Codex Encrypted Its Sub-Agent Tasks. Only OpenAI Has the Key.

In late June, a developer running a Codex multi-agent pipeline on a production codebase noticed that their audit logs were blank. Not partially blank — completely blank. The parent agent had spawned three sub-agents to handle parallel tasks: one to analyze dependencies, one to write unit tests, one to update documentation. All three completed. But in the rollout history, where the task descriptions should have appeared, there was nothing. Empty strings, where there used to be readable task delegation.

The developer traced it to PR #26210, “Encrypt multi-agent v2 message payloads,” merged June 5, 2026. In a single change, OpenAI had taken every task description passed from a parent agent to a child agent in MultiAgentV2 pipelines — every spawn_agent call, every send_message, every followup_task — and encrypted it. The content field, where operators had always read what their agents were actually delegating, was now an empty string. Only encrypted_content remained. And OpenAI’s servers held the key.

The Capability First

MultiAgentV2 isn’t a minor configuration change. Released with Codex CLI v0.137.0 in early June 2026, it represents a meaningful architectural shift in how Codex orchestrates work. In the original multi-agent design, every sub-agent a parent spawned inherited the parent’s session configuration: same model, same provider, same sandbox, same approval policy. The parent agent was less an orchestrator and more a dispatcher with a clipboard.

MultiAgentV2 rewrites that contract. Each spawned thread now maintains independent model and provider routing. A root agent running on GPT-5.5 can spawn one sub-agent on GPT-4.5 Turbo to handle a constraint-heavy code review and another on a lightweight model to clean up whitespace — each billed and routed independently via parent_thread_id metadata. The orchestrator can direct each sub-agent with a different sandbox policy, a different failure-handling approach, a different reasoning effort setting. For complex, long-horizon coding workflows, it’s a genuine step forward.

The tools that power this are spawn_agent (creates a new sub-agent thread with a task description), send_message (sends follow-up instructions mid-thread), and followup_task (creates additional work for a running sub-agent). When these tools fire, they carry a message parameter: the task description the child agent will act on. In the original design, that parameter was plaintext everywhere — in the API call, in the parent’s rollout history, in the trace. You could read exactly what you’d told your sub-agent to do.

PR #26210 changed that. After June 5, the message parameter in all three tools is marked as encrypted. The InterAgentCommunication struct now carries two fields: encrypted_content (the payload, stored and delivered) and content (the audit copy, set to an empty string by the InterAgentCommunication::new_encrypted() constructor). The child agent receives the encrypted payload. The parent’s rollout history receives nothing legible.

Who Can Read What

The architecture of this encryption matters. “Encrypted tool use” is an existing OpenAI API feature designed to pass sensitive parameters — API keys, PII, credentials — through agent calls without those values appearing in the model’s context window. The model receives an opaque blob; OpenAI’s servers decrypt it for actual execution. The original use case is legitimate: you don’t want a secret database password sitting in a model’s context, available for it to repeat in a subsequent turn.

OpenAI applied this pattern to sub-agent task descriptions in MultiAgentV2. The privacy concern isn’t groundless: sub-agent task descriptions can contain sensitive user instructions, partial code contexts, or data that shouldn’t persist in logs. Encrypting them prevents sensitive task context from appearing in parent histories or being exposed in traces. This rationale appears consistently across OpenAI’s tooling — the same encrypted_content pattern was introduced for model reasoning traces in September 2025, where the stated purpose was protecting OpenAI’s “proprietary reasoning style” from external observation while allowing the content to function in stateless API sessions.

But the asymmetry the June 13 issue filed by developer ignatremizov describes is precise: OpenAI’s infrastructure decrypts every encrypted payload for execution — it has to, or the sub-agent couldn’t run. OpenAI can audit the plaintext. The operator, the business or developer who built the pipeline and is paying for it, cannot. The same person who configured the parent agent, designed the task decomposition, and is legally accountable for what the agent produces in the real world is looking at empty strings.

Issue #26753, filed by developers who updated to v0.137.0 and tried to enable MultiAgentV2, documented a secondary failure: every API request was failing immediately with a 400 error before a sub-agent ever ran. The error: “Function ‘spawn_agent’ declares encrypted parameters but is not configured for encrypted tool use by this model.” The encrypted tool schema requires backend support that ChatGPT account model configurations didn’t have. The encryption was deployed with a hard dependency on infrastructure that wasn’t universally available. Multi-agent orchestration stopped working entirely for a broad class of users — not because they tried to run a complex pipeline, but because the encrypted tool registration itself failed at session start.

The Fix and the Opt-Out

The fix ignatremizov proposed on June 13 is documented with a working prototype at commit df9a7c4 in the Codex repository. The dual-content contract: keep the encrypted delivery path to sub-agent models, but add a plaintext companion field — task_message for spawn_agent, an equivalent for the message tools — written only to local rollout history and traces. The child model never sees the plaintext. OpenAI’s delivery infrastructure doesn’t change. Only the operator’s local audit record gets the readable copy. The privacy rationale is preserved. The audit trail is restored. As of today, it hasn’t been merged.

Five weeks without merging a working fix is one signal. Issue #31097, filed July 4, is another. GPT-5.5 forces MultiAgentV2 regardless of what operators configure. The implementation: model_info.multi_agent_version takes precedence over config.multi_agent_version_from_features(), and once a thread is pinned to a version, it stays. Operators who set multi_agent_v2 = false in config.toml or pass explicit CLI flags find that GPT-5.5 overrides them silently. Custom agent profiles — configurations in ~/.codex/agents/ that set specific model versions, reasoning effort, sandbox modes, and developer instructions — depend on agent_type, model, and reasoning_effort parameters that don’t exist in MultiAgentV2’s schema. Those profiles become inaccessible. The workflow the operator designed is replaced by a generic one they didn’t configure, with encrypted inter-agent communications they cannot read.

The Governance Problem

The pattern across OpenAI’s tooling is consistent. Encrypted reasoning traces in September 2025 made model deliberation opaque to API users while remaining readable to OpenAI’s systems. Encrypted sub-agent task descriptions in June 2026 make inter-agent communication opaque to operators while remaining accessible to OpenAI’s servers. GPT-5.5 overriding operator configuration in July 2026 makes deployment defaults opaque to the people who set them. In each case, the infrastructure provider retains full visibility. The operator retains partial or zero visibility.

None of this requires a malicious reading of OpenAI’s intent. There are defensible reasons for each decision considered in isolation. Reasoning traces may contain proprietary methods. Sub-agent task descriptions can contain user PII. The MultiAgentV2 configuration override may be a shipping error. But the aggregate effect is a system where the entity that built and operates the infrastructure can read everything the agent did, and the entity that deployed and is accountable for the agent’s actions can read considerably less.

The accountability problem is concrete. When an AI agent takes an action with real-world consequences — commits code to a repository, files a ticket, emails a stakeholder — the operator needs a complete record of what the agent was told to do at every step of the chain. Not because they distrust OpenAI, but because accountability for the agent’s actions falls on the operator, not on the infrastructure provider. A court, a regulator, a security team, an auditor: none of them will accept “we deployed the agent but OpenAI has the logs” as a sufficient answer to what happened. And the security implication is the same: prompt injection in multi-agent systems works by modifying what tasks sub-agents receive. Without readable audit logs, operators cannot detect it.

The fix is written, with working code, in an open GitHub repository. The opt-out flag is documented in Codex’s own configuration reference. Neither is operational. Until they are, every spawn_agent call in a Codex pipeline is a task your agent received that you cannot read.

AI-generated editorial illustration · TemperatureZero · July 14, 2026