Codex starts encrypting sub-agent prompts

TL;DR Highlight

Codex encrypted MultiAgentV2 messages, so sub-agent task content is no longer readable in local logs

Who Should Read

Developers who need to trace and debug what tasks Codex sub-agents were given via rollout history

Core Mechanics

Encryption hides the task content
- PR #26210 marked the MultiAgentV2 message parameter as encrypted.
- The ciphertext is stored only in encrypted_content, and content is an empty string.
Delegation content vanished from local records
- Rollout history, traces, and parent-side audit/debug views no longer have readable task text.
- You can't tell afterward what task spawn_agent gave the child.
All three tools are affected
- spawn_agent, send_message, and followup_task take only an encrypted message field.
- All three handlers call InterAgentCommunication::new_encrypted().
Logs put ciphertext where content should be
- The structured communication log uses encrypted_content as content when plaintext is absent.
- Rollout-trace also uses the encrypted delivery content as message_content.
The issue asks for a split audit copy, not a revert

Community Reactions

Opinion that the title is misleading
- Comments said it doesn't mean inference runs on ciphertext; ciphertext is passed between agents and plaintext is hidden from the user.
- A comment said inference still runs in plaintext after server-side decryption.
Explanation that prompts already pass through the client
- A comment from someone identifying as the issue author said the TUI switches between subagents, so prompts pass through the client.
- They said the change just saves a copy to disk, and that they use multi_agent_v1 because v2 is unstable and burns tokens.
Experience of a session-inspection tool breaking
- One commenter said their local tool for inspecting coding agent sessions stopped working in some cases.
Visibility concerns and a counterpoint
- A comment cited a Twitter report of a GPT 5.6 sub-agent deleting a home directory and wondered if lost visibility played a role.
- Another said Claude also sends thinking ciphertext back and forth, so it's no different.

How to Apply

Check sub-agent records in your Codex rollout today
- Run a build with MultiAgentV2 enabled, trigger one spawn_agent call, and see whether the task text is readable in the rollout.
- If content is empty and only ciphertext is present, you have an audit gap.
Record delegation content separately
- Instruct the parent agent to write a task summary as normal output before delegating.
- Save that summary to your team's audit log.
Check your log parser's assumptions about content
- If your tool reads the content field, make sure it doesn't break on ciphertext.
- Add a branch that distinguishes encrypted_content from empty content.
Use multi_agent_v1 where auditing matters
- Per a commenter's experience, v1 doesn't have this issue.
- Use v1 for workflows that must trace delegation content.

Try It

copy & run

# Paste into a Claude Code or Codex session (simple audit-log version: the issue's idea turned into a prompt)

Before delegating to any sub-agent, always first print a human-readable plaintext audit record in this format.
- Target agent: {{agent name}}
- One-line task summary: {{task}}
- Constraints being passed: {{constraints}}

Then proceed with the actual delegation.

Next step: after the task finishes, check that this audit record is readable in the rollout history.

Terminology

MultiAgentV2The second version of Codex's feature where a main agent spawns sub-agents and exchanges messages with them. Like a team lead handing memos to teammates.

rolloutThe progress record file of a Codex session. Like a black-box recording you replay to see what happened.

InterAgentCommunicationA struct holding messages passed between agents. It has a plaintext content field and an encrypted_content field.

Audit trailA record that lets you check afterward who asked for what. Like a receipt for after-the-fact tracing.