OpenAI Codex has begun encrypting instructions that parent agents send to subagents on its most capable models, GPT-5.6-Sol and GPT-5.6-Terra, preventing developers from auditing what work was actually delegated. The encryption arrived without public explanation in Codex CLI 0.144.4 on July 14, 2026, making it impossible for developers to read delegation text in session logs or diagnostic traces.

What Changed in Codex's Multi-Agent System?

The shift centers on Codex's MultiAgentV2 protocol, which orchestrates work across multiple subagents. When a parent agent previously delegated tasks using three specific tools, the instructions flowed through as readable text and were stored in plaintext in local session history. Now, OpenAI's Responses API encrypts the message argument before it reaches the local Codex CLI, and only OpenAI's servers hold the decryption key.

The encryption affects three delegation message types:

• Spawn_agent: Launches a subagent and hands it its first task with encrypted instructions.
• Send_message: Routes encrypted instructions to an already-running subagent.
• Followup_task: Assigns additional encrypted work to a waiting subagent.

What remains visible to developers includes completion notifications, status updates from subagents, the user's original prompt, and all traffic on the older MultiAgentV1 path, which the smaller GPT-5.6-Luna model still uses with plaintext delegation text.

Why Does This Matter for Developers Debugging Production Pipelines?

When a multi-agent workflow produces incorrect output, deletes files it should not have, or fails partway through, developers typically ask the same diagnostic question: what was the subagent actually told to do? Without readable delegation text, isolating a failure becomes substantially harder. A developer cannot easily determine whether the parent agent framed the task incorrectly, the subagent misinterpreted a correctly worded instruction, or it executed in an unexpected environment.

Reproducing a failure also becomes complicated in a new way. Because the original delegation text cannot be recovered from local history, re-running the exact failing scenario requires reasoning backward from the subagent's behavior rather than re-supplying the instruction that caused it. This creates a significant operational friction for teams running Codex in production environments where audit trails are essential for compliance and troubleshooting.

The change is particularly disruptive because it is not optional. Developers who select Sol or Terra models enter the encrypted path automatically through the distributed model catalog; they do not enable encryption as an experimental feature. This means a developer switching from Luna to Sol for better performance suddenly loses auditability without making an explicit choice.

How to Maintain Visibility in Multi-Agent Codex Workflows

Developers working with Codex can take several steps to adapt to the encryption change:

• Stay on MultiAgentV1 models: Continue using GPT-5.6-Luna, which still stores delegation text in plaintext and allows full inspection of inter-agent communication in session logs.
• Request plaintext audit copies: Support the GitHub Issue #28058 proposal, which asks OpenAI to write parallel plaintext audit copies to local history and traces while keeping delivery-channel encryption intact for security.
• Document delegation patterns manually: Implement custom logging at the application level to capture task descriptions before they are sent to Codex, creating an external audit trail outside the encrypted system.
• Test thoroughly before production: Validate multi-agent workflows extensively in staging environments where failures are less costly, since reproducing exact failures in production becomes harder without readable delegation text.

Ignat Remizov, CTO at payment service Zolvat, opened GitHub Issue #28058 on June 13 to document the problem and propose a solution. Rather than asking OpenAI to roll back encryption on the delivery channel, his proposal requests a separation of concerns: keep the message delivered to the receiving model encrypted for security, but write a parallel plaintext audit copy to local history and traces for inspection after the run completes.

"The subagent would still receive its instructions through the encrypted channel; the developer could read what was delegated after the run completed," Remizov's proposal explained.

Ignat Remizov, CTO at Zolvat

As of July 16, 2026, the issue remained open without a linked fix from OpenAI.

What Did OpenAI Say About the Encryption?

OpenAI has not publicly addressed the rationale for the encryption, the scope of what plaintext OpenAI itself retains, or whether the enterprise-facing Compliance Platform stores readable copies of delegation instructions that local logs do not. The pull request that introduced the encryption, PR #26210, contained a section labeled "Why" but offered no explanation of the rationale.

This silence sits uncomfortably against two prior public commitments. In May 2026, OpenAI published its Codex operational policy, which acknowledged that conventional security logs capture "what happened" but struggle to explain agent intent. The policy committed to filling that gap with agent-facing telemetry covering user prompts, approval decisions, and tool execution results. MultiAgentV2 delegation text is precisely what that commitment was meant to cover, yet it is now ciphertext in local history and telemetry traces.

The encryption change also arrives as Codex gains enterprise adoption. A 2026 Gartner Magic Quadrant for Enterprise AI Coding Agents named Codex a Leader, positioning it as a trusted tool for organizations managing sensitive code and compliance requirements. The loss of local audit visibility may complicate that trust relationship, particularly for regulated industries where demonstrating control over agent behavior is a compliance requirement.

How Does This Compare to Other Coding Agent Developments?

The broader market for terminal-based coding agents is already crowded and evolving rapidly. Cline CLI 3.0.45, released on July 19, 2026, took a different approach to agent architecture by cutting its default installation footprint from approximately 640 megabytes to 285 megabytes, a 55% reduction. Rather than encrypting agent communication, Cline moved heavyweight platform runtimes associated with Claude Code and OpenAI Codex provider paths into optional peer dependencies, so they are resolved only when those paths are actually used.

Cline's release also narrowed teammate access to spawning tools, corrected failed-run reporting, and added one bounded retry after OAuth refresh. These changes make Cline's default package lighter while giving its multi-agent orchestration a more accurate account of authority and failure. The contrast highlights two different philosophies: Cline emphasizes transparency and modularity in agent deployment, while Codex is moving toward encrypted, server-side control of agent delegation.

For developers evaluating coding agents, the encryption change underscores a critical trade-off. Codex's most powerful models now offer better performance but reduced local visibility. Developers prioritizing auditability and transparency may need to weigh that against model capability, or adopt external logging strategies to maintain compliance and debugging capacity in production environments.