local transparency.

The issue has 20+ thumbs-up reactions and remains open.

Why This Matters#

Agent-based development is trending toward more autonomous multi-step workflows. When something goes wrong - a sub-agent makes a bad decision, hallucinates an API call, or takes an unexpected path - developers need to understand the chain of reasoning.

Encrypting inter-agent prompts makes that debugging impossible without OpenAI's cooperation. For local development, this is inconvenient. For production systems where auditability is a compliance requirement, it may be disqualifying.

Workarounds#

The multi_agent_v2 feature is currently experimental and off by default. If you need full auditability, you can:

1. Avoid Sol and Terra for multi-agent workflows
2. Use Luna, which appears unaffected
3. Build custom orchestration using the app-server RPC API directly
4. Switch to alternative agents like Claude Code that do not encrypt local state

Several commenters mentioned using Codex's app-server for custom integrations. One user built a Rust "conductor" that manages agent interactions through Forgejo issues and PRs, avoiding the encrypted paths entirely.

The Bigger Picture#

This change arrives as AI providers navigate competing pressures: user demands for transparency, enterprise requirements for auditability, competitive concerns about IP leakage, and abuse prevention for API pooling.

OpenAI chose to prioritize the latter concerns here. Whether that trade-off is acceptable depends on your use case. For hobbyist experimentation, probably fine. For production systems with audit requirements, it is a regression that the current GitHub issue aims to address.

Continue Reading#

• ChatGPT Tasks: Scheduled AI Agents Inside ChatGPT
• Codex CLI Vim Mode Is an Ergonomics Signal
• OpenAI Open-Sourced Codex Security: What HN Thinks

Sources#

• GitHub Issue #28058 - Encrypted MultiAgentV2 Messages
• HN Discussion