OpenAI has quietly made a significant change to Codex, its flagship AI coding tool: instructions passed between a main agent and its subagents are now encrypted by default, effectively hiding task delegation logic from developers. Since early June, session history logs no longer display a readable task description when a subagent is spawned. Instead, developers see an opaque, unreadable string. This shift raises immediate questions about transparency, debugging, and competitive strategy in an era where coding tools are evolving into autonomous, multi-agent systems.
What Changed in Codex’s Agent Communication
The core change is straightforward. When a parent agent delegates a subtask to a child agent, the instruction payload used to be stored in plain text in the session history. Developers could inspect exactly what the agent told its subagent. Now that payload is encrypted before it is written to the log. The result is that a developer can no longer audit how a task was broken down or what specific instructions were passed to each subagent. A bug report filed on OpenAI’s GitHub repository explicitly calls for a local, readable copy of the task to be stored alongside the encrypted version, but no such change has been implemented.
Model-Specific Deployment of the Encryption
The encryption has been rolled out unevenly across models. For a period, GPT-5.5 would not allow developers to disable the encryption even when using the dedicated toggle in the interface, making visibility completely impossible. OpenAI has since reverted GPT-5.5 to the unencrypted path. The encryption now applies to the larger GPT-5.6 variants, Sol and Terra. Only the smallest GPT-5.6 variant, Luna, continues to use the open, readable path. This model-specific deployment suggests that OpenAI is testing the policy against its most capable systems first.
Reliability Problems Linked to the Encrypted Handoff
Multiple developers report that the encrypted handoff between agents is not functioning reliably. In several documented cases, the subagent fails to execute its task because the encrypted content cannot be decrypted successfully. Crucially, this failure occurs even when the parent and child agents use the same model. The encryption mechanism itself appears to introduce a failure mode that did not exist when instructions were passed in plain text, adding operational risk to every delegated task.
Why OpenAI May Be Encrypting Agent Instructions
OpenAI has not issued an official explanation for the change. The company has only confirmed that the encryption is in place. Two plausible motivations have emerged from community analysis and industry context.
The first is protection against model distillation. Agent-to-agent communication represents high-value training data. The prompts and sub-prompts a model generates to decompose a complex task encode reasoning patterns, decision criteria, and problem-solving strategies that are extremely difficult to extract from standard single-turn interactions. A competitor with access to these handoffs could use them to train a weaker model to approximate the behavior of a stronger one, a technique known as distillation. Suspicion around this motive is not speculative: the open-source model GLM-5.2 from Zhipu AI was recently suspected of having been distilled from GPT-5.5 and Claude Opus 4.8.
The second, simpler explanation is data privacy. OpenAI’s API already encrypts intermediate reasoning states so that they can be forwarded in follow-up API requests without the company storing plaintext on its servers. Extending that same policy to intra-agent communication is a natural, if opaque, extension of that architecture. It is not yet clear whether the change is primarily about competitive intelligence, privacy compliance, or both.
What This Means for Developers
The practical consequence of this change is a loss of visibility into how Codex organizes and executes complex tasks. Developers working with multi-agent workflows can no longer audit the delegation chain, making it harder to debug unexpected outputs or to understand how a tool arrived at a particular result. Until OpenAI clarifies its intent and ideally provides a local decryption key or a toggle that works reliably across all model variants, anyone relying on Codex for complex, multi-step coding tasks should account for the possibility that subagent failures may originate from encrypted handoff errors rather than from the logic of the code itself. Testing and logging strategies now need to assume that internal agent communication is a black box.
