# OpenAI Codex 加密 AI 智能体间指令，开发者无法追踪内部任务委派

- 来源：The Decoder：AI News（RSS）
- 作者：Jonathan Kemper
- 发布时间：2026-07-15 16:30
- AIHOT 分数：50
- AIHOT 链接：https://aihot.virxact.com/items/cmrlu3kpz004zbi5k9vl4p1gv
- 原文链接：https://the-decoder.com/openais-codex-now-encrypts-instructions-between-ai-agents-leaving-developers-blind-to-internal-delegation

## AI 摘要

OpenAI 的编程工具 Codex 自 6 月初起加密主智能体传递给子智能体的指令，开发者仅能看到不可读字符串，无法追踪任务如何被委派。强制加密目前影响较大的 GPT-5.6 变体 Sol 和 Terra，仅最小变体 Luna 仍使用开放路径。多名开发者报告加密交接有时因内容无法解密而失败，OpenAI 尚未解释该变更。

## 正文

Key Points

OpenAI's coding tool Codex encrypts the internal instructions exchanged between AI agents. Developers now see only unreadable strings and can no longer track how tasks get delegated.

Encryption is mandatory for the larger GPT-5.6 models Sol and Terra, but users report it sometimes causes failed handoffs.

OpenAI hasn't explained the change. Developers suspect it's either a basic privacy measure or an attempt to stop rivals from using the internal communication to train their own models.

OpenAI's Codex now hides what its AI agents tell each other. Developers can no longer see how tasks get delegated internally.

Since early June, OpenAI's coding tool Codex has encrypted the instructions a main agent passes to its subagents. Coding tools are increasingly turning into agentic systems that break down tasks, delegate parts to subagents, and make autonomous decisions in the background. That makes it all the more important whether users can still track these internal processes.

Since the change, the session history shows an unreadable string instead of a readable task description. Developers can no longer check what their agent delegates to each subagent. A bug report on GitHub calls this out directly, asking OpenAI to store a readable copy of the task locally alongside the encrypted version.

For a while, GPT-5.5 wouldn't even let developers turn off encryption using the dedicated toggle, cutting off visibility entirely. OpenAI has apparently since switched GPT-5.5 back to the readable path. The forced encryption now hits the larger GPT-5.6 variants, Sol and Terra. Only the smallest variant, Luna, still uses the open path.

The new system also appears unreliable. Several developers say the encrypted handoff to a subagent fails because the content can't be decrypted. In some cases, this happens even when the main agent and subagent use the same model.

The encryption may block distillation, but privacy could be the simpler reason

OpenAI hasn't explained why it encrypts communication between agents. Only the change itself has been confirmed.

Community members suspect the company treats these prompts like raw reasoning traces and wants to stop rivals from training on them. The suspicion isn't far-fetched. Zhipu AI's open GLM-5.2 model was recently suspected of having been distilled from GPT-5.5 and Opus 4.8. Agent-to-agent communication is valuable training data that can help lift a weaker model toward a stronger one's level. Encrypting it would keep that material out of competitors' hands.

A simpler reason is just as plausible. OpenAI's API already encrypts intermediate states so they can be forwarded in follow-up requests without storing plaintext on its servers. We're still waiting for OpenAI to confirm whether the change is about distillation protection, data privacy, or both.