Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex starts encrypting sub-agent prompts

github.com

Post reply on HN
Print view View original

41–50 of 272 posts

Re: Codex starts encrypting sub-agent prompts

#41

Post by embedding-shape »

swingboy wrote: post #37
embedding-shape wrote: post #3

Earlier quoted context omitted.

> I wonder if they are gonna stop us from using gpt subscriptions in alternative harnesses Probably not, the whole app-server machinery is there to facilitate that thing, would be a huge piece to rip out of codex. This is basically the reason I end up using codex the most, as it's the easiest to integrate against, with the app-server's RPC API making it really trivial. Besides, most of my codex usage at this point is…

What are some of the things you’re doing with the Codex app-server?

Everything I do with codex is managed via Forgejo comments, issues and PRs basically. I have a tiny little Rust "conductor" that integrates with app-server and does things when issues/PRs are labeled, when I write comments on PR lines and so on, and those interactions all fire of Codex sessions that are run via Codex's app-server and lead to different outcomes.

Beats having to parse output from CLI-runs and so on. Initially this environment was running aider (which feels like years ago), was running Claude (parsing stdout) at one point but using Codex's app-server since some weeks/months back and is a lot simpler implemented now.

Re: Codex starts encrypting sub-agent prompts

#42

Post by iknownothow »

embedding-shape wrote: post #30
iknownothow wrote: post #23

Could someone explain to me where exactly the encryption is happening? I assumed that the main agent makes calls to sub-agents locally. Does Codex work in such a way where the main agent makes calls to sub-agents in the backend (openai server) before reaching local?

Sure. "Traditionally", your agent would send a text prompt to the sub-agent, then it goes off doing it's work. In the logs/session data, the clear-text prompt would be there, so if I want to see what's happening, I just browse the data. It's all just clear-text prompts being sent everywhere, even when you were using the experimental "sub-agents" stuff in Codex, before Sol et al was available. Now, when using Sol or T…

Gotcha and thank you! So the encryption is happening on the OpenAI backend and the agent's clear-text output designated to the sub-agent never reaches local.

Which is a real problem since you can't intercept/monkey patch the ciphertext to decrypt it locally to be able see the clear-text since we don't have the encryption key/algo/salt. No hacking :(

Re: Codex starts encrypting sub-agent prompts

#43

Post by fortuitous-frog »

No normative opinion on whether this is justified or not, but noting that this is only for parent -> subagent spawns/messages, and only for the `multi_agent_v2` feature (currently experimental / off by default).

Notably, subagent output is still in plaintext.

EDIT: Title was now clarified. But wanted to expand that this is actually enabled for 5.6 Ultra it appears, which does subagent orchestration more natively in the API rather than direct tool calls; they are beginning to treat subagents as similar to chain-of-thought traces (already encrypted) rather than traditional tool calls.

Re: Codex starts encrypting sub-agent prompts

#44

Post by [deleted] »

embedding-shape wrote: post #32
xnorswap wrote: post #28

HN Title is ( edit: was ) very misleading, it makes it sound like inference is being done directly on ciphertext, which would require homomorphic encryption well advanced of what is known.

It is not misleading, quite literally what's happening is that content the agent sends sub-agents is encrypted in such a way that only OpenAIs backend can decrypt it and actually see the clear-text. Just shared this is another comment that hopefully explains things better: > Sure. "Traditionally", your agent would send a text prompt to the sub-agent, then it goes off doing it's work. In the logs/session data, the cle…

[deleted]

Re: Codex starts encrypting sub-agent prompts

#45

Post by embedding-shape »

pshirshov wrote: post #21
alansaber wrote: post #10

Earlier quoted context omitted.

"remarkably unremarkable harness" is why I like it so much.

I don't, feel better with Pi with a custom set of extensions.

Personally I use both, pi serves as a "personal assistant" with lots of extensions and changes made for those things specifically, and codex is for anything related to coding itself.

Re: Codex starts encrypting sub-agent prompts

#46

Post by 3form »

smalltorch wrote: post #39

Using ciphertext for inference would mean it's not a very secure ciphertext. These two ideas don't compute for me. Same thing with homomorphic encryption. I don't get it. If you can gain any knowledge from a ciphertext, you just found a way to exploit the ciphertext to me.

The idea of homomorphic encryption is to do things without the knowledge, and not gaining the knowledge. If ciphertext contains a number, and you don't need to know what number it does to always be able to multiply it by 2, you succeeded - as a simple example.

Re: Codex starts encrypting sub-agent prompts

#48

Post by ebiederm »

embedding-shape wrote: post #32
xnorswap wrote: post #28

HN Title is ( edit: was ) very misleading, it makes it sound like inference is being done directly on ciphertext, which would require homomorphic encryption well advanced of what is known.

It is not misleading, quite literally what's happening is that content the agent sends sub-agents is encrypted in such a way that only OpenAIs backend can decrypt it and actually see the clear-text. Just shared this is another comment that hopefully explains things better: > Sure. "Traditionally", your agent would send a text prompt to the sub-agent, then it goes off doing it's work. In the logs/session data, the cle…

I would change

"Codex starts encrypting prompts, uses ciphertext for inference instead"

to just

"Codex starts encrypting prompts"

That is enough.

Maybe you could say sub agent prompts. The article can say the rest.

Re: Codex starts encrypting sub-agent prompts

#49

Post by LoganDark »

fortuitous-frog wrote: post #35
LoganDark wrote: post #24

Earlier quoted context omitted.

I'd be all for homomorphic encryption on inference, but as you say, this is probably mostly to prevent end users from observing intermediate results.

Homomorphic encryption for LLMs is extremely expensive and nowhere near computationally possible for the scale of current LLMs.

When I say things like that, I'm talking about a hypothetical version that would be computationally possible. I'm not talking about today's homomorphic encryption.

Re: Codex starts encrypting sub-agent prompts

#50

Post by flexagoon »

jimmydoe wrote: post #38
flexagoon wrote: post #13

Ah I was wondering why the Chinese black market resellers stopped working yesterday, I guess that's it

This is the reason I think. These black markets not only pool and resell subs, but also store data and sell to whoever is training. Encryption is useful to at least stop the latter. Ultimately same purpose as a\ ‘s trick exposed earlier, but a much nicer implementation.

> but also store data and sell to whoever is training

I see this as an argument against using them/Chinese models all the time, but I don't get it. I totally understand wanting to keep your data private if you're using an LLM for personal chats. But coding? I'm not working for the military, I'd gladly donate my codebase to Chinese labs if that means they can keep releasing 6-months-behind level models for 100x cheaper.

(I understand why OpenAI doesn't want this and would implement protections. I'm talking about people using this as an argument for why you as an end user shouldn't use those services.)

Post reply on HN