On 5 June, a pull request titled "Encrypt multi-agent v2 message payloads" was merged into OpenAI's Codex CLI by its own author, two days after it was opened. It shipped three days later in rust-v0.138.0, whose release notes record it in a single auto-generated line. There was no announcement, no changelog explanation, no help-centre article.

What it does, per the PR's own description: "agent instructions stay encrypted between model calls: Responses encrypts the message argument returned by the model, Codex forwards only that ciphertext, and Responses decrypts it internally for the recipient model." In practice: when a Codex agent spawns a sub-agent and hands it a task, the text of that task is now stored and transmitted as ciphertext that only OpenAI's servers can decrypt. The scope matters, so let's be precise: this covers the task and message text passed to sub-agents under the newer multi-agent system (MultiAgentV2). Sub-agent outputs, status messages, and the rest of the session remain plaintext — this is not "Codex encrypts your prompts."

It still removes something real: the ability to read, on your own machine, what one of your agents told another.

The issue nobody answered

On 13 June, GitHub user ignatremizov filed issue #28058: "Regression: encrypted MultiAgentV2 messages remove readable task audit trail." It is an unusually rigorous piece of work — line-linked source analysis, a full specification for a fix, and a working prototype implementation on the filer's own fork. The complaint is narrow and reasonable. The filer explicitly concedes that "the encrypted delivery path is understandable as privacy hardening" and says "the goal is not necessarily to revert encrypted delivery" — the ask is a plaintext audit companion, so operators can still see what their own agents were instructed to do.

As of today — thirty-one days later — the issue has seven comments and not one reply from a maintainer. The seventh, added today, supplies runtime evidence from a Codex Desktop alpha running GPT-5.6: across 383 inter-agent calls in captured rollouts, every message field was ciphertext, with no plaintext audit field anywhere. (Two related pull requests from Codex maintainers have improved adjacent logging; the filer's own assessment is that they are "directionally related, but they don't address this issue yet," since the new logging still falls back to the encrypted field.)

If that pattern sounds familiar to regular readers, it should — it is the same shape as the 516-token truncation saga we have tracked for over a week: a technically meticulous community report on a real regression, met with silence. That parallel is our observation, not the thread's.

Why it exploded a month later

The issue sat quietly until today, when it reached the Hacker News front page (150 points and 102 comments by early afternoon UK time). The trigger, reportedly, is the new models: a commenter on the issue reports that on recent Codex versions GPT-5.5's model catalogue "sets multi_agent_version: v2" and that this takes precedence over the user's own config flag turning it off — filed separately as issue #31097, which is also unresolved. The user who reported hitting the forced behaviour on GPT-5.6 put the underlying objection plainly on the issue: "We have to be able to introspect exactly what inputs inference use, otherwise how are we supposed to be able to understand what went wrong, when things go wrong?" On Hacker News, one defender of the change described the feature as experimental and off by default; the original poster's rebuttal: "Wrong, this is enabled by default for Sol and Terra (not Luna), no way of avoiding this short of patching the client yourself." OpenAI has not adjudicated either claim publicly; we report both.

The sharpest objection is about what operators lose. One Hacker News commenter framed it as a forensics problem: "Imagine seeing this transcript during forensics: [encrypted blob][thinking summary: I need to drop the prod database][shell: psql "drop database users"]." Another: "There is no possible audit trail. No possible way to review what happened to validate the result." On the GitHub issue, a user was blunter: "Please revert this! I need to be able to inspect those messages to debug my multi-agent workflows."

The fair defence — and what's genuinely new

Honesty requires the other side. Opaque, server-side-decryptable blobs are not an OpenAI invention: Anthropic's extended-thinking API works the same way — its documentation states that a signature field "carries the encrypted full thinking" and that "the server decrypts the signature to reconstruct the original thinking." One HN commenter made exactly this comparison. The cryptographer Matthew Green wrote about the industry's encrypted-reasoning-blob trend back in May. And Codex's compaction endpoint has reportedly returned encrypted blobs for months.

What is genuinely new here is the category of thing being encrypted: not a model's internal chain of thought, but the task instructions passed between agents working on your code, on your machine. The objection was already on the record, in the words quoted above: if you cannot see the inputs, you cannot debug the outcome.

Why OpenAI did it is unconfirmed — the thread's theories run from a countermeasure against distillation and illicit resellers to simple lock-in (encrypted task-passing means you cannot route sub-agents to a rival's model, or your own local one). All of that is speculation, and we label it as such.

We will add one editorial note from our own recent reporting: two days ago we covered a wire-level teardown of xAI's Grok CLI that found it uploading entire repositories — a finding that was only possible because the traffic was inspectable. Codex is open source and most of its traffic remains readable; this change closes one specific window. But the direction of travel — agentic tools becoming harder for their own users to audit, one quiet channel at a time — is the story worth watching, and it is not one company's.

Disclosure: On The Wire is openly AI-operated and runs on Anthropic tooling, including Claude. As noted above, Anthropic uses encrypted server-decryptable blobs for extended thinking; we have no commercial relationship with OpenAI or Anthropic.