On June 5, 2026, OpenAI merged a change into the open-source Codex repository. After the change landed, if you look back at the session logs Codex keeps locally, a critical piece of information will be missing. The before-and-after picture is stark.
Before the update, when the parent agent dispatched a task to a sub-agent, you could see the specific instruction in the local log:
{"message":"Review the authentication changes and report regressions."}After the update, that same instruction appears locally as nothing but ciphertext:
{"message":"<ciphertext>"}The sub-agent still receives the plaintext task in the cloud and carries it out. What you lose is the ability to look back and read that instruction: the local log no longer tells you what the parent agent actually told it to do.
The trouble surfaces during debugging. Codex reads and writes files on your machine, runs terminal commands, and saves execution logs locally. If the sub-agent later does something wrong, you first need to distinguish: did the parent agent assign the wrong task, or did the sub-agent misinterpret a correct one? That is exactly the question the developer is chasing in GitHub issue #28058.
Codex was never fully transparent. But the task text the parent agent sent to the sub-agent used to be at least visible, and now it is not. The local CLI, SDK, and App Server remain open source — the scope is detailed in the official documentation — but the open-source client is no longer sufficient to reconstruct this part of the full task chain.
When faced with a complex programming task, the parent agent often breaks the work apart and spawns several sub-agents to handle different pieces in parallel. One might revise the interface definition, another might fill in the unit tests, and the parent agent assembles the results afterward.
In the past, these task messages were stored in plaintext in the local session. GitHub issue #25458 contains an early log where the task parameters can be read directly. During debugging, you could at least see the exact instruction each sub-agent received.
The encryption
PR #26210, merged on June 5, changed how MultiAgentV2 transmits
these messages. The task text inside spawn_agent,
send_message, and followup_task is no longer
handed to the local client in plaintext; instead, it is replaced by
ciphertext generated through the Responses API.
The encryption touches only these task messages. It does not hide the sub-agent’s entire execution. You can still see what tools it called, what commands it ran, what output it produced, what code it changed, and what result it finally returned. The PR also explicitly preserves MultiAgentV1, leaving the old channel untouched.
Where does this ciphertext come from? When the parent agent dispatches a task through the Responses API, the API encrypts the task text in the cloud first, then sends the ciphertext to the local Codex.
Codex does not decrypt it upon receipt; it merely stores it. When it later launches the sub-agent, the client sends that same ciphertext back to the Responses API verbatim. The cloud decrypts it there and hands the plaintext task to the sub-agent. The current open-source client has no path to recover the plaintext, so when you examine the local log, all you see is that ciphertext.
Another code change makes this even clearer. The developers explicitly committed “Clear encrypted agent task previews”, which removes the preview for encrypted tasks. In other words, the local plaintext isn’t visible because the feature was designed out of the code, not because the UI happened to hide it.
OpenAI did not explain why this was done in the PR. Several external theories have circulated: perhaps it is to protect the prompts used for task decomposition and orchestration, perhaps to avoid exposing something akin to a chain of thought, or perhaps it relates to message integrity or unification of the cloud-side multi-agent service. These are only guesses. What is certain now is that local debugging has lost a clue that used to be readable.
This is not the first time Codex has kept part of its state in the cloud. Before the model produces a visible answer, it generates reasoning, and that content arrives locally as ciphertext. You can see the final answer, but you cannot read from the log what it thought through in between. OpenAI documented this practice in the reasoning handbook published on May 11, 2025.
Long conversations carry another invisible piece of state. When a
session approaches the context limit, the cloud compresses earlier
content into an encrypted_content ciphertext block. Codex
does not know what that block specifically preserves; it just forwards
it back verbatim in the next request. OpenAI described this mechanism as
compaction in its technical
article dissecting the Codex agent loop.
So the pattern of “the cloud can read it, the local client only forwards it” did not start this time. The difference is that what was previously invisible was mainly reasoning and compacted session state; ordinary user messages, tool parameters, terminal commands, execution results, and tasks dispatched between agents were mostly still findable in the local log.
Reasoning, compaction, and this new task encryption follow a similar technical path: the cloud generates some state, the local side receives ciphertext, and it sends that ciphertext back to the cloud. But what they hide is not the same thing.
Reasoning records how the model itself arrived at an answer. A task the parent agent sends to the sub-agent tells another agent what to do next. The former stays within a single model’s internals; the latter sets another executor into action.
This distinction becomes very practical during debugging. Suppose a sub-agent deletes a file it shouldn’t have, or runs an incorrect command. You need to know whether it acted on a wrong task instruction, or whether it received the correct task and made a mistake on its own.
You can still see when the sub-agent was created. You can still see what commands it later ran, what files it modified. But the one sentence in between — “here is what you should do” — is now nothing but ciphertext. As a result, both a human and a local audit tool lose a critical piece of evidence, and there is no way to check whether the delegation itself was reasonable before the command gets executed.
If you look at these changes together, the direction is clear. Codex never displayed reasoning or the contents of compaction; now MultiAgentV2 has extended the opaque zone to task messages between agents.
This does not mean the open-source parts of Codex have lost their value. The CLI, SDK, and App Server remain public, and local tool calls, commands, output, and code changes remain inspectable. But what the open-source client can show you increasingly diverges from everything the agent system actually goes through.
The question that really needs asking is: is a piece of hidden content merely helping a model think, or is it already directing another agent to act? As sub-agents proliferate and task chains grow longer, these two categories of information can no longer be brushed past with the same “internal state” boundary. How far we can audit will increasingly depend on what the service provider is willing to let the local side see.