OpenAI Codex 加密 AI 智能体间指令，开发者无法追踪内部任务委派

OpenAI 的编程工具 Codex 自 6 月初起加密主智能体传递给子智能体的指令，开发者仅能看到不可读字符串，无法追踪任务如何被委派。

强制加密目前影响较大的 GPT-5.6 变体 Sol 和 Terra，仅最小变体 Luna 仍使用开放路径。

多名开发者报告加密交接有时因内容无法解密而失败，OpenAI 尚未解释该变更。

OpenAI's Codex now hides what its AI agents tell each other. Developers can no longer see how tasks get delegated internally.

Since early June, OpenAI's coding tool Codex has encrypted the instructions a main agent passes to its subagents. Coding tools are increasingly turning into agentic systems：https://the-decoder.com/frontier-radar-1-from-chatbots-to-problem-solvers-the-state-of-ai-agents-in-2026/ that break down tasks, delegate parts to subagents, and make autonomous decisions in the background. That makes it all the more important：https://the-decoder.com/americans-are-using-ai-more-than-ever-while-trusting-it-less-new-quinnipiac-poll-finds/ whether users can still track these internal processes.

Since the change, the session history shows an unreadable string instead of a readable task description. Developers can no longer check what their agent delegates to each subagent. A bug report on GitHub：https://github.com/openai/codex/issues/28058 calls this out directly, asking OpenAI to store a readable copy of the task locally alongside the encrypted version. Ad

For a while, GPT-5.5 wouldn't even let developers turn off encryption using the dedicated toggle：https://github.com/openai/codex/issues/31097, cutting off visibility entirely. OpenAI has apparently since switched GPT-5.5 back to the readable path. The forced encryption now hits the larger GPT-5.6 variants, Sol and Terra：https://the-decoder.com/openais-gpt-5-6-sol-autonomously-post-trained-the-smaller-luna-model-with-a-fairly-underspecified-prompt/. Only the smallest variant, Luna, still uses the open path. Ad DEC_D_Incontent-1

The new system also appears unreliable. Several developers say the encrypted handoff to a subagent fails because the content can't be decrypted. In some cases, this happens even when the main agent and subagent use the same model.

OpenAI hasn't explained why it encrypts communication between agents. Only the change itself has been confirmed. Ad

Community members：https://news.ycombinator.com/item?id=48905028 suspect the company treats these prompts like raw reasoning traces and wants to stop rivals from training on them. The suspicion isn't far-fetched. Zhipu AI's open GLM-5.2 model：https://the-decoder.com/zhipu-ais-glm-5-2-closes-in-on-closed-source-leaders-in-coding-marathons/ was recently suspected of having been distilled：https://www.graphistry.com/blog/glm-5-2-cybersecurity-open-model from GPT-5.5：https://the-decoder.com/openai-unveils-gpt-5-5-claims-a-new-class-of-intelligence-at-double-the-api-price/ and Opus 4.8：https://the-decoder.com/anthropic-ships-claude-opus-4-8-as-a-modest-but-tangible-improvement-that-tops-gpt-5-5-in-most-benchmarks/. Agent-to-agent communication is valuable training data that can help lift a weaker model toward a stronger one's level. Encrypting it would keep that material out of competitors' hands.

Stay in the loop on AI. Clear, useful, no fluff.

Follow The Decoder for AI news, background stories and expert analyses.

The Decoder：https://the-decoder.com/