Codex Encrypts Sub-Agent Prompts

Codex starts encrypting sub-agent prompts is an open GitHub issue in OpenAI Codex, OpenAI's local terminal coding agent. The issue says a MultiAgentV2 change made sub-agent task messages unreadable, which breaks a small but important audit trail for people reviewing agent work. The takeaway is simple: encrypted agent internals can be reasonable, but your workflow still needs a readable handoff before you trust the result. For codex training, this is a useful case study because it shows the difference between running an agent and reviewing what it actually did.

Understand what became unreadable

Codex CLI is a coding agent from OpenAI that runs locally in your terminal and can inspect, edit, and test code in a repository. As of July 2026, the open source openai/codex repository is mainly Rust, Apache-2.0 licensed, and widely watched by developers using terminal-first AI coding workflows.

The GitHub issue is about MultiAgentV2, specifically messages used by spawn_agent, send_message, and followup_task. The reporter says that after the merged change titled Encrypt multi-agent v2 message payloads, the task text passed between the main agent and sub-agents is no longer readable in the local trail.

A sub-agent prompt is the task instruction sent from a parent coding agent to a smaller worker agent. In a normal review, that prompt is useful because it tells you what the worker was asked to do before you judge the output.

The trap is assuming the final diff is the whole story. In a real repo, a sub-agent might be asked to update a migration, audit a dependency path, or rewrite a test helper. If the prompt disappears into ciphertext, the reviewer can still inspect the final patch, but cannot easily compare the assignment to the result.

Separate security from reviewability

The discussion around the issue got noisy because prompt encryption sounds like two different things. One interpretation is privacy: stop sensitive task payloads from sitting around in plain text. Another is control: make it harder for alternative harnesses or resellers to reuse subscription-backed traffic.

The issue itself is narrower than that debate. It is not proof that Codex CLI is closing off every alternative harness. It is a concrete regression report: a readable MultiAgentV2 task audit trail became unreadable after encryption landed.

That distinction matters. Encrypting internal messages may be a valid product or security choice, especially if prompts include private code, secrets, or customer names. But reviewability is not optional in coding work. If the tool hides the task text, the workflow has to preserve intent somewhere else.

A good mental model is commit review. You do not need every keystroke from a developer, but you do need the ticket, the change, and the test evidence. Sub-agent work needs the same minimum receipt.

Keep intent outside the encrypted path

The practical move is to write the task contract somewhere the repository can see before the agent spawns helpers. This does not mean dumping giant prompts into version control. It means keeping a small, durable rule for how agent work must be handed back.

For Codex, the natural place is AGENTS.md. OpenAI's AGENTS.md guide describes repository instructions for Codex; in practice, this is where you put local constraints, verification commands, and handoff rules that should survive across sessions.

Here is a small repo rule that helps when sub-agent prompts are not readable:

# AGENTS.md

## Agent handoff rule

Before delegating work to a sub-agent, write a short task receipt in the session summary:
- target files or directories
- intended change
- commands that must pass
- known non-goals

When returning with a patch, include:
- what changed
- what was not changed
- verification output
- any uncertainty that needs human review

This does not recover the encrypted payload. It gives you a parallel audit artifact that is plain enough to review.

The trap is making AGENTS.md a junk drawer. Keep it short. Put repo-wide rules at the root, and put local rules near the code that needs them, such as services/billing/AGENTS.md for payment logic or packages/ui/AGENTS.md for frontend conventions.

If you want a broader pattern for checking prompt quality across coding tools, the related note on Evaluate Prompt Quality in Claude Code and Codex pairs well with this issue. The shared idea is boring and powerful: preserve intent before you measure output.

Run a verification loop before you trust the patch

Before a fix lands upstream, treat encrypted sub-agent trails as a review constraint. You can still use Codex, but ask it to produce a readable receipt and then verify the repository state yourself.

A small Codex CLI workflow might look like this:

# Start in a clean working tree
git status --short

# Run Codex from the repository root
codex

# After Codex edits files, inspect the patch
git diff --stat
git diff

# Run the checks the agent claimed were relevant
npm test -- --runInBand
npm run lint

# Save the human-readable handoff in the PR body or task note
git status --short

The exact commands should match your repo. A Rust service might use cargo test and cargo clippy; a Python package might use pytest and ruff check ..

This is also the one place where a starter exercise plan is useful. For codex training, give a developer a tiny bug in a test fixture, ask Codex to fix it with a handoff receipt, then compare three things: the requested task, the patch, and the verification output. If any one is missing, the exercise is not done.

The trap is letting the agent choose the definition of done after the fact. Ask for the receipt first, then inspect whether the diff and tests match it.

Add boundaries for MCP-backed work

Many Codex workflows use MCP to reach external systems such as issue trackers, docs, databases, or internal search. Encryption of sub-agent messages does not change the basic safety rule: the more tools an agent can call, the more explicit the boundary needs to be.

A simple MCP boundary note belongs next to the task, not buried in chat history:

## MCP boundary for this task

Allowed:
- read GitHub issue title, body, and linked PRs
- read internal docs returned by search

Not allowed:
- write to GitHub
- query production databases
- post to Slack
- modify secrets or deployment settings

This is not ceremony. It makes the review legible when the agent uses external context and the sub-agent payload itself is opaque.

The trap is treating MCP access as all-or-nothing. Read-only access to a GitHub issue is very different from write access to a production incident channel. Put that difference in plain text before the run.

Before you run this agent

Use this checklist when a Codex task may spawn sub-agents or call tools outside the repo.

This checklist will not make encrypted prompts readable. It reduces the damage by moving the important review facts into artifacts you control.

Common questions

• Did Codex really start encrypting prompts?

  Yes, the issue reports that Codex began encrypting MultiAgentV2 message payloads after a merged change on June 5, 2026. The affected area named in the report is sub-agent message handling for spawn_agent, send_message, and followup_task, not every visible prompt in every Codex CLI session.

• Does this make Codex closed source in practice?

  No, not by itself. The openai/codex repository remains public and Apache-2.0 licensed as of July 2026, but encrypted runtime payloads can still reduce local inspectability. Open source code and readable operational traces are related, but they are not the same thing.

• Is this about stopping alternative Codex harnesses?

  The issue does not prove that. Some developers worry encryption could make third-party harnesses harder to build or debug, but the concrete bug report is about losing a readable task audit trail. Treat broader business motives as speculation unless maintainers document them directly.

• What should codex training cover after this change?

  Codex training should cover receipts, not just prompting. A useful beginner exercise is to run Codex on a small bug, require a task receipt before edits, inspect git diff, and rerun the verification commands. The learner should be able to explain what the agent was asked to do and how the patch proved it.

• Can AGENTS.md solve the encrypted sub-agent prompt problem?

  No, AGENTS.md cannot decrypt or restore hidden MultiAgentV2 payloads. It can give Codex durable instructions to create a readable handoff, follow repo rules, and run known checks. That makes review possible even when one internal message path is no longer human-readable.

Best ways to use this research

• Best for: Codex CLI users who delegate work to sub-agents and still need a plain review trail.
• Best first artifact: Add a short AGENTS.md handoff rule that requires task intent, changed files, verification commands, and uncertainty.
• Best comparison angle: Compare encrypted sub-agent messages against your normal PR review evidence: issue, diff, tests, and reviewer notes.
• Best workflow fit: Use this with the related training topic when you are shaping repeatable Codex CLI workflows around real repositories.

Further reading

• OpenAI Developers — Codex quickstart
• OpenAI Developers — AGENTS.md guide
• Codex starts encrypting sub-agent prompts — source

Next step

Before your next Codex run, add the handoff rule to AGENTS.md and try it on one small bug fix. If the final diff cannot be matched to the receipt and verification output, do not merge it yet.

One methodology lens

One useful way to read this through our methodology is the Plan step: delegate first-pass decomposition and dependency mapping, review the sequencing and assumptions, and keep ownership of scope and priorities. If that split is still fuzzy, the workflow usually is too.