Tools · · Updated · 2 min read

Codex Encrypts Multi-Agent v2 Prompts: What You Can No Longer Read

Codex PR #26210 turned MultiAgentV2 spawn_agent, send_message and followup_task text into ciphertext. Which models get v2 by default in Codex 0.164.0, what the July plaintext PR changed, and how to keep a readable sub-agent trail.

Takeaway: If Codex runs sub-agents on GPT-6, GPT-6.1 Sol or GPT-5.6 Sol/Terra, you can’t read the task text the parent sends them. Those models default to Multi-Agent V2, and V2 stores the message from spawn_agent, send_message and followup_task only as ciphertext that Codex can’t decrypt locally. Setting features.multi_agent_v2 = false does not opt you out. The model’s catalog entry overrides it. The bug report (#28058) is still open as of October 23, 2026, with no maintainer response. A July PR added a plaintext path, but whether you get it is decided per call, not by you.

What changed, and what has happened since

  • June 5, 2026, PR #26210 (“Encrypt multi-agent v2 message payloads”): Responses encrypts the message argument the model returns, Codex forwards only that ciphertext, and Responses “decrypts it internally for the recipient model.” Locally, InterAgentCommunication.content is empty, and the task text exists only in encrypted_content. Multi-agent v1 was not changed.
  • July 14, PR #33030: list_agents now returns only each agent’s name and status. It no longer shows the last task message, which was one more place you could see what an agent had been told.
  • July 28, PR #35845 (“Support plaintext collaboration tool messages”): when a function call arrives with an empty encrypted_function_args list, Codex delivers spawn_agent / send_message / followup_task as structured plaintext. In the PR’s words, it will “retain encrypted delivery otherwise.” Plaintext arguments are redacted from tool and communication logs, and the metadata is stripped for non-OpenAI providers. One commenter on #28058 reads this as mainly enabling third-party models, with the server still deciding which form each call uses. That is a community reading, not an OpenAI statement.
  • Still being reproduced: users on #28058 report ciphertext-only parent and child histories on Codex desktop with the bundled CLI 0.151.0-alpha.7.2 (September 1) and on CLI 0.154.0 with gpt-5.6-sol (September 14). The thread has 40 comments, the most recent from October 13, and none from a maintainer. The current release is Codex 0.164.0 (October 23).
GitHub PR #26210 'Encrypt multi-agent v2 message payloads', merged by jif-oai, +677/-62 across 34 files, with the Why and What changed sections listed
The merged PR states the intent: "agent instructions stay encrypted between model calls." (Source: openai/codex PR #26210)

Which models use V2 (the encrypted path)

How Codex picks the version, from multi_agent_version_for_model in codex-rs/core/src/config/mod.rs:

  1. features.multi_agent_v2 = true forces V2.
  2. [agents] enabled = false turns sub-agents off entirely.
  3. Otherwise, the model catalog’s multi_agent_version decides.
  4. Only if the catalog doesn’t set one do the feature flags apply, and the collab feature gives you V1.

So multi_agent_v2 = false only matters for models whose catalog entry has no version. Community member Alek2077 reported this precedence on #28058 in July. Here is the catalog bundled with the rust-v0.164.0 tag (codex-rs/models-manager/models.json):

Modelmulti_agent_versionSub-agent task text
gpt-6-astra, gpt-6.1-sol, gpt-6-sol, gpt-6-lunav2Encrypted
gpt-5.6-sol, gpt-5.6-terrav2Encrypted
gpt-daybreak-blue-latest, gpt-daybreak-red-latestv2Encrypted
gpt-5.6-lunav1Readable
gpt-5.5not set (falls back to features)Readable on v1

That’s the catalog shipped in the client. Codex can also load a catalog from OpenAI at runtime, so check your own sessions instead of relying on this table.

How to check your own sessions

  1. Run codex --version. Anything after 0.137.0 has the encryption path (#28058 dates it from builds after 0.137.0).
  2. Open the rollout files under ~/.codex/sessions/ and search for spawn_agent. If the message value is an opaque blob instead of a sentence, you’re on V2 with encryption.
  3. In the child’s history, the NEW_TASK entry shows a readable sender and recipient header followed by encrypted_content, which matches the September 14 report on #28058.
  4. For any audit job, read encrypted_content only to confirm a message existed. content is empty, and nothing on your machine can decrypt it.

Keeping a readable trail

These are listed from least to most effort. None of them is an official OpenAI recommendation.

  • Use a model whose catalog entry is v1 or unset. In the table above, that’s gpt-5.6-luna (v1) or gpt-5.5 (no entry). Sub-agents then use V1, and the task text stays readable in the rollout.
  • Turn sub-agents off with [agents] enabled = false in ~/.codex/config.toml, and run any parallel work as separate codex exec processes whose prompts you write yourself.
  • Override the catalog. model_catalog_json is a config.toml key that points to a JSON model catalog, applied at startup. On #28058, ignatremizov describes forcing the GPT-5.6 family to v1 by keeping a custom catalog with multi_agent_version changed. I haven’t tested this. The file needs the full catalog format (“must contain at least one model”), so start from a copy of models.json for your Codex version and repeat that after every upgrade.
  • Build your own orchestration on the app-server API, or maintain a fork. On #28058, ignatremizov posted an A/B recording in which a fork with the V2 tool switched to plaintext showed the exact spawn_agent task. That fork isn’t upstream.
  • Use a different harness. In Claude Code, sub-agent prompts are readable in the local transcript. Our head-to-head compares the two under autonomy.

Troubleshooting and FAQ

I set features.multi_agent_v2 = false and the messages are still encrypted. That’s expected for any model whose catalog entry says v2. See the version-selection order above.

Can I decrypt encrypted_content on my machine? No. By the PR’s design, Responses encrypts the content and decrypts it for the recipient model. No local key exists.

Does PR #35845 mean it’s fixed? Only partly. Codex can now deliver plaintext when the call carries the empty-encrypted_function_args marker, but encrypted delivery remains the default otherwise, and #28058 is still open. Reports from September show ciphertext on 0.151 and 0.154.

Why can’t I type into a V2 child agent directly? That’s a separate change. On #28058, a user links #33885 / PR #33841: V2 thread-spawn children reject direct input, so corrections have to go through the parent, as another encrypted message.

Is multi-agent v1 affected? No. PR #26210 leaves v1 unchanged.

Why did OpenAI do this? OpenAI hasn’t said. On the Hacker News thread (425 points and 249 comments as of October 23), the leading theory is protecting orchestration prompts from competitors who might train on them, the same logic as hiding raw reasoning traces. That is speculation.

GitHub issue #28058 'Regression: encrypted MultiAgentV2 messages remove readable task audit trail', open, filed against openai/codex
Issue #28058 is still open as of October 23, 2026. (Source: openai/codex Issue #28058)
Hacker News thread 'Codex starts encrypting sub-agent prompts', 405 points, 238 comments, top comment discussing latent-space representation and RL rollouts
The HN discussion as captured in July, at 405 points, split between "inevitable IP protection" and "unacceptable loss of visibility." (Source: Hacker News)

Sources

Source: openai/codex PR #26210