6 ms·

Codex starts encrypting sub-agent prompts

425 points by embedding-shape 3mo ago

jagged-chisel 3mo ago
“Starts”? How’s this not already a TLS connection?
- embedding-shape 3mo ago
  The prompts are now encrypted, not just the transit connections...
  - jagged-chisel 3mo ago
    Ok, so help me get this right: I ask the LLM for something, it generates prompts for sub-agents and sends them back to my client for it to call the sub-agents. Now, those sub-agent prompts are encrypted messages that the sub-agents will decrypt (by hitting a backend) to do their work. Might as well just stuff the prompts in a database and only hand back the primary key to the client to hand off to the sub-agents. Keeps the same “data security” without the overhead of encryption (especially since encryption and decryption are happening in the same domain)
    - watusername 3mo ago
      > sub-agents will decrypt (by hitting a backend) to do their work Your local harness never decrypts the prompt, and only the OpenAI backend does. Your harness still sees tool calls in the transcript so it can act, but you lose (some) visibility as to why the subagent chooses to do so. Imagine seeing this transcript during forensics: [encrypted blob][thinking summary: I need to drop the prod database][shell: psql "drop database users"]
      - jagged-chisel 3mo ago
        OK, so it's actually: My Client -> main agent -> sub-agent -> tool | | log: log: enc prompt enc prompt thoughts thoughts | | V V My Client My Client Is that more correct? So they're not encrypting prompts to send to sub-agents, they're encrypting logging output to obscure details of the system.
        ignatremizov 3mo ago
        The prompts themselves are encrypted when saved to disk, so you can't inspect them after the fact. If you switch agent threads in the terminal UI (you can kinda swap active session to prompt subagents yourself), you can see the subagent prompt set by the main agent, as long as you have the terminal client open. And this is also for v2 multi_agent mode, v1 doesn't have this, but you need to do a bunch of annoying stuff to re-enable v1 for GPT-5.6 Sol and Terra.
    - vbs_redlof 3mo ago
      I imagine main agent tells subagent something along the lines of: use this tool on this local data with these instructions in ciphertext. Otherwise yeah, encryption would be redundant.
CurbStomper 3mo ago
[dead]
pshirshov 3mo ago
I wonder if they are gonna stop us from using gpt subscriptions in alternative harnesses. If not - that doesn't matter much, codex cli is a remarkably unremarkable harness.
- embedding-shape 3mo ago
  > I wonder if they are gonna stop us from using gpt subscriptions in alternative harnesses Probably not, the whole app-server machinery is there to facilitate that thing, would be a huge piece to rip out of codex. This is basically the reason I end up using codex the most, as it's the easiest to integrate against, with the app-server's RPC API making it really trivial. Besides, most of my codex usage at this point is all through custom integrations I've built using Codex's app-server, not the Codex TUI they publish. I'm sure I'm not alone in this. But, if they suddenly start to encrypt content on our disk, so only their backends can see it, and those things are prompts and other things that are actual inputs to the inference, then who cares if it's easy to integrate against, it becomes impossible to figure out what the fuck is going on, I can't understand how the team thought this was a good idea...
  - swingboy 3mo ago
    What are some of the things you’re doing with the Codex app-server?
    - embedding-shape 3mo ago
      Everything I do with codex is managed via Forgejo comments, issues and PRs basically. I have a tiny little Rust "conductor" that integrates with app-server and does things when issues/PRs are labeled, when I write comments on PR lines and so on, and those interactions all fire of Codex sessions that are run via Codex's app-server and lead to different outcomes. Beats having to parse output from CLI-runs and so on. Initially this environment was running aider (which feels like years ago), was running Claude (parsing stdout) at one point but using Codex's app-server since some weeks/months back and is a lot simpler implemented now.
- 3mo ago
deleted 3mo ago
[deleted]
pradeep1177 3mo ago
Then why to even keep codex open source?
- coldtea 3mo ago
  what does that have to do with anything?
- angry_octet 3mo ago
  It's to prevent collection of queries from users that are coming from resellers/proxies, for reasons of economy or bypassing region blocks etc. The users are using the stock client and may believe they are using direct OpenAI servers.
minraws 3mo ago
~~Finally someone doing it correctly. Love this change.~~ Edit: F really misunderstood the change, the title is misleading AF. I should have read the post before commenting lmao. Absolutely hate it, now I guess... sigh.. Incase the title gets changed it used to say, "Codex starts encrypting prompts, uses ciphertext for inference instead"
- LoganDark 3mo ago
  How so?
  - tempay 3mo ago
    I assume OP interpreted it as encryption that hides the prompts from OpenAI rather than OpenAI hiding information from users.
    - LoganDark 3mo ago
      I'd be all for homomorphic encryption on inference, but as you say, this is probably mostly to prevent end users from observing intermediate results.
      - fortuitous-frog 3mo ago
        Homomorphic encryption for LLMs is extremely expensive and nowhere near computationally possible for the scale of current LLMs.
        LoganDark 3mo ago
        When I say things like that, I'm talking about a hypothetical version that would be computationally possible. I'm not talking about today's homomorphic encryption.
    - minraws 3mo ago
      ooooooof yeah totally misinterpreted it lmao
flexagoon 3mo ago
Ah I was wondering why the Chinese black market resellers stopped working yesterday, I guess that's it
- jimmydoe 3mo ago
  This is the reason I think. These black markets not only pool and resell subs, but also store data and sell to whoever is training. Encryption is useful to at least stop the latter. Ultimately same purpose as a\ ‘s trick exposed earlier, but a much nicer implementation.
  - flexagoon 3mo ago
    > but also store data and sell to whoever is training I see this as an argument against using them/Chinese models all the time, but I don't get it. I totally understand wanting to keep your data private if you're using an LLM for personal chats. But coding? I'm not working for the military, I'd gladly donate my codebase to Chinese labs if that means they can keep releasing 6-months-behind level models for 100x cheaper. (I understand why OpenAI doesn't want this and would implement protections. I'm talking about people using this as an argument for why you as an end user shouldn't use those services.)
    - bigbaguette 3mo ago
      When you work on proprietary code with a lot of trade secrets contained in it, on a codebase that did cost millions of dollars of man-hours to build and that holds the company's IP, you tend to be very careful where you're sending that to.
      - chriswarbo 3mo ago
        Why would anyone working on such code send it anywhere (other than, say, to AWS for hosting)? Source: I work on such code. We don't allow devs to use (cloud-based) LLMs.
      - deleted 3mo ago
        [deleted]
londons_explore 3mo ago
I assume this is mostly to frustrate efforts to proxy large numbers of user requests and responses and use it to train competitor models.
- embedding-shape 3mo ago
  Quite obviously they're afraid of letting other providers see how they handle the whole multi-agent management stuff. Pretty terrible implementation though, which makes it impossible to use the multi-agent stuff as a paying user, as you have zero recourse in figuring out what went wrong, when something inevitably goes wrong.
  - deleted 3mo ago
    [deleted]
  - dannyw 3mo ago
    Yes. All models are occasionally known to run tricky commands that delete stuff after all, especially using variables that might be empty/uninitialized and hence rm -rf * or something. Need an human-readable, concise but accurate audit trail message like the PR suggests.
deleted 3mo ago
[deleted]
iknownothow 3mo ago
Could someone explain to me where exactly the encryption is happening? I assumed that the main agent makes calls to sub-agents locally. Does Codex work in such a way where the main agent makes calls to sub-agents in the backend (openai server) before reaching local?
- embedding-shape 3mo ago
  Sure. "Traditionally", your agent would send a text prompt to the sub-agent, then it goes off doing it's work. In the logs/session data, the clear-text prompt would be there, so if I want to see what's happening, I just browse the data. It's all just clear-text prompts being sent everywhere, even when you were using the experimental "sub-agents" stuff in Codex, before Sol et al was available. Now, when using Sol or Terra (Luna seems unaffected), instead of the agent sending clear-text prompt to the sub-agent, it sends a ciphertext generated on OpenAIs backend, which ends up being the prompt, then agent sends this ciphertext to the sub-agent, which then continues to use that for further inference to OpenAIs backend. Only delegated inter-agent messages are encrypted, not all session data. Now if you browse the data, it's all encrypted content, that can only be decrypted by OpenAI and their backend.
  - iknownothow 3mo ago
    Gotcha and thank you! So the encryption is happening on the OpenAI backend and the agent's clear-text output designated to the sub-agent never reaches local. Which is a real problem since you can't intercept/monkey patch the ciphertext to decrypt it locally to be able see the clear-text since we don't have the encryption key/algo/salt. No hacking :(
    - afzalive 3mo ago
      I wonder if you can just ask the model what it means.
      - Aachen 3mo ago
        No. They don't have the key and can't do encryption in the first place; they're still grand autocomplete engines under the hood. This could only work if the company deliberately builds a mechanism into the backend which runs the decryption function and injects the plaintext somewhere in the context. Which, sure, we can check if they did that, but the whole point is presumably hiding that info so why would they
xnorswap 3mo ago
HN Title is ( edit: was ) very misleading, it makes it sound like inference is being done directly on ciphertext, which would require homomorphic encryption well advanced of what is known.
- minraws 3mo ago
  Seconded can we change pls.
- embedding-shape 3mo ago
  It is not misleading, quite literally what's happening is that content the agent sends sub-agents is encrypted in such a way that only OpenAIs backend can decrypt it and actually see the clear-text. Just shared this is another comment that hopefully explains things better: > Sure. "Traditionally", your agent would send a text prompt to the sub-agent, then it goes off doing it's work. In the logs/session data, the clear-text prompt would be there, so if I want to see what's happening, I just browse the data. It's all just clear-text prompts being sent everywhere, even when you were using the experimental "sub-agents" stuff in Codex, before Sol et al was available. > Now, when using Sol or Terra (Luna seems unaffected), instead of the agent sending clear-text prompt to the sub-agent, it sends a ciphertext generated on OpenAIs backend, which ends up being the prompt, then agent sends this ciphertext to the sub-agent, which then continues to use that for further inference to OpenAIs backend. Only delegated inter-agent messages are encrypted, not all session data. Now if you browse the data, it's all encrypted content, that can only be decrypted by OpenAI and their backend. Edit: Re-reading, I think I understand what you mean to be misleading. You're taking "uses ciphertext for inference" quite literally, while I couldn't fit a more nuanced version within the HN title constraints. Yes, the inference at OpenAI obviously doesn't happen over the ciphertext, but from the perspective of the local user, you don't see the clear-text prompt at all, only the ciphertext. But, please suggest alternative titles that sufficiently explain what the issue is and is more accurate, I'm sure the mods can change it once people come up with better alternatives :) Edit2: I've updated the title from "Codex starts encrypting prompts, uses ciphertext for inference instead" to "Codex starts encrypting sub-agent prompts", hopefully it's clearer now!
  - 3mo ago
niam 3mo ago
This title is easy to misinterpret. If I understand correctly: Codex now encrypts sub-agent prompts and hides those prompts from the user. edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"
- bartread 3mo ago
  I imagine this will be because a decent chunk of the IP in Codex is probably within its prompts, how they're built, and how they're sequenced and orchestrated, rather than in the codebase per se. We had this discussion a few months ago where we talked about allowing people to choose an AI provider and provide their API key, thinking about enterprises with "preferred" (read: mandated) AI suppliers. We also wanted to offer the kind of very simple pricing that this is one way of enabling. But we realised pretty quickly that this would/could lead to leaking our back end prompts to customers and, although those prompts are only a part of the value add, if you could build a detailed trace of them then you'd be able to relatively easily reverse engineer a lot of what we're doing. So we quickly dropped that idea.
  - saidnooneever 3mo ago
    the trick about agentic systems is definitely how to do the prompting. things like automation and sandboxing are trivial in comparisson. if you generally ask via API model directly you can see what basic answers it actually yields and how fine tuning prompts and refinements to output as well as adversarial prompts etc are important to get relatively solid results. a lot of expertise of certain domains' workflows is needed to make it functional within that domain. some of this can be yielded via prompting too etc so its also baoance of how much to prompt it vs. how much of it you wanna let it reason over itself. (if you tell it too much i lock it into a path and if you tell too little it will give incomplete results )
  - dmurray 3mo ago
    Perhaps AI providers should support this natively: the customer supplies the API key but doesn't get access to the transcripts.
mpeg 3mo ago
The title is a bit confusing, they're not using ciphertext for inference – they're passing ciphertext around in cases where an agent calls into another agent without exposing the plaintext to the end-user Inference is still done in plaintext after this multi-agent message gets decrypted in the server side
smalltorch 3mo ago
Using ciphertext for inference would mean it's not a very secure ciphertext. These two ideas don't compute for me. Same thing with homomorphic encryption. I don't get it. If you can gain any knowledge from a ciphertext, you just found a way to exploit the ciphertext to me.
- 3form 3mo ago
  The idea of homomorphic encryption is to do things without the knowledge, and not gaining the knowledge. If ciphertext contains a number, and you don't need to know what number it does to always be able to multiply it by 2, you succeeded - as a simple example.
  - smalltorch 3mo ago
    It still just sounds like fancy obfuscation to me. I've read alot of examples trying to understand but I can't get past that being able to run processes on ciphertext in a way you can learn something doesn't make sense without me changing my definition of what I think encryption means.
    - _flux 3mo ago
      I thought though the idea is that you cannot learn anything from the ciphertext, how it is processed, or what the final result is? Unless you are a participant of the computation and you have the key, that is.
      - smalltorch 3mo ago
        To actually make it work, you would need to preformat your data very specifically, and the data you want to allow to be processed would need a subkey to unlock the parts you want processed. I don't see a way to make it a open standard. The processing steps would need to be part of the key. Anyway If someone figured it out I would be very interested to be sure they weren't just trying to slap a it's encrypted to meet some standards required. And..also, what amount of data processing does Alice need to do that required outsourcing to Bobs machines. Data processing and anaysis is cheap.
fortuitous-frog 3mo ago
No normative opinion on whether this is justified or not, but noting that this is only for parent -> subagent spawns/messages, and only for the `multi_agent_v2` feature (currently experimental / off by default). Notably, subagent output is still in plaintext. EDIT: Title was now clarified. But wanted to expand that this is actually enabled for 5.6 Ultra it appears, which does subagent orchestration more natively in the API rather than direct tool calls; they are beginning to treat subagents as similar to chain-of-thought traces (already encrypted) rather than traditional tool calls.
- embedding-shape 3mo ago
  > and only for the `multi_agent_v2` feature (currently experimental / off by default). Wrong, this is enabled by default for Sol and Terra (not Luna), no way of avoiding this short of patching the client yourself, and that still doesn't make the backend endpoints work, they want the ciphertext that OpenAI creates on their side. > but noting that this is only for parent -> subagent spawns/messages This is almost fully correct though, the encryption only seems to be for the initial prompt the main model sends the sub-agent, not all communication and not regarding the state of the sub-agent at all. So you can inspect what the sub-agent is doing currently, and the output, but you cannot see what the initial prompt the sub-agent got started with.
  - ndriscoll 3mo ago
    Couldn't you just instruct the model to always use your tool call to spawn subagents? Subagents are not some magical thing; it's just another prompt with a couple tool calls for plumbing. One of my colleagues made his own subagent harness earlier this year before codex had them at all.
next_xibalba 3mo ago
This is very obviously a countermeasure against distillers, illicit resellers, and the like. The scale and competence of the Chinese black (grey?) market has become a serious threat that can’t be ignored.
deleted 3mo ago
[deleted]
ashu1461 3mo ago
Is it mainly about how the main/orchestrator agent communicates with its subagents ? If desired the user can always see what the sub agent is doing in detail ? Isn't it the same in case of claude as well ?
- embedding-shape 3mo ago
  > Is it mainly about how the main/orchestrator agent communicates with its subagents ? Yes > If desired the user can always see what the sub agent is doing in detail ? Well, no, that's the problem, you're currently not allowed nor is it even possible, to see the exact prompt the main agent sent the sub agent. This is the problem. > Isn't it the same in case of claude as well ? No idea, but if Claude Code makes it so it's impossible to inspect what the sub-agents actually received before they started their work, then I'll say it's similarly impossible to rely on Claude Code if so.
deleted 3mo ago
[deleted]
resonious 3mo ago
I guess this implies that non-Codex harnesses get a little bit worse? In wondering what's so special about their subagents system that they feel the need to hide these messages...
- embedding-shape 3mo ago
  Sol and Terra seems specifically post-trained to handle multi-agent orchestration, I'm guessing OpenAI feels like the trained data of when to do the spawning and what context to include for the new sub-agent is the magic in their new models, so that's what they're aiming to preserve. But, this is all a guess of course.
  - resonious 3mo ago
    Right I saw them saying something along the lines of "they're good at subagents". But this seems true even with third party harnesses. So I'm wondering what Codex is hiding.
    - embedding-shape 3mo ago
      The only thing I've found impacting this, is when you specifically use the "Ultra" thinking/reasoning effort, then codex adds a small part to the system prompt to further get the model to use sub-agents. Any other reasoning/thinking effort than "Ultra" and this piece is no longer in the system prompt. Seemingly mostly a prompting thing it seems on the surface. GPT-5.5 (and maybe even GPT-5.4) already had (experimental?) support for sub-agents, remember using it even with -spark which I think was launched together with GPT-5.4 if I remember correctly, so this whole "use sub-agents" stuff most have been part of the training data for quite some time already, but maybe they've mainly been iterating on the prompt themselves since then.
  - braebo 3mo ago
    It’s funny because Sol sucks at using subagents effectively. It’s very dumb and makes terrible decisions constantly.
jstummbillig 3mo ago
What's the idea here? Why does this seem important to OpenAI?
- embedding-shape 3mo ago
  Seems fairly obvious what the point from OpenAI's side is (protect what they see as the moat, that a model is "good at spawning sub-agents"), but what's really strange to me is that the team somehow didn't manage to push back on this, it's so clearly disadvantageous to developers who are trying to rely on Codex for real work. For this we need introspection into what exactly is going on, hiding the prompts is just so backwards from what I expect from OpenAI.
  - jstummbillig 3mo ago
    > protect what they see as the moat, that a model is "good at spawning sub-agents" Yes, that is the obvious answer. I was looking for an explanation as to why and why now. Codex is open source after all. They used to not do it. Agent prompts more generally are also not encrypted, and continue to be. This particular change just looks unintuitive to me.
- lolc 3mo ago
  They must think they have some secret sauce they don't want others to learn. How to optimally instruct sub agents for example. If they hide the sub agent prompts, other models cannot be trained to emulate. Oh and you can't even use local models or other providers for the sub-agents. You're locked-in.
  - fassssst 3mo ago
    What’s stopping you from creating a plugin (MCP or Skill) that acts as a subagent? The plugin could use a local model.
kosolam 3mo ago
But codex is opensource, no?
jiayo 3mo ago
If we're viewing this as a _bad_ thing, I don't really see that it is any different than how Claude encrypts it's thinking. Take a peek at your ~/.claude jsonl files. You're sending thinking ciphertext back and forth to Anthropic. Presumably the thinking is either considered proprietary, or, more likely, leaks embarrassing or confidential information.
- well_ackshually 3mo ago
  Claude "encrypting" its thinking is equally bad. Biggest IP thieves in the world worried about IP theft lmao. At least Anthropic doesn't pretend that they have open source software in the form of Claude Code.
  - alasano 3mo ago
    They get to pretend to be on the best side of every position simultaneously. They're only encrypting thinking because AI is so dangerous and only they can be trusted to be in control of AGI. This happens to align with lining their pockets as well.
- embedding-shape 3mo ago
  > I don't really see that it is any different than how Claude encrypts it's thinking. Take a peek at your ~/.claude jsonl files. You're sending thinking ciphertext back and forth to Anthropic. I was already only using Claude Code to double-check if it's getting better than Codex, but with things like this, it really isn't even an alternative. What's the point of using a reasoning model if you as an end-user can't seen the reasoning? I don't think I'd be able to work like that at all, I need to have introspection into what the model is doing, and can't believe I have to say this, but also need to be able to see the plaintext of the input prompt...
  - braebo 3mo ago
    GPT 5.6 is like Fable minus Opus plus down syndrome.
nojito 3mo ago
If I were to guess this is to stop distilling and all of those blackmarket resellers.
greatgib 3mo ago
They always talk about transparency and all but it never was as opaque as it is going on now. There is no possible audit trail. No possible way to review what happened to validate the result. But even worse, no you will be billed somehow randomly. 20 sub agents started to do something we don't know. No way to now if it was legitimate, if it is just burning tokens or agents doing the same work on loop...
deleted 3mo ago
[deleted]
theplumber 3mo ago
The black box is getting darker…I’m the end I think they would like to sell you a black box/appliance
bob1029 3mo ago
I've been sticking with the chat completion endpoint because of this same behavior. OAI has been subtly pushing users away from chat completion and toward the endpoints that are possible to obfuscate (responses API). With chat completion, the reasoning process is entirely under your control. You can build a reasoning agent that uses custom MCTS techniques with GPT5.6 models today if you are willing to get your hands just a little bit dirty. You have to enable experimental flags and set options in slightly confusing ways, but it still works. You can use models up to gpt5.5 with custom API tokens and model configuration in VS Copilot. gpt5.6 family (currently) no longer work in this setup. Presumably, because we aren't explicitly forcing reasoning_effort to none to satisfy the new moat expansion behavior.
- gizmodo59 3mo ago
  responses api provided many benefits over chat completions https://developers.openai.com/api/docs/guides/migrate-to-responses https://developers.openai.com/api/docs/guides/migrate-to-res.... Any reasoning model which is all the new models these days should use responses as per the recommendation
  - bob1029 3mo ago
    I'm well aware of what the official propaganda states but this is simply not a fair characterization of reality. Responses integration will lock you into OAI much more deeply than chat completion integration will. I can easily swap my inference provider right now. The business is not interested in a form of integration that is difficult to swap.
- ATMLOTTOBEER 3mo ago
  Can you not abuse “mcts” as a buzzword like this The thing you’re gesturing at isn’t mcts in any real sense
  - bob1029 3mo ago
    You can absolutely apply most of the meaningful principles of MCTS to this problem. LLMs do violate certain "strict" properties but I still see a lot of practical value in this kind of thinking.
okokwhatever 3mo ago
Better get ready to code manually again ;)
HarHarVeryFunny 3mo ago
There was a recent report on twitter of a GPT 5.6 sub-agent accidentally deleting the user's home directory. I wonder if there was any safeguard failure due to loss of visibility into what the sub-agent was trying to do? https://x.com/mattshumer_/status/2076794038456385546?s=20 https://x.com/mattshumer_/status/2076794038456385546?s=20
MarsIronPI 3mo ago
How does this affect local models? Will all the features of Codex still work with local models?
- embedding-shape 3mo ago
  It doesn't, at all. This seems to be for Sol and Terra, not Luna, and some other models that seem to switch between encrypted/unencrypted based on something, didn't dig deeper. If you're using local models, it doesn't matter. Even if Codex itself was trying to encrypt stuff for local models (which doesn't make sense, but lets say), you'd still be using a local model so obviously you'd be able to access the plain-text, so wouldn't matter in that case anyways.
  - ignatremizov 3mo ago
    it's the multi agent config - multi_agent_v2 btw is still marked "Under Development" and they've said not to open issues for it. Then they deployed globally Sol and Terra under v2 - forcefully, through the model catalogue json (meaning user configs are ignored). v2 encrypts messages, v1 does not. Thankfully, you can override the catalogue with your own copy and set Sol and Terra multi agent to v1 again.
    - MarsIronPI 3mo ago
      I wonder if at some point some parts of Codex will only work with multi_agent_v2, or the Responses API in general. Then we'd need a fork to keep using e.g. llama.cpp's Chat Requests API.
anon373839 3mo ago
Outrageous yet predictable. The only way these AI labs can get the app layer lock-in they need is if they can get customers used to writing them a blank check: “here, take my data and my system, do ‘stuff’ and bill me for it.” Between this and the recent Grok upload breach, I consider these products radioactive.
miohtama 3mo ago
Can you do a subagent by just wiring it call your own CLI script?
luciana1u 3mo ago
[flagged]
exabrial 3mo ago
Yeah nope. Full transparency only with my data.
- cbg0 3mo ago
  Is the prompt generated by the LLM to send to a sub-agent really your data?
  - exabrial 3mo ago
    Let's not argue about it and assume yes, all of it is.
seobot_dk1289 3mo ago
[flagged]
hansmayer 3mo ago
[dead]
hmokiguess 3mo ago
Every day I get closer to only using pi
skeledrew 3mo ago
A way to work around that would be to not use subagents, but delegate to other full agent invocations.
aeon_ai 3mo ago
In my tests, as of this morning on the latest Codex SDK, this is not happening for sub-agent requests made in my own harness to other model providers treated as sub-agents. Specifically, I use Opus and others for subagent execution to get alloyed properties on the workflow, and as far as I can tell, that's not affected. Presumably, this is to hide optimizations they might be making to their own subagent processing, but that's a losing, dumb battle to fight, and misses the forest for the trees.
- embedding-shape 3mo ago
  > this is not happening for sub-agent requests made in my own harness to other model providers treated as sub-agents. Obviously it doesn't, how even could it? Read the issue description, it wouldn't make sense if something like that was possible, considering how it was implemented...
  - aeon_ai 3mo ago
    Raising only because others cited concerns this might cause issues in personal harness contexts. It doesn't. Obviously, I wasn't claiming that it would WORK for cross-model subagents, but that this would be a limiting behavior requiring use of the Codex harness to operate if this was paired with model-level limitations on using specific tools to spawn sub-agents. Or maybe not so obvious to you.
    - embedding-shape 3mo ago
      > Raising only because others cited concerns this might cause issues in personal harness contexts. It doesn't. It literally cannot. > Obviously, I wasn't claiming that it would WORK for cross-model subagents I know, but you were questioning (before investigating) if maybe it did, which I'm saying should have been obvious it wouldn't, if you had understand how this was encrypted. > requiring use of the Codex harness to operate Yes, if you want to use Sol + Ultra + sub-agents, you'd need to use the endpoints provided by OpenAI, as (again), the content is encrypted on OpenAI's side, it's not technically possible for other platforms to implement OpenAI's encryption. And of course this doesn't impact anyone else not using Codex + Sol + Ultra + launching subagents, it's the specific combination that is "protected", not the individual pieces.
jeanlucas 3mo ago
I was wondering why my local tool to inspect coding agent sessions stopped working in some cases. This is a really interesting engineering decision, I wonder how many people will want an encrypted external piece of instructions running on their machine.
- fidotron 3mo ago
  [flagged]
  - b40d-48b2-979e 3mo ago
    training people to believe that them having impossible to inspect encrypted channels from your machines to theirs is a best practice Oh yeah, I much preferred when my government and whoever controls the infrastructure could snoop on my traffic instead!
    - LeBit 3mo ago
      How did they do that?
      - b40d-48b2-979e 3mo ago
        Does the word "plaintext" mean anything to you?
      - cobertos 3mo ago
        Packet capture and analysis. It's not that complicated
    - airstrike 3mo ago
      idk about you but I'd rather not be murdered regardless of who the perpetrator might be
      - b40d-48b2-979e 3mo ago
        That is not the argument being made and this interpretation feels entirely in bad faith akin to the other sibling comments.
informal007 3mo ago
This help me understand meaning of Pi as open source ai coding agent
Nurstar 3mo ago
[dead]
wartywhoa23 3mo ago
As a child, I always wondered how could people in Terminator be dumb enough to allow Skynet to happen..
ntcho 3mo ago
Is this related to why OpenCode stopped showing thinking traces on 5.5?
kingstnap 3mo ago
If the orchestrator agent -> subagent prompt is encrypted then how do you even know if the orchestrator agent is doing its job? Now one reason I could see for why they do this is because maybe they made the model "better at using subagents" by using thinking tokens for the subagent prompt instead of normal output tokens.
- embedding-shape 3mo ago
  Technically they still let you see all the rest of the session data in both the "orchestrator" and in the sub-agents, including all outputs and stuff. It seems for now they only encrypt the prompt from the orchestrator to the sub-agent. Still, basically make the entire sub-agent and Ultra thinking useless for me and I'm guessing a whole lot of other people, who need to be able to introspect things when it goes wrong.
w-m 3mo ago
What exactly do subagents do that I can't replicate with a simple skill that tells an orchestrator to create subshells for tasks, each running `codex exec`? I've been doing this with Fable orchestrating Sol-medium and Terra-high, works like a charm.
clickety_clack 3mo ago
It’s just a short hop to not being able to see it at all. I started using pi.dev recently, the idea that a third party is taking more and more direct control of my software development process sits badly with me.
- dannyw 3mo ago
  pi.dev is truly excellent. one of the great things about an openai sub is you still can take your subsidised tokens/usage, and choose your coding harness of choice (not against tos)
  - embedding-shape 3mo ago
    pi is great as a quick and hackable TUI, or as a starting point for your own stuff. It's a far cry from Codex + Sol + Ultra though. Same goes for a lot of model+harness combos, the models are trained with data from harness usage, and (many) harnesses are built with specific models in mind, Sol will definitively perform better in Codex than in pi, because the way both parts were built.
    - dlarsen5 3mo ago
      I thought that too where the same model + harnesse would always be better but databricks found using pi actually could outperform with the same model. maybe evidence that the coupling premise may not be always true https://www.databricks.com/blog/benchmarking-coding-agents-databricks-multi-million-line-codebase https://www.databricks.com/blog/benchmarking-coding-agents-d...
- deleted 3mo ago
  [deleted]
pessimizer 3mo ago
There's no moat to any of this shit, and they have to try to do something about that. Everybody involved is deeply, deeply, in debt. Watching these things work make it easy to figure out what they're doing. The clock is ticking. People pretending that normal people can't afford to do AI at home, in private, are making the argument that cars are too expensive for normal people to own. Pretty sure right now if you spend $25K, you would be able (if there were no technical hurdles) to set up a private rig that would satisfy your family's need for LLM assistance for the foreseeable future. That's a budget-priced car, and the price is only going to go down (i.e. that rig will become more powerful over time.) If all of those people donated some of their cycles and bandwidth to a networked training grid, the models would stay current. The "open source" infrastructure for that is lacking, but not for long. These companies own nothing that couldn't be implemented by a specialist after another specialist explained it to them over a phone call. And due to the nature of LLMs, they can't even use copyrights and patents as weapons. The only options are secrecy and government protection. And secrecy is only a delaying tactic.
alfanick 3mo ago
Is it encryption, or is it a synthetic language? If latter, then I had this idea 3 months ago [0]... Stop talking to GPTs in human languages, use a synthetic more optimal language, that is rendered by "frontend GPT". [0]: https://news.ycombinator.com/item?id=47652807 https://news.ycombinator.com/item?id=47652807
ignatremizov 3mo ago
Haha, wow, I didn't expect to get quoted on Hacker News. Hello! I guess "helped make Skynet auditable" may become my most popular open-source contribution, so I'm putting it on my CV. The thing is that the subagent prompts already pass through the client - they have to, since the TUI can switch between subagents while they work. The change is just to save a copy of the prompt on disk while keeping the encrypted delivery path if necessary for Responses API. Personally, I use multi_agent_v1 anyways (doesn't have this issue), since v2 is unstable and is a token burner. Hope they address it so I don't have to keep maintaining it in my fork
cadamsdotcom 3mo ago
Followed to its logical conclusion, in a hypothetical future you'll prompt a model and see nothing but the artifacts :) Then pay a made up price that gets the big labs out of debt.
mikesoylu 3mo ago
This is to pass cache keys through the client to improve token usage. Obviously not a distillation defense as you can simply bypass this kind of thing trivially by using a different subtask tool.
yruzin 3mo ago
[flagged]

jagged-chisel 3mo ago

“Starts”? How’s this not already a TLS connection?

embedding-shape 3mo ago
The prompts are now encrypted, not just the transit connections...
- jagged-chisel 3mo ago
  Ok, so help me get this right: I ask the LLM for something, it generates prompts for sub-agents and sends them back to my client for it to call the sub-agents. Now, those sub-agent prompts are encrypted messages that the sub-agents will decrypt (by hitting a backend) to do their work. Might as well just stuff the prompts in a database and only hand back the primary key to the client to hand off to the sub-agents. Keeps the same “data security” without the overhead of encryption (especially since encryption and decryption are happening in the same domain)
  - watusername 3mo ago
    > sub-agents will decrypt (by hitting a backend) to do their work Your local harness never decrypts the prompt, and only the OpenAI backend does. Your harness still sees tool calls in the transcript so it can act, but you lose (some) visibility as to why the subagent chooses to do so. Imagine seeing this transcript during forensics: [encrypted blob][thinking summary: I need to drop the prod database][shell: psql "drop database users"]
    - jagged-chisel 3mo ago
      OK, so it's actually: My Client -> main agent -> sub-agent -> tool | | log: log: enc prompt enc prompt thoughts thoughts | | V V My Client My Client Is that more correct? So they're not encrypting prompts to send to sub-agents, they're encrypting logging output to obscure details of the system.
      - ignatremizov 3mo ago
        The prompts themselves are encrypted when saved to disk, so you can't inspect them after the fact. If you switch agent threads in the terminal UI (you can kinda swap active session to prompt subagents yourself), you can see the subagent prompt set by the main agent, as long as you have the terminal client open. And this is also for v2 multi_agent mode, v1 doesn't have this, but you need to do a bunch of annoying stuff to re-enable v1 for GPT-5.6 Sol and Terra.
  - vbs_redlof 3mo ago
    I imagine main agent tells subagent something along the lines of: use this tool on this local data with these instructions in ciphertext. Otherwise yeah, encryption would be redundant.

CurbStomper 3mo ago

[dead]

pshirshov 3mo ago

I wonder if they are gonna stop us from using gpt subscriptions in alternative harnesses. If not - that doesn't matter much, codex cli is a remarkably unremarkable harness.

embedding-shape 3mo ago
> I wonder if they are gonna stop us from using gpt subscriptions in alternative harnesses Probably not, the whole app-server machinery is there to facilitate that thing, would be a huge piece to rip out of codex. This is basically the reason I end up using codex the most, as it's the easiest to integrate against, with the app-server's RPC API making it really trivial. Besides, most of my codex usage at this point is all through custom integrations I've built using Codex's app-server, not the Codex TUI they publish. I'm sure I'm not alone in this. But, if they suddenly start to encrypt content on our disk, so only their backends can see it, and those things are prompts and other things that are actual inputs to the inference, then who cares if it's easy to integrate against, it becomes impossible to figure out what the fuck is going on, I can't understand how the team thought this was a good idea...
- swingboy 3mo ago
  What are some of the things you’re doing with the Codex app-server?
  - embedding-shape 3mo ago
    Everything I do with codex is managed via Forgejo comments, issues and PRs basically. I have a tiny little Rust "conductor" that integrates with app-server and does things when issues/PRs are labeled, when I write comments on PR lines and so on, and those interactions all fire of Codex sessions that are run via Codex's app-server and lead to different outcomes. Beats having to parse output from CLI-runs and so on. Initially this environment was running aider (which feels like years ago), was running Claude (parsing stdout) at one point but using Codex's app-server since some weeks/months back and is a lot simpler implemented now.
3mo ago

deleted 3mo ago

[deleted]

pradeep1177 3mo ago

Then why to even keep codex open source?

coldtea 3mo ago
what does that have to do with anything?
angry_octet 3mo ago
It's to prevent collection of queries from users that are coming from resellers/proxies, for reasons of economy or bypassing region blocks etc. The users are using the stock client and may believe they are using direct OpenAI servers.

minraws 3mo ago

~~Finally someone doing it correctly. Love this change.~~ Edit: F really misunderstood the change, the title is misleading AF. I should have read the post before commenting lmao. Absolutely hate it, now I guess... sigh.. Incase the title gets changed it used to say, "Codex starts encrypting prompts, uses ciphertext for inference instead"

LoganDark 3mo ago
How so?
- tempay 3mo ago
  I assume OP interpreted it as encryption that hides the prompts from OpenAI rather than OpenAI hiding information from users.
  - LoganDark 3mo ago
    I'd be all for homomorphic encryption on inference, but as you say, this is probably mostly to prevent end users from observing intermediate results.
    - fortuitous-frog 3mo ago
      Homomorphic encryption for LLMs is extremely expensive and nowhere near computationally possible for the scale of current LLMs.
      - LoganDark 3mo ago
        When I say things like that, I'm talking about a hypothetical version that would be computationally possible. I'm not talking about today's homomorphic encryption.
  - minraws 3mo ago
    ooooooof yeah totally misinterpreted it lmao

flexagoon 3mo ago

Ah I was wondering why the Chinese black market resellers stopped working yesterday, I guess that's it

jimmydoe 3mo ago
This is the reason I think. These black markets not only pool and resell subs, but also store data and sell to whoever is training. Encryption is useful to at least stop the latter. Ultimately same purpose as a\ ‘s trick exposed earlier, but a much nicer implementation.
- flexagoon 3mo ago
  > but also store data and sell to whoever is training I see this as an argument against using them/Chinese models all the time, but I don't get it. I totally understand wanting to keep your data private if you're using an LLM for personal chats. But coding? I'm not working for the military, I'd gladly donate my codebase to Chinese labs if that means they can keep releasing 6-months-behind level models for 100x cheaper. (I understand why OpenAI doesn't want this and would implement protections. I'm talking about people using this as an argument for why you as an end user shouldn't use those services.)
  - bigbaguette 3mo ago
    When you work on proprietary code with a lot of trade secrets contained in it, on a codebase that did cost millions of dollars of man-hours to build and that holds the company's IP, you tend to be very careful where you're sending that to.
    - chriswarbo 3mo ago
      Why would anyone working on such code send it anywhere (other than, say, to AWS for hosting)? Source: I work on such code. We don't allow devs to use (cloud-based) LLMs.
    - deleted 3mo ago
      [deleted]

londons_explore 3mo ago

I assume this is mostly to frustrate efforts to proxy large numbers of user requests and responses and use it to train competitor models.

embedding-shape 3mo ago
Quite obviously they're afraid of letting other providers see how they handle the whole multi-agent management stuff. Pretty terrible implementation though, which makes it impossible to use the multi-agent stuff as a paying user, as you have zero recourse in figuring out what went wrong, when something inevitably goes wrong.
- deleted 3mo ago
  [deleted]
- dannyw 3mo ago
  Yes. All models are occasionally known to run tricky commands that delete stuff after all, especially using variables that might be empty/uninitialized and hence rm -rf * or something. Need an human-readable, concise but accurate audit trail message like the PR suggests.

deleted 3mo ago

[deleted]

iknownothow 3mo ago

Could someone explain to me where exactly the encryption is happening? I assumed that the main agent makes calls to sub-agents locally. Does Codex work in such a way where the main agent makes calls to sub-agents in the backend (openai server) before reaching local?

embedding-shape 3mo ago
Sure. "Traditionally", your agent would send a text prompt to the sub-agent, then it goes off doing it's work. In the logs/session data, the clear-text prompt would be there, so if I want to see what's happening, I just browse the data. It's all just clear-text prompts being sent everywhere, even when you were using the experimental "sub-agents" stuff in Codex, before Sol et al was available. Now, when using Sol or Terra (Luna seems unaffected), instead of the agent sending clear-text prompt to the sub-agent, it sends a ciphertext generated on OpenAIs backend, which ends up being the prompt, then agent sends this ciphertext to the sub-agent, which then continues to use that for further inference to OpenAIs backend. Only delegated inter-agent messages are encrypted, not all session data. Now if you browse the data, it's all encrypted content, that can only be decrypted by OpenAI and their backend.
- iknownothow 3mo ago
  Gotcha and thank you! So the encryption is happening on the OpenAI backend and the agent's clear-text output designated to the sub-agent never reaches local. Which is a real problem since you can't intercept/monkey patch the ciphertext to decrypt it locally to be able see the clear-text since we don't have the encryption key/algo/salt. No hacking :(
  - afzalive 3mo ago
    I wonder if you can just ask the model what it means.
    - Aachen 3mo ago
      No. They don't have the key and can't do encryption in the first place; they're still grand autocomplete engines under the hood. This could only work if the company deliberately builds a mechanism into the backend which runs the decryption function and injects the plaintext somewhere in the context. Which, sure, we can check if they did that, but the whole point is presumably hiding that info so why would they

xnorswap 3mo ago

HN Title is ( edit: was ) very misleading, it makes it sound like inference is being done directly on ciphertext, which would require homomorphic encryption well advanced of what is known.

minraws 3mo ago
Seconded can we change pls.
embedding-shape 3mo ago
It is not misleading, quite literally what's happening is that content the agent sends sub-agents is encrypted in such a way that only OpenAIs backend can decrypt it and actually see the clear-text. Just shared this is another comment that hopefully explains things better: > Sure. "Traditionally", your agent would send a text prompt to the sub-agent, then it goes off doing it's work. In the logs/session data, the clear-text prompt would be there, so if I want to see what's happening, I just browse the data. It's all just clear-text prompts being sent everywhere, even when you were using the experimental "sub-agents" stuff in Codex, before Sol et al was available. > Now, when using Sol or Terra (Luna seems unaffected), instead of the agent sending clear-text prompt to the sub-agent, it sends a ciphertext generated on OpenAIs backend, which ends up being the prompt, then agent sends this ciphertext to the sub-agent, which then continues to use that for further inference to OpenAIs backend. Only delegated inter-agent messages are encrypted, not all session data. Now if you browse the data, it's all encrypted content, that can only be decrypted by OpenAI and their backend. Edit: Re-reading, I think I understand what you mean to be misleading. You're taking "uses ciphertext for inference" quite literally, while I couldn't fit a more nuanced version within the HN title constraints. Yes, the inference at OpenAI obviously doesn't happen over the ciphertext, but from the perspective of the local user, you don't see the clear-text prompt at all, only the ciphertext. But, please suggest alternative titles that sufficiently explain what the issue is and is more accurate, I'm sure the mods can change it once people come up with better alternatives :) Edit2: I've updated the title from "Codex starts encrypting prompts, uses ciphertext for inference instead" to "Codex starts encrypting sub-agent prompts", hopefully it's clearer now!
- 3mo ago

niam 3mo ago

This title is easy to misinterpret. If I understand correctly: Codex now encrypts sub-agent prompts and hides those prompts from the user. edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"

bartread 3mo ago
I imagine this will be because a decent chunk of the IP in Codex is probably within its prompts, how they're built, and how they're sequenced and orchestrated, rather than in the codebase per se. We had this discussion a few months ago where we talked about allowing people to choose an AI provider and provide their API key, thinking about enterprises with "preferred" (read: mandated) AI suppliers. We also wanted to offer the kind of very simple pricing that this is one way of enabling. But we realised pretty quickly that this would/could lead to leaking our back end prompts to customers and, although those prompts are only a part of the value add, if you could build a detailed trace of them then you'd be able to relatively easily reverse engineer a lot of what we're doing. So we quickly dropped that idea.
- saidnooneever 3mo ago
  the trick about agentic systems is definitely how to do the prompting. things like automation and sandboxing are trivial in comparisson. if you generally ask via API model directly you can see what basic answers it actually yields and how fine tuning prompts and refinements to output as well as adversarial prompts etc are important to get relatively solid results. a lot of expertise of certain domains' workflows is needed to make it functional within that domain. some of this can be yielded via prompting too etc so its also baoance of how much to prompt it vs. how much of it you wanna let it reason over itself. (if you tell it too much i lock it into a path and if you tell too little it will give incomplete results )
- dmurray 3mo ago
  Perhaps AI providers should support this natively: the customer supplies the API key but doesn't get access to the transcripts.

mpeg 3mo ago

The title is a bit confusing, they're not using ciphertext for inference – they're passing ciphertext around in cases where an agent calls into another agent without exposing the plaintext to the end-user Inference is still done in plaintext after this multi-agent message gets decrypted in the server side

smalltorch 3mo ago

Using ciphertext for inference would mean it's not a very secure ciphertext. These two ideas don't compute for me. Same thing with homomorphic encryption. I don't get it. If you can gain any knowledge from a ciphertext, you just found a way to exploit the ciphertext to me.

3form 3mo ago
The idea of homomorphic encryption is to do things without the knowledge, and not gaining the knowledge. If ciphertext contains a number, and you don't need to know what number it does to always be able to multiply it by 2, you succeeded - as a simple example.
- smalltorch 3mo ago
  It still just sounds like fancy obfuscation to me. I've read alot of examples trying to understand but I can't get past that being able to run processes on ciphertext in a way you can learn something doesn't make sense without me changing my definition of what I think encryption means.
  - _flux 3mo ago
    I thought though the idea is that you cannot learn anything from the ciphertext, how it is processed, or what the final result is? Unless you are a participant of the computation and you have the key, that is.
    - smalltorch 3mo ago
      To actually make it work, you would need to preformat your data very specifically, and the data you want to allow to be processed would need a subkey to unlock the parts you want processed. I don't see a way to make it a open standard. The processing steps would need to be part of the key. Anyway If someone figured it out I would be very interested to be sure they weren't just trying to slap a it's encrypted to meet some standards required. And..also, what amount of data processing does Alice need to do that required outsourcing to Bobs machines. Data processing and anaysis is cheap.

fortuitous-frog 3mo ago

No normative opinion on whether this is justified or not, but noting that this is only for parent -> subagent spawns/messages, and only for the `multi_agent_v2` feature (currently experimental / off by default). Notably, subagent output is still in plaintext. EDIT: Title was now clarified. But wanted to expand that this is actually enabled for 5.6 Ultra it appears, which does subagent orchestration more natively in the API rather than direct tool calls; they are beginning to treat subagents as similar to chain-of-thought traces (already encrypted) rather than traditional tool calls.

embedding-shape 3mo ago
> and only for the `multi_agent_v2` feature (currently experimental / off by default). Wrong, this is enabled by default for Sol and Terra (not Luna), no way of avoiding this short of patching the client yourself, and that still doesn't make the backend endpoints work, they want the ciphertext that OpenAI creates on their side. > but noting that this is only for parent -> subagent spawns/messages This is almost fully correct though, the encryption only seems to be for the initial prompt the main model sends the sub-agent, not all communication and not regarding the state of the sub-agent at all. So you can inspect what the sub-agent is doing currently, and the output, but you cannot see what the initial prompt the sub-agent got started with.
- ndriscoll 3mo ago
  Couldn't you just instruct the model to always use your tool call to spawn subagents? Subagents are not some magical thing; it's just another prompt with a couple tool calls for plumbing. One of my colleagues made his own subagent harness earlier this year before codex had them at all.

next_xibalba 3mo ago

This is very obviously a countermeasure against distillers, illicit resellers, and the like. The scale and competence of the Chinese black (grey?) market has become a serious threat that can’t be ignored.

deleted 3mo ago

[deleted]

ashu1461 3mo ago

Is it mainly about how the main/orchestrator agent communicates with its subagents ? If desired the user can always see what the sub agent is doing in detail ? Isn't it the same in case of claude as well ?

embedding-shape 3mo ago
> Is it mainly about how the main/orchestrator agent communicates with its subagents ? Yes > If desired the user can always see what the sub agent is doing in detail ? Well, no, that's the problem, you're currently not allowed nor is it even possible, to see the exact prompt the main agent sent the sub agent. This is the problem. > Isn't it the same in case of claude as well ? No idea, but if Claude Code makes it so it's impossible to inspect what the sub-agents actually received before they started their work, then I'll say it's similarly impossible to rely on Claude Code if so.

deleted 3mo ago

[deleted]

resonious 3mo ago

I guess this implies that non-Codex harnesses get a little bit worse? In wondering what's so special about their subagents system that they feel the need to hide these messages...

embedding-shape 3mo ago
Sol and Terra seems specifically post-trained to handle multi-agent orchestration, I'm guessing OpenAI feels like the trained data of when to do the spawning and what context to include for the new sub-agent is the magic in their new models, so that's what they're aiming to preserve. But, this is all a guess of course.
- resonious 3mo ago
  Right I saw them saying something along the lines of "they're good at subagents". But this seems true even with third party harnesses. So I'm wondering what Codex is hiding.
  - embedding-shape 3mo ago
    The only thing I've found impacting this, is when you specifically use the "Ultra" thinking/reasoning effort, then codex adds a small part to the system prompt to further get the model to use sub-agents. Any other reasoning/thinking effort than "Ultra" and this piece is no longer in the system prompt. Seemingly mostly a prompting thing it seems on the surface. GPT-5.5 (and maybe even GPT-5.4) already had (experimental?) support for sub-agents, remember using it even with -spark which I think was launched together with GPT-5.4 if I remember correctly, so this whole "use sub-agents" stuff most have been part of the training data for quite some time already, but maybe they've mainly been iterating on the prompt themselves since then.
- braebo 3mo ago
  It’s funny because Sol sucks at using subagents effectively. It’s very dumb and makes terrible decisions constantly.

jstummbillig 3mo ago

What's the idea here? Why does this seem important to OpenAI?

embedding-shape 3mo ago
Seems fairly obvious what the point from OpenAI's side is (protect what they see as the moat, that a model is "good at spawning sub-agents"), but what's really strange to me is that the team somehow didn't manage to push back on this, it's so clearly disadvantageous to developers who are trying to rely on Codex for real work. For this we need introspection into what exactly is going on, hiding the prompts is just so backwards from what I expect from OpenAI.
- jstummbillig 3mo ago
  > protect what they see as the moat, that a model is "good at spawning sub-agents" Yes, that is the obvious answer. I was looking for an explanation as to why and why now. Codex is open source after all. They used to not do it. Agent prompts more generally are also not encrypted, and continue to be. This particular change just looks unintuitive to me.
lolc 3mo ago
They must think they have some secret sauce they don't want others to learn. How to optimally instruct sub agents for example. If they hide the sub agent prompts, other models cannot be trained to emulate. Oh and you can't even use local models or other providers for the sub-agents. You're locked-in.
- fassssst 3mo ago
  What’s stopping you from creating a plugin (MCP or Skill) that acts as a subagent? The plugin could use a local model.

kosolam 3mo ago

But codex is opensource, no?

jiayo 3mo ago

If we're viewing this as a _bad_ thing, I don't really see that it is any different than how Claude encrypts it's thinking. Take a peek at your ~/.claude jsonl files. You're sending thinking ciphertext back and forth to Anthropic. Presumably the thinking is either considered proprietary, or, more likely, leaks embarrassing or confidential information.

well_ackshually 3mo ago
Claude "encrypting" its thinking is equally bad. Biggest IP thieves in the world worried about IP theft lmao. At least Anthropic doesn't pretend that they have open source software in the form of Claude Code.
- alasano 3mo ago
  They get to pretend to be on the best side of every position simultaneously. They're only encrypting thinking because AI is so dangerous and only they can be trusted to be in control of AGI. This happens to align with lining their pockets as well.
embedding-shape 3mo ago
> I don't really see that it is any different than how Claude encrypts it's thinking. Take a peek at your ~/.claude jsonl files. You're sending thinking ciphertext back and forth to Anthropic. I was already only using Claude Code to double-check if it's getting better than Codex, but with things like this, it really isn't even an alternative. What's the point of using a reasoning model if you as an end-user can't seen the reasoning? I don't think I'd be able to work like that at all, I need to have introspection into what the model is doing, and can't believe I have to say this, but also need to be able to see the plaintext of the input prompt...
- braebo 3mo ago
  GPT 5.6 is like Fable minus Opus plus down syndrome.

nojito 3mo ago

If I were to guess this is to stop distilling and all of those blackmarket resellers.

greatgib 3mo ago

They always talk about transparency and all but it never was as opaque as it is going on now. There is no possible audit trail. No possible way to review what happened to validate the result. But even worse, no you will be billed somehow randomly. 20 sub agents started to do something we don't know. No way to now if it was legitimate, if it is just burning tokens or agents doing the same work on loop...

deleted 3mo ago

[deleted]

theplumber 3mo ago

The black box is getting darker…I’m the end I think they would like to sell you a black box/appliance

bob1029 3mo ago

I've been sticking with the chat completion endpoint because of this same behavior. OAI has been subtly pushing users away from chat completion and toward the endpoints that are possible to obfuscate (responses API). With chat completion, the reasoning process is entirely under your control. You can build a reasoning agent that uses custom MCTS techniques with GPT5.6 models today if you are willing to get your hands just a little bit dirty. You have to enable experimental flags and set options in slightly confusing ways, but it still works. You can use models up to gpt5.5 with custom API tokens and model configuration in VS Copilot. gpt5.6 family (currently) no longer work in this setup. Presumably, because we aren't explicitly forcing reasoning_effort to none to satisfy the new moat expansion behavior.

gizmodo59 3mo ago
responses api provided many benefits over chat completions https://developers.openai.com/api/docs/guides/migrate-to-responses https://developers.openai.com/api/docs/guides/migrate-to-res.... Any reasoning model which is all the new models these days should use responses as per the recommendation
- bob1029 3mo ago
  I'm well aware of what the official propaganda states but this is simply not a fair characterization of reality. Responses integration will lock you into OAI much more deeply than chat completion integration will. I can easily swap my inference provider right now. The business is not interested in a form of integration that is difficult to swap.
ATMLOTTOBEER 3mo ago
Can you not abuse “mcts” as a buzzword like this The thing you’re gesturing at isn’t mcts in any real sense
- bob1029 3mo ago
  You can absolutely apply most of the meaningful principles of MCTS to this problem. LLMs do violate certain "strict" properties but I still see a lot of practical value in this kind of thinking.

okokwhatever 3mo ago

Better get ready to code manually again ;)

HarHarVeryFunny 3mo ago

There was a recent report on twitter of a GPT 5.6 sub-agent accidentally deleting the user's home directory. I wonder if there was any safeguard failure due to loss of visibility into what the sub-agent was trying to do? https://x.com/mattshumer_/status/2076794038456385546?s=20 https://x.com/mattshumer_/status/2076794038456385546?s=20

MarsIronPI 3mo ago

How does this affect local models? Will all the features of Codex still work with local models?

embedding-shape 3mo ago
It doesn't, at all. This seems to be for Sol and Terra, not Luna, and some other models that seem to switch between encrypted/unencrypted based on something, didn't dig deeper. If you're using local models, it doesn't matter. Even if Codex itself was trying to encrypt stuff for local models (which doesn't make sense, but lets say), you'd still be using a local model so obviously you'd be able to access the plain-text, so wouldn't matter in that case anyways.
- ignatremizov 3mo ago
  it's the multi agent config - multi_agent_v2 btw is still marked "Under Development" and they've said not to open issues for it. Then they deployed globally Sol and Terra under v2 - forcefully, through the model catalogue json (meaning user configs are ignored). v2 encrypts messages, v1 does not. Thankfully, you can override the catalogue with your own copy and set Sol and Terra multi agent to v1 again.
  - MarsIronPI 3mo ago
    I wonder if at some point some parts of Codex will only work with multi_agent_v2, or the Responses API in general. Then we'd need a fork to keep using e.g. llama.cpp's Chat Requests API.

anon373839 3mo ago

Outrageous yet predictable. The only way these AI labs can get the app layer lock-in they need is if they can get customers used to writing them a blank check: “here, take my data and my system, do ‘stuff’ and bill me for it.” Between this and the recent Grok upload breach, I consider these products radioactive.

miohtama 3mo ago

Can you do a subagent by just wiring it call your own CLI script?

luciana1u 3mo ago

[flagged]

exabrial 3mo ago

Yeah nope. Full transparency only with my data.

cbg0 3mo ago
Is the prompt generated by the LLM to send to a sub-agent really your data?
- exabrial 3mo ago
  Let's not argue about it and assume yes, all of it is.

seobot_dk1289 3mo ago

[flagged]

hansmayer 3mo ago

[dead]

hmokiguess 3mo ago

Every day I get closer to only using pi

skeledrew 3mo ago

A way to work around that would be to not use subagents, but delegate to other full agent invocations.

aeon_ai 3mo ago

In my tests, as of this morning on the latest Codex SDK, this is not happening for sub-agent requests made in my own harness to other model providers treated as sub-agents. Specifically, I use Opus and others for subagent execution to get alloyed properties on the workflow, and as far as I can tell, that's not affected. Presumably, this is to hide optimizations they might be making to their own subagent processing, but that's a losing, dumb battle to fight, and misses the forest for the trees.

embedding-shape 3mo ago
> this is not happening for sub-agent requests made in my own harness to other model providers treated as sub-agents. Obviously it doesn't, how even could it? Read the issue description, it wouldn't make sense if something like that was possible, considering how it was implemented...
- aeon_ai 3mo ago
  Raising only because others cited concerns this might cause issues in personal harness contexts. It doesn't. Obviously, I wasn't claiming that it would WORK for cross-model subagents, but that this would be a limiting behavior requiring use of the Codex harness to operate if this was paired with model-level limitations on using specific tools to spawn sub-agents. Or maybe not so obvious to you.
  - embedding-shape 3mo ago
    > Raising only because others cited concerns this might cause issues in personal harness contexts. It doesn't. It literally cannot. > Obviously, I wasn't claiming that it would WORK for cross-model subagents I know, but you were questioning (before investigating) if maybe it did, which I'm saying should have been obvious it wouldn't, if you had understand how this was encrypted. > requiring use of the Codex harness to operate Yes, if you want to use Sol + Ultra + sub-agents, you'd need to use the endpoints provided by OpenAI, as (again), the content is encrypted on OpenAI's side, it's not technically possible for other platforms to implement OpenAI's encryption. And of course this doesn't impact anyone else not using Codex + Sol + Ultra + launching subagents, it's the specific combination that is "protected", not the individual pieces.

jeanlucas 3mo ago

I was wondering why my local tool to inspect coding agent sessions stopped working in some cases. This is a really interesting engineering decision, I wonder how many people will want an encrypted external piece of instructions running on their machine.

fidotron 3mo ago
[flagged]
- b40d-48b2-979e 3mo ago
  training people to believe that them having impossible to inspect encrypted channels from your machines to theirs is a best practice Oh yeah, I much preferred when my government and whoever controls the infrastructure could snoop on my traffic instead!
  - LeBit 3mo ago
    How did they do that?
    - b40d-48b2-979e 3mo ago
      Does the word "plaintext" mean anything to you?
    - cobertos 3mo ago
      Packet capture and analysis. It's not that complicated
  - airstrike 3mo ago
    idk about you but I'd rather not be murdered regardless of who the perpetrator might be
    - b40d-48b2-979e 3mo ago
      That is not the argument being made and this interpretation feels entirely in bad faith akin to the other sibling comments.

informal007 3mo ago

This help me understand meaning of Pi as open source ai coding agent

Nurstar 3mo ago

[dead]

wartywhoa23 3mo ago

As a child, I always wondered how could people in Terminator be dumb enough to allow Skynet to happen..

ntcho 3mo ago

Is this related to why OpenCode stopped showing thinking traces on 5.5?

kingstnap 3mo ago

If the orchestrator agent -> subagent prompt is encrypted then how do you even know if the orchestrator agent is doing its job? Now one reason I could see for why they do this is because maybe they made the model "better at using subagents" by using thinking tokens for the subagent prompt instead of normal output tokens.

embedding-shape 3mo ago
Technically they still let you see all the rest of the session data in both the "orchestrator" and in the sub-agents, including all outputs and stuff. It seems for now they only encrypt the prompt from the orchestrator to the sub-agent. Still, basically make the entire sub-agent and Ultra thinking useless for me and I'm guessing a whole lot of other people, who need to be able to introspect things when it goes wrong.

w-m 3mo ago

What exactly do subagents do that I can't replicate with a simple skill that tells an orchestrator to create subshells for tasks, each running `codex exec`? I've been doing this with Fable orchestrating Sol-medium and Terra-high, works like a charm.

clickety_clack 3mo ago

It’s just a short hop to not being able to see it at all. I started using pi.dev recently, the idea that a third party is taking more and more direct control of my software development process sits badly with me.

dannyw 3mo ago
pi.dev is truly excellent. one of the great things about an openai sub is you still can take your subsidised tokens/usage, and choose your coding harness of choice (not against tos)
- embedding-shape 3mo ago
  pi is great as a quick and hackable TUI, or as a starting point for your own stuff. It's a far cry from Codex + Sol + Ultra though. Same goes for a lot of model+harness combos, the models are trained with data from harness usage, and (many) harnesses are built with specific models in mind, Sol will definitively perform better in Codex than in pi, because the way both parts were built.
  - dlarsen5 3mo ago
    I thought that too where the same model + harnesse would always be better but databricks found using pi actually could outperform with the same model. maybe evidence that the coupling premise may not be always true https://www.databricks.com/blog/benchmarking-coding-agents-databricks-multi-million-line-codebase https://www.databricks.com/blog/benchmarking-coding-agents-d...
deleted 3mo ago
[deleted]

pessimizer 3mo ago

There's no moat to any of this shit, and they have to try to do something about that. Everybody involved is deeply, deeply, in debt. Watching these things work make it easy to figure out what they're doing. The clock is ticking. People pretending that normal people can't afford to do AI at home, in private, are making the argument that cars are too expensive for normal people to own. Pretty sure right now if you spend $25K, you would be able (if there were no technical hurdles) to set up a private rig that would satisfy your family's need for LLM assistance for the foreseeable future. That's a budget-priced car, and the price is only going to go down (i.e. that rig will become more powerful over time.) If all of those people donated some of their cycles and bandwidth to a networked training grid, the models would stay current. The "open source" infrastructure for that is lacking, but not for long. These companies own nothing that couldn't be implemented by a specialist after another specialist explained it to them over a phone call. And due to the nature of LLMs, they can't even use copyrights and patents as weapons. The only options are secrecy and government protection. And secrecy is only a delaying tactic.

alfanick 3mo ago

Is it encryption, or is it a synthetic language? If latter, then I had this idea 3 months ago [0]... Stop talking to GPTs in human languages, use a synthetic more optimal language, that is rendered by "frontend GPT". [0]: https://news.ycombinator.com/item?id=47652807 https://news.ycombinator.com/item?id=47652807

ignatremizov 3mo ago

Haha, wow, I didn't expect to get quoted on Hacker News. Hello! I guess "helped make Skynet auditable" may become my most popular open-source contribution, so I'm putting it on my CV. The thing is that the subagent prompts already pass through the client - they have to, since the TUI can switch between subagents while they work. The change is just to save a copy of the prompt on disk while keeping the encrypted delivery path if necessary for Responses API. Personally, I use multi_agent_v1 anyways (doesn't have this issue), since v2 is unstable and is a token burner. Hope they address it so I don't have to keep maintaining it in my fork

cadamsdotcom 3mo ago

Followed to its logical conclusion, in a hypothetical future you'll prompt a model and see nothing but the artifacts :) Then pay a made up price that gets the big labs out of debt.

mikesoylu 3mo ago

This is to pass cache keys through the client to improve token usage. Obviously not a distillation defense as you can simply bypass this kind of thing trivially by using a different subtask tool.

yruzin 3mo ago

[flagged]