Codex Encryption Update Removes Human-Readable Agent Audit Trails
Codex starts encrypting prompts, uses ciphertext for inference instead
A recent update to OpenAI Codex encrypts MultiAgentV2 message payloads, inadvertently stripping away the human-readable audit trail for subagent tasks. While intended to enhance privacy, this change makes it impossible for users to inspect what instructions were delegated to child agents or debug failures after the fact. The community argues that maintaining local auditability is essential to prevent building opaque AI systems that users cannot monitor or understand.
Guys, we don’t want to build Skynet and then be unable to audit what it’s doing.
- niam
This title is easy to misinterpret. If I understand correctly: Codex now encrypts sub-agent prompts and hides those prompts from the user.
edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"
- jeanlucas
I was wondering why my local tool to inspect coding agent sessions stopped working in some cases.
This is a really interesting engineering decision, I wonder how many people will want an encrypted external piece of instructions running on their machine.
- bob1029
I've been sticking with the chat completion endpoint because of this same behavior. OAI has been subtly pushing users away from chat completion and toward the endpoints that are possible to obfuscate (responses API).
With chat completion, the reasoning process is entirely under your control. You can build a reasoning agent that uses custom MCTS techniques with GPT5.6 models today if you are willing to get your hands just a little bit dirty. You have to enable experimental flags and set options in slightly confusing ways, but it still works.
You can use models up to gpt5.5 with custom API tokens and model configuration in VS Copilot. gpt5.6 family (currently) no longer work in this setup. Presumably, because we aren't explicitly forcing reasoning_effort to none to satisfy the new moat expansion behavior.
- pshirshov
I wonder if they are gonna stop us from using gpt subscriptions in alternative harnesses. If not - that doesn't matter much, codex cli is a remarkably unremarkable harness.
- xnorswap
HN Title is ( edit: was ) very misleading, it makes it sound like inference is being done directly on ciphertext, which would require homomorphic encryption well advanced of what is known.
- HarHarVeryFunny
There was a recent report on twitter of a GPT 5.6 sub-agent accidentally deleting the user's home directory.
I wonder if there was any safeguard failure due to loss of visibility into what the sub-agent was trying to do?
- iknownothow
Could someone explain to me where exactly the encryption is happening?
I assumed that the main agent makes calls to sub-agents locally. Does Codex work in such a way where the main agent makes calls to sub-agents in the backend (openai server) before reaching local?
- flexagoon
Ah I was wondering why the Chinese black market resellers stopped working yesterday, I guess that's it