Codex Now Encrypts What Agents Tell Each Other — and OpenAI Won't Say Why

OpenAI quietly changed something important in June 2026: Codex now encrypts the instructions a main agent passes to its subagents, replacing readable task descriptions with unreadable strings in session history. Since then, developers running multi-agent workflows on GPT-5.6 have lost the ability to see how their agents delegate work — and OpenAI has provided no official explanation for why.

What Happened

The encryption began affecting GPT-5.5 models in early June and now applies mandatorily to the larger GPT-5.6 variants — Sol and Terra. The smallest variant, Luna, remains unencrypted and readable. The practical effect: any system routing tasks from a primary agent to specialized subagents is now opaque in its session history for the models most developers are using for demanding workloads.

The Decoder’s reporting confirms that GitHub bug reports have documented both the change and a more immediate problem: some encrypted subagent handoffs are failing outright because the target subagent cannot decrypt the content. One bug report asks OpenAI to “store a readable copy of the task locally alongside the encrypted version” — a workaround that shouldn’t be necessary if this were a deliberate, well-communicated design decision.

Why It Matters

Two theories circulate in the developer community. The first is IP protection: after reports that Chinese AI startup Zhipu AI apparently distilled capabilities from GPT-5.5’s visible reasoning traces, OpenAI may be encrypting agent coordination to prevent competitors from reverse-engineering its orchestration patterns. The second is privacy alignment — applying to multi-agent coordination the same protections that already exist for certain intermediate states in the API.

Neither theory, if true, would be unreasonable. But the combination of no announcement, no documentation, and broken workflows from encryption failures points to a rollout managed without developer experience as a priority. When your agentic system silently fails because a subagent received an instruction it cannot read, the debugging surface is nearly zero.

This matters beyond the immediate outage risk. Multi-agent agentic systems derive their auditability from being able to trace exactly what each agent was told to do and why. Encrypting that layer doesn’t just add opacity — it removes a core safety mechanism that developers building compliant enterprise workflows depend on. Stack Archive has covered the shift toward agentic engineering patterns as a fundamental change in how software gets built — this is the first time a major model provider has actively restricted that observability.

What This Means for Builders

If your Codex-based workflows use GPT-5.6 Sol or Terra and depend on readable session history for debugging or auditing, the ground has shifted. Luna remains transparent, making it the appropriate choice for any system where task delegation must be inspectable. For production systems where you need Sol or Terra’s capabilities, the interim path is to instrument delegation at the application layer before it reaches Codex — logging what your orchestrator sends rather than relying on Codex session records.

The longer-term question is whether OpenAI treats this as a permanent architecture decision or responds to developer pressure with a documented transparency mode. The GitHub bug reports suggest they are aware of the broken-handoff failures; whether that feedback results in a rollback, a fix, or an explanation remains to be seen.

Source: The Decoder

Content created with AI assistance and reviewed for accuracy.