Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex starts encrypting sub-agent prompts

github.com

Post reply on HN
Print view View original

191–200 of 272 posts

Re: Codex starts encrypting sub-agent prompts

#191

Post by embedding-shape »

aeon_ai wrote: post #181
embedding-shape wrote: post #160

Earlier quoted context omitted.

> this is not happening for sub-agent requests made in my own harness to other model providers treated as sub-agents. Obviously it doesn't, how even could it? Read the issue description, it wouldn't make sense if something like that was possible, considering how it was implemented...

Raising only because others cited concerns this might cause issues in personal harness contexts. It doesn't. Obviously , I wasn't claiming that it would WORK for cross-model subagents, but that this would be a limiting behavior requiring use of the Codex harness to operate if this was paired with model-level limitations on using specific tools to spawn sub-agents. Or maybe not so obvious to you.

> Raising only because others cited concerns this might cause issues in personal harness contexts. It doesn't.

It literally cannot.

> Obviously, I wasn't claiming that it would WORK for cross-model subagents

I know, but you were questioning (before investigating) if maybe it did, which I'm saying should have been obvious it wouldn't, if you had understand how this was encrypted.

> requiring use of the Codex harness to operate

Yes, if you want to use Sol + Ultra + sub-agents, you'd need to use the endpoints provided by OpenAI, as (again), the content is encrypted on OpenAI's side, it's not technically possible for other platforms to implement OpenAI's encryption.

And of course this doesn't impact anyone else not using Codex + Sol + Ultra + launching subagents, it's the specific combination that is "protected", not the individual pieces.

Re: Codex starts encrypting sub-agent prompts

#192

Post by bobthebob »

b40d-48b2-979e wrote: post #188
airstrike wrote: post #175

Earlier quoted context omitted.

idk about you but I'd rather not be murdered regardless of who the perpetrator might be

That is not the argument being made and this interpretation feels entirely in bad faith akin to the other sibling comments.

Maybe to you, it resonates with me.

Re: Codex starts encrypting sub-agent prompts

#194

Post by embedding-shape »

realusername wrote: post #190
embedding-shape wrote: post #183

Earlier quoted context omitted.

> I don't think the difference between both really justifies the wide gap in pricing I'd be ecstatic if this was true, but nothing so far comes close to the SOTA models from OpenAI + highest reasoning, but I'd be more than happy to be proven wrong by testing it out myself. So far, I've tried MiniMax M3, GLM 5.2, Hy3, MiMo-V2.5 (+ Pro), DeepSeek V4 Pro (+ Flash), Gemini 3, Kimi K2.6, GLM 5, all the various Qwen varian…

I'm using Kimi 2.7 and GPT 5.5 at home, Opus (4.8 I think) at work and I really don't see much difference honestly. Sure, Claude might be 90% correct and Kimi only 70% correct but does that matter when 90% isn't enough to make it work autonomously anyways? My workflow is just strict supervision of what's happening, I also edit the agents file with anything I see the model doing that I don't like. My sessions are also…

> Sure, Claude might be 90% correct and Kimi only 70% correct but does that matter when 90% isn't enough to make it work autonomously?

Huuh, what does this mean? GPT models frequently do 100% of what I tell them to do, anything less and I'd see no point in using agents for work at all. Do you tell them stuff then 30% of the cases Kimi goes off and does other things, or what do you mean? The time the agent does something unexpected, I can almost always trace it back to me fucking up something in the user prompt, or the system prompt being wrong somehow, I'd lose my mind if it was only "70% accurate".

> My workflow is just strict supervision of what's happening, I also edit the agents file with anything I see the model doing that I don't like.

Same, including inspecting exactly what the (full verbatim) sent system/user prompts are, which the change we're all discussing here is getting in the way of.

But "Kimi only 70% correct" sounds like it's so bad it's not worth using. In my testing, I didn't find that the model just went out and did other things, but all the providers I tried were way slower than even Sol which is kind of slow to begin with, and it's really inefficient with it's thinking. Tasks that took Sol five minutes could take 15 minutes with Kimi for example, which just feels like such a waste too.

Re: Codex starts encrypting sub-agent prompts

#196

Post by kingstnap »

If the orchestrator agent -> subagent prompt is encrypted then how do you even know if the orchestrator agent is doing its job?

Now one reason I could see for why they do this is because maybe they made the model "better at using subagents" by using thinking tokens for the subagent prompt instead of normal output tokens.

Re: Codex starts encrypting sub-agent prompts

#197

Post by dannyw »

hansihe wrote: post #117
niam wrote: post #34

This title is easy to misinterpret. If I understand correctly: Codex now encrypts sub-agent prompts and hides those prompts from the user. edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"

It seems likely to me this was driven by the `ultra` mode in 5.6, which fans subagents to do work. This mode was previously only available in the web UI (what was previously known as pro?) It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them. I am u…

If there is no visible prompt at all, then that is very understandable. The PR issue exposes a real gap though: subagent spawns need a human-readable audit trial, of its goals/intent, its boundaries and scope and limitations, etc; for basic responsible agentic harness functionality.

Hopefully they can add that.

Re: Codex starts encrypting sub-agent prompts

#198

Post by dannyw »

bob1029 wrote: post #93

I've been sticking with the chat completion endpoint because of this same behavior. OAI has been subtly pushing users away from chat completion and toward the endpoints that are possible to obfuscate (responses API). With chat completion, the reasoning process is entirely under your control. You can build a reasoning agent that uses custom MCTS techniques with GPT5.6 models today if you are willing to get your hands…

> MCTS techniques

what does that mean?

> the reasoning process is entirely under your control

you're still dealing with summarised thinking, no, which is kinda useless as it's way too high level?

Re: Codex starts encrypting sub-agent prompts

#199

Post by dannyw »

embedding-shape wrote: post #17
londons_explore wrote: post #14

I assume this is mostly to frustrate efforts to proxy large numbers of user requests and responses and use it to train competitor models.

Quite obviously they're afraid of letting other providers see how they handle the whole multi-agent management stuff. Pretty terrible implementation though, which makes it impossible to use the multi-agent stuff as a paying user, as you have zero recourse in figuring out what went wrong, when something inevitably goes wrong.

Yes. All models are occasionally known to run tricky commands that delete stuff after all, especially using variables that might be empty/uninitialized and hence rm -rf * or something.

Need an human-readable, concise but accurate audit trail message like the PR suggests.

Re: Codex starts encrypting sub-agent prompts

#200

Post by w-m »

What exactly do subagents do that I can't replicate with a simple skill that tells an orchestrator to create subshells for tasks, each running `codex exec`? I've been doing this with Fable orchestrating Sol-medium and Terra-high, works like a charm.
Post reply on HN