Codex Encrypts Sub-Agent Prompts

Codex starts encrypting sub-agent prompts is an open GitHub issue in OpenAI Codex, OpenAI's local terminal coding agent. The issue says a MultiAgentV2 change made sub-agent task messages unreadable, which breaks a small but important audit trail for people reviewing agent work. Encrypted agent internals can be reasonable, but your workflow still needs a readable handoff before you trust the result. For codex training, this is a useful case study because it shows the difference between running an agent and reviewing what it actually did.

Understand what became unreadable

Codex CLI is a coding agent from OpenAI that runs locally in your terminal and can inspect, edit, and test code in a repository. As of July 2026, the open source openai/codex repository is mainly Rust, Apache-2.0 licensed, and widely watched by developers using terminal-first AI coding workflows.

The GitHub issue is about MultiAgentV2, specifically messages used by spawn_agent, send_message, and followup_task. The reporter says that after the merged change titled Encrypt multi-agent v2 message payloads, the task text passed between the main agent and sub-agents is no longer readable in the local trail.

A sub-agent prompt is the task instruction sent from a parent coding agent to a smaller worker agent. In a normal review, that prompt is useful because it tells you what the worker was asked to do before you judge the output.

Don't assume the final diff is the whole story. In a real repo, a sub-agent might be asked to update a migration, audit a dependency path, or rewrite a test helper. If the prompt disappears into ciphertext, the reviewer can still inspect the final patch, but cannot easily compare the assignment to the result.

Separate security from reviewability

The discussion around the issue got noisy because prompt encryption sounds like two different things. One interpretation is privacy: stop sensitive task payloads from sitting around in plain text. Another is control: make it harder for alternative harnesses or resellers to reuse subscription-backed traffic.

The issue itself is narrower than that debate. It is not proof that Codex CLI is closing off every alternative harness. It is a concrete regression report: a readable MultiAgentV2 task audit trail became unreadable after encryption landed.

That distinction matters. Encrypting internal messages may be a valid product or security choice, especially if prompts include private code, secrets, or customer names. But reviewability is not optional in coding work. If the tool hides the task text, the workflow has to preserve intent somewhere else.

A good mental model is commit review. You do not need every keystroke from a developer, but you do need the ticket, the change, and the test evidence. Sub-agent work needs the same minimum receipt.

Keep intent outside the encrypted path

The practical move is to write the task contract somewhere the repository can see before the agent spawns helpers. This does not mean dumping giant prompts into version control. It means keeping a small, durable rule for how agent work must be handed back.

For Codex, the natural place is AGENTS.md. OpenAI's AGENTS.md guide describes repository instructions for Codex; in practice, this is where you put local constraints, verification commands, and handoff rules that should survive across sessions.

Here is a small repo rule that helps when sub-agent prompts are not readable:

# AGENTS.md

## Agent handoff rule

Before delegating work to a sub-agent, write a short task receipt in the session summary:
- target files or directories
- intended change
- commands that must pass
- known non-goals

When returning with a patch, include:
- what changed
- what was not changed
- verification output
- any uncertainty that needs human review

This does not recover the encrypted payload. It gives you a parallel audit artifact that is plain enough to review.

Don't make AGENTS.md a junk drawer. Keep it short. Put repo-wide rules at the root, and put local rules near the code that needs them, such as services/billing/AGENTS.md for payment logic or packages/ui/AGENTS.md for frontend conventions.

If you want a broader pattern for checking prompt quality across coding tools, the related note on Evaluate Prompt Quality in Claude Code and Codex pairs well with this issue. The shared idea is boring and powerful: preserve intent before you measure output.

Run a verification loop before you trust the patch

Before a fix lands upstream, treat encrypted sub-agent trails as a review constraint. You can still use Codex, but ask it to produce a readable receipt and then verify the repository state yourself.

A small Codex CLI workflow might look like this:

# Start in a clean working tree
git status --short

# Run Codex from the repository root
codex

# After Codex edits files, inspect the patch
git diff --stat
git diff

# Run the checks the agent claimed were relevant
npm test -- --runInBand
npm run lint

# Save the human-readable handoff in the PR body or task note
git status --short

The exact commands should match your repo. A Rust service might use cargo test and cargo clippy; a Python package might use pytest and ruff check ..

This is also the one place where a starter exercise plan is useful. For codex training, give a developer a tiny bug in a test fixture, ask Codex to fix it with a handoff receipt, then compare three things: the requested task, the patch, and the verification output. If any one is missing, the exercise is not done.

Don't let the agent choose the definition of done after the fact. Ask for the receipt first, then inspect whether the diff and tests match it.

Add boundaries for MCP-backed work

Many Codex workflows use MCP to reach external systems such as issue trackers, docs, databases, or internal search. Encryption of sub-agent messages does not change the basic safety rule: the more tools an agent can call, the more explicit the boundary needs to be.

A simple MCP boundary note belongs next to the task, not buried in chat history:

## MCP boundary for this task

Allowed:
- read GitHub issue title, body, and linked PRs
- read internal docs returned by search

Not allowed:
- write to GitHub
- query production databases
- post to Slack
- modify secrets or deployment settings

This is not ceremony. It makes the review legible when the agent uses external context and the sub-agent payload itself is opaque.

Don't treat MCP access as all-or-nothing. Read-only access to a GitHub issue is very different from write access to a production incident channel. Put that difference in plain text before the run.

Before you run this agent

Use this checklist when a Codex task may spawn sub-agents or call tools outside the repo.

This checklist will not make encrypted prompts readable. It reduces the damage by moving the important review facts into artifacts you control.

Further reading

• Codex CLI docs
• AGENTS.md guide
• Codex starts encrypting sub-agent prompts

Next step

Before your next Codex run, add the handoff rule to AGENTS.md and try it on one small bug fix. If the final diff cannot be matched to the receipt and verification output, do not merge it yet.