Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex starts encrypting sub-agent prompts

github.com

Post reply on HN
Print view View original

81–90 of 272 posts

Re: Codex starts encrypting sub-agent prompts

#81

Post by embedding-shape »

resonious wrote: post #72
embedding-shape wrote: post #65

Earlier quoted context omitted.

Sol and Terra seems specifically post-trained to handle multi-agent orchestration, I'm guessing OpenAI feels like the trained data of when to do the spawning and what context to include for the new sub-agent is the magic in their new models, so that's what they're aiming to preserve. But, this is all a guess of course.

Right I saw them saying something along the lines of "they're good at subagents". But this seems true even with third party harnesses. So I'm wondering what Codex is hiding.

The only thing I've found impacting this, is when you specifically use the "Ultra" thinking/reasoning effort, then codex adds a small part to the system prompt to further get the model to use sub-agents. Any other reasoning/thinking effort than "Ultra" and this piece is no longer in the system prompt.

Seemingly mostly a prompting thing it seems on the surface. GPT-5.5 (and maybe even GPT-5.4) already had (experimental?) support for sub-agents, remember using it even with -spark which I think was launched together with GPT-5.4 if I remember correctly, so this whole "use sub-agents" stuff most have been part of the training data for quite some time already, but maybe they've mainly been iterating on the prompt themselves since then.

Re: Codex starts encrypting sub-agent prompts

#82

Post by jagged-chisel »

embedding-shape wrote: post #63
jagged-chisel wrote: post #56

“Starts”? How’s this not already a TLS connection?

The prompts are now encrypted, not just the transit connections...

Ok, so help me get this right: I ask the LLM for something, it generates prompts for sub-agents and sends them back to my client for it to call the sub-agents. Now, those sub-agent prompts are encrypted messages that the sub-agents will decrypt (by hitting a backend) to do their work.

Might as well just stuff the prompts in a database and only hand back the primary key to the client to hand off to the sub-agents. Keeps the same “data security” without the overhead of encryption (especially since encryption and decryption are happening in the same domain)

Re: Codex starts encrypting sub-agent prompts

#84

Post by greatgib »

They always talk about transparency and all but it never was as opaque as it is going on now.

There is no possible audit trail. No possible way to review what happened to validate the result. But even worse, no you will be billed somehow randomly. 20 sub agents started to do something we don't know. No way to now if it was legitimate, if it is just burning tokens or agents doing the same work on loop...

Re: Codex starts encrypting sub-agent prompts

#85

Post by well_ackshually »

jiayo wrote: post #80

If we're viewing this as a _bad_ thing, I don't really see that it is any different than how Claude encrypts it's thinking. Take a peek at your ~/.claude jsonl files. You're sending thinking ciphertext back and forth to Anthropic. Presumably the thinking is either considered proprietary, or, more likely, leaks embarrassing or confidential information.

Claude "encrypting" its thinking is equally bad. Biggest IP thieves in the world worried about IP theft lmao.

At least Anthropic doesn't pretend that they have open source software in the form of Claude Code.

Re: Codex starts encrypting sub-agent prompts

#86

Post by kbart »

flexagoon wrote: post #50
jimmydoe wrote: post #38

Earlier quoted context omitted.

This is the reason I think. These black markets not only pool and resell subs, but also store data and sell to whoever is training. Encryption is useful to at least stop the latter. Ultimately same purpose as a\ ‘s trick exposed earlier, but a much nicer implementation.

> but also store data and sell to whoever is training I see this as an argument against using them/Chinese models all the time, but I don't get it. I totally understand wanting to keep your data private if you're using an LLM for personal chats. But coding? I'm not working for the military, I'd gladly donate my codebase to Chinese labs if that means they can keep releasing 6-months-behind level models for 100x cheape…

How do you know that they don't train their models or append your prompts to add backdoors, or compromise your supply chain by including evil dependencies? This seems hugely irresponsible.

Re: Codex starts encrypting sub-agent prompts

#87

Post by tybit »

smalltorch wrote: post #39

Using ciphertext for inference would mean it's not a very secure ciphertext. These two ideas don't compute for me. Same thing with homomorphic encryption. I don't get it. If you can gain any knowledge from a ciphertext, you just found a way to exploit the ciphertext to me.

They’re not using ciphertext in inference. They are encrypting agent responses on their servers if it’s going to a subagent on the client. The subagent will send it back to their servers for inference. Only their servers have the keys, so they can decrypt when running inference.

Re: Codex starts encrypting sub-agent prompts

#88

Post by _flux »

smalltorch wrote: post #68
3form wrote: post #46

Earlier quoted context omitted.

The idea of homomorphic encryption is to do things without the knowledge, and not gaining the knowledge. If ciphertext contains a number, and you don't need to know what number it does to always be able to multiply it by 2, you succeeded - as a simple example.

It still just sounds like fancy obfuscation to me. I've read alot of examples trying to understand but I can't get past that being able to run processes on ciphertext in a way you can learn something doesn't make sense without me changing my definition of what I think encryption means.

I thought though the idea is that you cannot learn anything from the ciphertext, how it is processed, or what the final result is?

Unless you are a participant of the computation and you have the key, that is.

Re: Codex starts encrypting sub-agent prompts

#89

Post by embedding-shape »

jiayo wrote: post #80

If we're viewing this as a _bad_ thing, I don't really see that it is any different than how Claude encrypts it's thinking. Take a peek at your ~/.claude jsonl files. You're sending thinking ciphertext back and forth to Anthropic. Presumably the thinking is either considered proprietary, or, more likely, leaks embarrassing or confidential information.

> I don't really see that it is any different than how Claude encrypts it's thinking. Take a peek at your ~/.claude jsonl files. You're sending thinking ciphertext back and forth to Anthropic.

I was already only using Claude Code to double-check if it's getting better than Codex, but with things like this, it really isn't even an alternative. What's the point of using a reasoning model if you as an end-user can't seen the reasoning? I don't think I'd be able to work like that at all, I need to have introspection into what the model is doing, and can't believe I have to say this, but also need to be able to see the plaintext of the input prompt...

Re: Codex starts encrypting sub-agent prompts

#90

Post by alasano »

well_ackshually wrote: post #85
jiayo wrote: post #80

If we're viewing this as a _bad_ thing, I don't really see that it is any different than how Claude encrypts it's thinking. Take a peek at your ~/.claude jsonl files. You're sending thinking ciphertext back and forth to Anthropic. Presumably the thinking is either considered proprietary, or, more likely, leaks embarrassing or confidential information.

Claude "encrypting" its thinking is equally bad. Biggest IP thieves in the world worried about IP theft lmao. At least Anthropic doesn't pretend that they have open source software in the form of Claude Code.

They get to pretend to be on the best side of every position simultaneously.

They're only encrypting thinking because AI is so dangerous and only they can be trusted to be in control of AGI.

This happens to align with lining their pockets as well.

Post reply on HN