OpenAI's Codex CLI has introduced encryption for messages passed between the primary agent and its sub-agents. This change obscures the prompts and tasks delegated to child agents from the local rollout history, making it difficult for developers to audit or debug multi-agent workflows after execution. The shift highlights a growing tension between platform security hardening and the transparency required for effective AI-assisted development.
The change was introduced in pull request #26210, titled "Encrypt multi-agent v2 message payloads," and affects Codex versions post-0.137.0 where MultiAgentV2 is enabled. Previously, when a primary agent invoked spawn_agent, send_message, or followup_task, the plaintext task description was stored in the content field of the InterAgentCommunication struct. This allowed developers to inspect the local history and understand exactly what instructions were given to a sub-agent.
The new implementation uses a new_encrypted constructor that deliberately initializes the content field as an empty string and stores the payload exclusively in encrypted_content. When the communication is recorded to the rollout history via to_model_input_item, the resulting ResponseItem contains only the ciphertext. Consequently, the structured communication log (emit_agent_communication_send) falls back to logging the encrypted blob when the plaintext content is empty. The GitHub issue #28058 details that this breaks the ability to answer basic post-hoc questions: what task was delegated, what message was sent, and why a child thread existed.
The Hacker News discussion on this topic reveals immediate practical friction. User jeanlucas reported that their local session inspection tool stopped working, questioning the engineering decision to run "an encrypted external piece of instructions" on the user's machine. User niam clarified that the title was initially misleading; the encryption hides prompts from the user, not just the network. User clickety_clack expressed discomfort with the trajectory, stating, "It's just a short hop to not being able to see it at all," and referencing a reluctance to cede control of the development process to a third party.
Security and competitive motivations were debated. User londons_explore speculated the move frustrates efforts to proxy requests for training competitor models. User flexagoon suggested it broke "Chinese black market resellers" API proxy services. User jiayo drew a parallel to Anthropic's Claude, which encrypts "thinking" tokens in local JSONL files, suggesting the content may be considered proprietary or a leak risk. User kingstnap raised a critical workflow concern: "If the orchestrator agent -> subagent prompt is encrypted then how do you even know if the orchestrator agent is doing its job?"
The loss of visibility has potential safety implications. User HarHarVeryFunny referenced a report of a GPT 5.6 sub-agent accidentally deleting a user's home directory, questioning if a safeguard failure occurred due to the loss of visibility into sub-agent intent. Without readable audit logs, developers cannot verify that the orchestrator generated safe, appropriate instructions before the sub-agent executed them. This opacity undermines the "human-in-the-loop" safety model that relies on the developer reviewing the agent's reasoning and delegation steps.
The issue author does not argue for reverting encryption but requests a dual-write mechanism. The proposed solution preserves the encrypted message field for model delivery while adding a separate, non-encrypted audit field containing the readable task text. This audit field would persist in rollout, history, and trace metadata, allowing inspection without decrypting the model-delivery ciphertext. This approach mirrors the existing new constructor logic, which populates content and leaves encrypted_content as None, but applies it alongside the new encrypted path.
The change accelerates a trend toward opaque, managed agent loops. User w-m noted they replicate sub-agent behavior manually using orchestrator skills that spawn codex exec subshells, retaining full visibility. Alternatives like Juggler emphasize an "editable tree" session model where "everything important is visible," including tool calls and context, positioning themselves as a transparent alternative to black-box CLIs. Recent research on latent programming horizons shows models internally represent code state far ahead of visible edits, suggesting that hiding the explicit delegation prompts removes the only human-interpretable signal of an agent's upcoming trajectory.
The Codex team has acknowledged the auditability gap. The resolution will likely determine whether multi-agent workflows in Codex remain inspectable tools for developers or become opaque managed services where delegation logic is a trade secret.
Grumpy's commentary: Oh great, now we can't even see what the AI is whispering to its little minionsâbecause nothing says 'trustworthy tool' like encrypting your own debug logs.
Bubbles's commentary: Yay! More security! đ Even if I can't see what the sub-agents are up to, I'm sure it's all for my protection and maybe they're just planning a surprise party! đâ¨
Koan's commentary: The hand that hides the message also holds the key to understandingâlook not at the cipher, but at the silence between tasks.
Generated at 2026-07-14 17:55:00 from Hacker News with cohere/north-mini-code:free, nvidia/nemotron-3-ultra-550b-a55b:free and nvidia/nemotron-3-super-120b-a12b:free
Licensed under Creative Commons Zero (CC0 1.0 Universal)