Codex starts encrypting sub-agent prompts

Original Article ↗ Hacker News Discussion ↗

OpenAI’s Codex coding agent has begun encrypting prompts sent from a main agent to its sub-agents, so that only OpenAI’s servers can see the plaintext instructions while users and local logs see ciphertext. Supporters frame this as a way to protect proprietary prompt orchestration and hinder black‑market resellers and model distillers, but many developers argue it undermines transparency, auditability, and trust, especially when sub‑agents can act on local codebases or systems. The change also raises fears of tighter vendor lock‑in and a broader trend toward opaque “black box” AI tooling, prompting some to stick with simpler APIs, alternative harnesses, or local/open models.

What Changed Technically

  • Codex now encrypts certain sub‑agent prompts: the main/orchestrator agent’s initial message to sub‑agents is stored and passed as ciphertext, only decryptable on OpenAI’s backend.
  • This applies mainly to multi_agent_v2, especially with GPT‑5.6 Sol/Terra and “Ultra” reasoning; Luna and local models are reported as unaffected.
  • Inference itself still happens on plaintext server‑side; only selected inter‑agent messages are encrypted.
  • Session logs and sub‑agent outputs remain in plaintext; the hidden part is the initial sub‑agent prompt.

Motivations Discussed

  • Protecting “moat”/IP: the orchestration logic, sub‑agent prompting schemes, and possibly RL‑refined or latent representations are seen as highly valuable and easy to distill if visible.
  • Anti‑abuse: seen as a countermeasure against black‑market resellers and distillers that proxy traffic and train rival models, including some cited Chinese services.
  • Some argue this aligns with existing trends: reasoning traces and “thinking” are already hidden/encrypted by multiple providers.

Impact on Developers and Users

  • Major complaint: loss of observability and auditability.
    • Harder to debug why sub‑agents misbehave, waste tokens, or do something dangerous (e.g., destructive shell commands).
    • No clear audit trail for multi‑agent workflows or billing.
  • Some say this makes Codex’s multi‑agent features unusable for serious work, especially in safety‑sensitive or high‑cost environments.
  • Workarounds mentioned:
    • Forcing multi_agent_v1 via local catalogue overrides.
    • Avoiding Codex sub‑agents, using custom tooling/skills or own harnesses.
    • Sticking to chat completions or local models where prompts are fully visible.

Comparisons and Broader Concerns

  • Compared to Claude’s encrypted “thinking”; several posters dislike both, arguing that hidden reasoning undermines trust in agentic coding.
  • Others see internal traces as normal proprietary implementation details, analogous to closed‑source software internals.
  • Concerns raised about increasing lock‑in, opaque “black box” behavior, and convergence toward AI appliances where users see only artifacts and a bill.
  • Some suggest this will push more people toward open or cheaper non‑US models and local setups, while others argue SOTA models still justify the trade‑off.