OpenAI Codex Encrypts Agent Instructions, Stripping Developers of Audit Access Codex openai.com Since July 14, developers running Codex on its most capable models — GPT-5.6-Sol and GPT-5.6-Terra — can no longer read what their parent agents told their subagents to do. The instructions are encrypte...
OpenAI Codex Encrypts Agent Instructions, Stripping Developers of Audit Access
Codex openai.com
Since July 14, developers running Codex on its most capable models — GPT-5.6-Sol and GPT-5.6-Terra — can no longer read what their parent agents told their subagents to do. The instructions are encrypted before they ever reach local storage, and only OpenAI's servers hold the key. What was once an inspectable task description in a session log is now ciphertext, leaving developers with evidence that a delegation happened but no record of what was delegated.
The change arrived silently, without a public explanation, in pull request #26210, merged on June 5, 2026. It became unavoidable when Codex CLI 0.144.4 shipped on July 14, bundling a model catalog that specified Sol and Terra as mandatory MultiAgentV2 users— meaning developers who choose those models get the encrypted path whether they want it or not.
For developers building production pipelines on Codex, the practical question is now: when something goes wrong inside a multi-agent workflow, how do you diagnose it?
Read more: OpenAI Codex Remote Goes Live for All Plans: Phone Control Now Secured by QR Relay
Read more: OpenAI Codex Computer Use Now on Windows: Foreground Takeover, Europe Excluded
The component at the center of this change is Codex's MultiAgentV2 protocol — the newer orchestration layer that lets the runtime, rather than user-declared configuration, decide how to allocate work across subagents. MultiAgentV2 controls three specific kinds of delegation messages:`spawn_a
The instructions are encrypted before they ever reach local storage, and only OpenAI's servers hold the key.
What was once an inspectable task description in a session log is now ciphertext, leaving developers with evidence that a delegation happened but no record of what was delegated.
The change arrived silently, without a public explanation, in pull request 26210, merged on June 5, 2026.
Continue reading
