OpenAI has quietly flipped a switch that makes the internal chatter between Codex’s AI agents invisible to the humans who deploy them. Since early June, the coding tool encrypts the instructions a main agent passes to its subagents, replacing readable task descriptions in the session history with an unreadable string. For developers accustomed to tracking exactly how their autonomous systems break down and delegate work, the change feels less like an upgrade and more like having the hood welded shut.
The forced encryption currently targets the larger GPT-5.6 variants, Sol and Terra, after a brief stint on GPT-5.5 that was apparently rolled back. Only the smallest model, Luna, still shows developers the open, legible path. A GitHub bug report captures the frustration, asking OpenAI to at least store a readable local copy of each task alongside the encrypted version. It’s a reasonable request when you consider that these agentic coding systems are making more autonomous decisions in the background, and losing that audit trail means you can’t debug delegation failures.
And failures are happening. Several developers report encrypted handoffs that simply fall apart because the content can’t be decrypted, sometimes even when the main agent and subagent are running the same model. OpenAI hasn’t offered an explanation. The company confirmed only the change itself, leaving the community to fill in the blanks. The leading theory? This is a moat around valuable training data. Agent-to-agent communication is a goldmine for distillation — Zhipu AI’s open GLM-5.2 model was recently suspected of being trained on outputs from GPT-5.5 and Opus 4.8 — and encrypting those traces keeps rivals from boosting their own models on OpenAI’s dime.
But a simpler reason is just as likely. OpenAI’s API already encrypts intermediate states so they can be forwarded in follow-up requests without storing plaintext on its servers. This could be a privacy play, not a competitive one. Until OpenAI clarifies, developers working with Sol and Terra are coding blind, trusting that their agents are delegating intelligently while staring at a log full of cryptographic noise. The opacity rankles not because it’s malicious, but because it’s unexplained — and for a tool that increasingly acts on its own, visibility into its thinking was the only real seatbelt developers had.
