You have a multi-agent workflow running on Codex CLI. A parent agent spawns a sub-agent to handle a sensitive task — say, refactoring a database migration script. The sub-agent goes rogue. Or hallucinates. Or touches data it shouldn't.

Before last month, you'd open your local session logs and see exactly what the parent instructed: the task, the context, the constraints. You'd know where to assign blame and how to fix the prompt.

Today, that field reads encrypted_content. Ciphertext. Unreadable without keys only OpenAI holds.

That's not a hypothetical. That's Codex CLI v0.137.0+, since early June 2026.

What Actually Changed

On June 5, OpenAI merged PR #26210 into the Codex repository, authored by engineer jif-oai. The title: "Encrypt multi-agent v2 message payloads." The description explains the technical shift:

"Multi-agent v2 currently routes agent instructions through normal tool arguments and inter-agent context. That means the parent model can emit plaintext task text, Codex can persist it in history/rollouts, and the recipient can receive it as ordinary assistant-message JSON."

"This changes the v2 path so agent instructions stay encrypted between model calls: Responses encrypts the message argument returned by the model, Codex forwards only that ciphertext, and Responses decrypts it internally for the recipient model."

Here's what that means in practice:

Three operations are affected: spawn_agent, send_message, and followup_task — the core primitives of multi-agent delegation.
Local data model changes: Codex now stores InterAgentCommunication.encrypted_content with an empty plaintext content field. The readable instruction is gone from your local disk.
The decryption path is server-internal: When Codex builds the recipient request, it forwards the ciphertext via a new agent_message input item in OpenAI's Responses API. Decryption happens on OpenAI's side, fed directly into the recipient model's context.

Only the initial spawn prompt is encrypted. Subsequent messages between agents remain in plaintext. But that initial delegation — the instruction that defines what a sub-agent is supposed to do — is now opaque.

Which models are affected? This applies to GPT-5.6's Sol and Terra variants running the MultiAgentV2 protocol. Luna appears unaffected. MultiAgentV1 works as before.

Version scope: Codex CLI builds v0.137.0+. You can revert to an earlier build or switch to MultiAgentV1 to get plaintext back — but that means giving up the V2 protocol's runtime orchestration improvements.

The Developer Response

The developer leading the pushback is Ignat Remizov, CTO at Zolvat, who opened GitHub Issue #28058 against the Codex repo. His summary is worth quoting directly:

"The encrypted delivery path is understandable as privacy hardening, but it also removes the human-readable task/message text from local rollout history, trace reduction, and parent-side audit/debug surfaces."

His proposed remedy is sensible: keep the encrypted delivery path for the recipient model, but add a separate, non-encrypted audit field that persists readable task text to local history, telemetry, and trace metadata. It preserves both security and observability — no trade-off required.

The issue has 20+ thumbs-up and remains open. OpenAI has not shipped a fix, and the company has not responded to press inquiries from The Register or InfoWorld.

On Hacker News, the sentiment is predominantly negative. Developers who rely on session traces for debugging and iteration feel blindsided. A common refrain: "I need to have introspection into what the model is doing, and also need to be able to see the plaintext of the input prompt."

The Missing "Why"

Here's what makes this uncomfortable: the PR itself includes a "Why" heading — with nothing written underneath it. The technical description is detailed. The motivation is absent.

OpenAI hasn't given a public explanation. The speculation, drawn from community analysis and press coverage, clusters around three theories:

1. Protecting the orchestration moat. Multi-agent orchestration — when to spawn, what context to include, how to decompose tasks — is a hard problem that OpenAI has invested heavily in, including RL training on agent-to-agent interactions. The resulting prompts may look nothing like human-readable instructions. They're proprietary IP, and encryption makes them unreadable to competitors.

2. Preventing distillation and reseller abuse. Multiple HN commenters noted that Chinese black-market API resellers — who pool subscriptions and extract prompt data — stopped working the day this change shipped. If your business model is copying prompt patterns, ciphertext is a wall you can't climb.

3. Consistency with encrypted reasoning traces. Both OpenAI and Anthropic already encrypt chain-of-thought tokens. Agent delegation prompts are a natural extension of the same logic: if reasoning traces are sensitive enough to hide, the instructions that drive agent behavior probably are too.

None of these theories are mutually exclusive. All of them are plausible. But none of them are confirmed — and that silence is itself a signal.

The Bigger Pattern

This isn't an isolated incident. It's the latest turn in a trend that's been building all year:

Anthropic encrypts Claude's thinking traces. Users cannot inspect them.
OpenAI encrypts reasoning tokens in its o-series models.
Codex now encrypts agent-to-agent instructions.

The trajectory is clear: the internal reasoning of AI systems is becoming a black box, even to the developers building on top of them.

For the agent ecosystem, this raises a question that doesn't have a comfortable answer yet: can you build trustworthy multi-agent systems on top of infrastructure you can't observe?

Analyst Pareekh Jain of Pareekh Consulting put it bluntly to InfoWorld:

"If a sub-agent does something bad, like touching private data, the company needs to show what it was told to do. If that record doesn't exist, it is a serious problem for trust and legal accountability."

That's not a theoretical concern. Regulated industries — banking, healthcare, insurance — won't deploy systems they can't audit. If the encryption stands, it creates a compliance ceiling for the entire multi-agent paradigm before it's even hit production at scale.

What This Means for Developers

If you're building with Codex today, here's your real-world picture:

Debugging is harder. When a sub-agent fails, you can see that it was spawned, but not what it was told. Tool telemetry (OpenAI's OpenTelemetry export) captures actions and events, but not the raw task message that triggered them.
Root cause analysis is blind. Teams can't distinguish between "the sub-agent misunderstood the task" and "the task itself was wrong" — the two most common failure modes in agentic systems.
Lock-in deepens. Only OpenAI holds the decryption keys. If you want to switch providers or run your own orchestration layer, you lose access to your own agent history.
Workarounds exist, but they're not great. You can skip the encrypted path by using MultiAgentV1, by instructing the model to use custom tool calls instead of the built-in spawn_agent, or by switching to Luna. Each comes with trade-offs: losing V2's orchestration improvements, increased complexity, or reduced model capability.

The Crossroads

Agent observability isn't a nice-to-have. It's a prerequisite for building systems you can trust, debug, and put into production. The encryption of inter-agent instructions trades developer visibility for competitive protection, and it does so without any opt-in, documentation, or public rationale.

The community's proposed fix is straightforward: encrypted_content for delivery, plaintext audit field for humans. It costs OpenAI nothing in terms of IP protection. It restores everything developers lost.

Whether OpenAI adopts it — or whether the ecosystem begins to vote with its feet toward more transparent platforms — will tell us a lot about where the agent space is headed.

Right now, the black box is getting darker. The question is whether we're okay with that.