edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"

This is a really interesting engineering decision, I wonder how many people will want an encrypted external piece of instructions running on their machine.

With chat completion, the reasoning process is entirely under your control. You can build a reasoning agent that uses custom MCTS techniques with GPT5.6 models today if you are willing to get your hands just a little bit dirty. You have to enable experimental flags and set options in slightly confusing ways, but it still works.

You can use models up to gpt5.5 with custom API tokens and model configuration in VS Copilot. gpt5.6 family (currently) no longer work in this setup. Presumably, because we aren't explicitly forcing reasoning_effort to none to satisfy the new moat expansion behavior.

I wonder if there was any safeguard failure due to loss of visibility into what the sub-agent was trying to do?

https://x.com/mattshumer_/status/2076794038456385546?s=20

I assumed that the main agent makes calls to sub-agents locally. Does Codex work in such a way where the main agent makes calls to sub-agents in the backend (openai server) before reaching local?

I guess "helped make Skynet auditable" may become my most popular open-source contribution, so I'm putting it on my CV.

The thing is that the subagent prompts already pass through the client - they have to, since the TUI can switch between subagents while they work. The change is just to save a copy of the prompt on disk while keeping the encrypted delivery path if necessary for Responses API.

Personally, I use multi_agent_v1 anyways (doesn't have this issue), since v2 is unstable and is a token burner.

Hope they address it so I don't have to keep maintaining it in my fork

Now one reason I could see for why they do this is because maybe they made the model "better at using subagents" by using thinking tokens for the subagent prompt instead of normal output tokens.

Then pay a made up price that gets the big labs out of debt.

Specifically, I use Opus and others for subagent execution to get alloyed properties on the workflow, and as far as I can tell, that's not affected.

Presumably, this is to hide optimizations they might be making to their own subagent processing, but that's a losing, dumb battle to fight, and misses the forest for the trees.

Inference is still done in plaintext after this multi-agent message gets decrypted in the server side

The only way these AI labs can get the app layer lock-in they need is if they can get customers used to writing them a blank check: “here, take my data and my system, do ‘stuff’ and bill me for it.”

Between this and the recent Grok upload breach, I consider these products radioactive.

If desired the user can always see what the sub agent is doing in detail ?

Isn't it the same in case of claude as well ?

Notably, subagent output is still in plaintext.

EDIT: Title was now clarified. But wanted to expand that this is actually enabled for 5.6 Ultra it appears, which does subagent orchestration more natively in the API rather than direct tool calls; they are beginning to treat subagents as similar to chain-of-thought traces (already encrypted) rather than traditional tool calls.

There is no possible audit trail. No possible way to review what happened to validate the result. But even worse, no you will be billed somehow randomly. 20 sub agents started to do something we don't know. No way to now if it was legitimate, if it is just burning tokens or agents doing the same work on loop...

[0]: https://news.ycombinator.com/item?id=47652807

The clock is ticking. People pretending that normal people can't afford to do AI at home, in private, are making the argument that cars are too expensive for normal people to own. Pretty sure right now if you spend $25K, you would be able (if there were no technical hurdles) to set up a private rig that would satisfy your family's need for LLM assistance for the foreseeable future. That's a budget-priced car, and the price is only going to go down (i.e. that rig will become more powerful over time.) If all of those people donated some of their cycles and bandwidth to a networked training grid, the models would stay current.

The "open source" infrastructure for that is lacking, but not for long.

These companies own nothing that couldn't be implemented by a specialist after another specialist explained it to them over a phone call. And due to the nature of LLMs, they can't even use copyrights and patents as weapons. The only options are secrecy and government protection. And secrecy is only a delaying tactic.

These two ideas don't compute for me.

Same thing with homomorphic encryption. I don't get it. If you can gain any knowledge from a ciphertext, you just found a way to exploit the ciphertext to me.

Edit: F really misunderstood the change, the title is misleading AF. I should have read the post before commenting lmao.

Absolutely hate it, now I guess... sigh..

Incase the title gets changed it used to say, "Codex starts encrypting prompts, uses ciphertext for inference instead"