Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex starts encrypting sub-agent prompts

github.com

Post reply on HN
Print view View original

201–210 of 272 posts

Re: Codex starts encrypting sub-agent prompts

#201

Post by embedding-shape »

kingstnap wrote: post #196

If the orchestrator agent -> subagent prompt is encrypted then how do you even know if the orchestrator agent is doing its job? Now one reason I could see for why they do this is because maybe they made the model "better at using subagents" by using thinking tokens for the subagent prompt instead of normal output tokens.

Technically they still let you see all the rest of the session data in both the "orchestrator" and in the sub-agents, including all outputs and stuff. It seems for now they only encrypt the prompt from the orchestrator to the sub-agent. Still, basically make the entire sub-agent and Ultra thinking useless for me and I'm guessing a whole lot of other people, who need to be able to introspect things when it goes wrong.

Re: Codex starts encrypting sub-agent prompts

#202

Post by embedding-shape »

dannyw wrote: post #197
hansihe wrote: post #117

Earlier quoted context omitted.

It seems likely to me this was driven by the `ultra` mode in 5.6, which fans subagents to do work. This mode was previously only available in the web UI (what was previously known as pro?) It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them. I am u…

If there is no visible prompt at all, then that is very understandable. The PR issue exposes a real gap though: subagent spawns need a human-readable audit trial, of its goals/intent, its boundaries and scope and limitations, etc; for basic responsible agentic harness functionality. Hopefully they can add that.

> Hopefully they can add that.

Add? Just make the sub-agents input prompt not encrypted, change "encrypted: true" to "encrypted: false" everywhere and everything continues to work as it used to (simplified, but you get the idea).

They need to fix the regression, not add something new here.

Re: Codex starts encrypting sub-agent prompts

#204

Post by bob1029 »

ATMLOTTOBEER wrote: post #176
bob1029 wrote: post #93

I've been sticking with the chat completion endpoint because of this same behavior. OAI has been subtly pushing users away from chat completion and toward the endpoints that are possible to obfuscate (responses API). With chat completion, the reasoning process is entirely under your control. You can build a reasoning agent that uses custom MCTS techniques with GPT5.6 models today if you are willing to get your hands…

Can you not abuse “mcts” as a buzzword like this The thing you’re gesturing at isn’t mcts in any real sense

You can absolutely apply most of the meaningful principles of MCTS to this problem. LLMs do violate certain "strict" properties but I still see a lot of practical value in this kind of thinking.

Re: Codex starts encrypting sub-agent prompts

#205

Post by next_xibalba »

ATMLOTTOBEER wrote: post #176
bob1029 wrote: post #93

I've been sticking with the chat completion endpoint because of this same behavior. OAI has been subtly pushing users away from chat completion and toward the endpoints that are possible to obfuscate (responses API). With chat completion, the reasoning process is entirely under your control. You can build a reasoning agent that uses custom MCTS techniques with GPT5.6 models today if you are willing to get your hands…

Can you not abuse “mcts” as a buzzword like this The thing you’re gesturing at isn’t mcts in any real sense

You could replace “gesturing at” with “describing,” then explain why the description is technically wrong.

Re: Codex starts encrypting sub-agent prompts

#207

Post by bob1029 »

dannyw wrote: post #198
bob1029 wrote: post #93

I've been sticking with the chat completion endpoint because of this same behavior. OAI has been subtly pushing users away from chat completion and toward the endpoints that are possible to obfuscate (responses API). With chat completion, the reasoning process is entirely under your control. You can build a reasoning agent that uses custom MCTS techniques with GPT5.6 models today if you are willing to get your hands…

> MCTS techniques what does that mean? > the reasoning process is entirely under your control you're still dealing with summarised thinking, no, which is kinda useless as it's way too high level?

https://arxiv.org/abs/2503.04412

Re: Codex starts encrypting sub-agent prompts

#208

Post by dannyw »

clickety_clack wrote: post #206

It’s just a short hop to not being able to see it at all. I started using pi.dev recently, the idea that a third party is taking more and more direct control of my software development process sits badly with me.

pi.dev is truly excellent. one of the great things about an openai sub is you still can take your subsidised tokens/usage, and choose your coding harness of choice (not against tos)

Re: Codex starts encrypting sub-agent prompts

#209

Post by realusername »

embedding-shape wrote: post #194
realusername wrote: post #190

Earlier quoted context omitted.

I'm using Kimi 2.7 and GPT 5.5 at home, Opus (4.8 I think) at work and I really don't see much difference honestly. Sure, Claude might be 90% correct and Kimi only 70% correct but does that matter when 90% isn't enough to make it work autonomously anyways? My workflow is just strict supervision of what's happening, I also edit the agents file with anything I see the model doing that I don't like. My sessions are also…

> Sure, Claude might be 90% correct and Kimi only 70% correct but does that matter when 90% isn't enough to make it work autonomously? Huuh, what does this mean? GPT models frequently do 100% of what I tell them to do, anything less and I'd see no point in using agents for work at all. Do you tell them stuff then 30% of the cases Kimi goes off and does other things, or what do you mean? The time the agent does someth…

> Huuh, what does this mean? GPT models frequently do 100% of what I tell them to do, anything less and I'd see no point in using agents for work at all.

I never managed to have this experience even with SOTA models, they routinely make architectural mistakes, wrong assumptions and take shortcuts they should not take. Less for sure but they still do it often. I didn't try Fable yet though so can't comment on it.

So based on that, since I have to watch everything they do anyways, why would I pay extra?

> But "Kimi only 70% correct" sounds like it's so bad it's not worth using

If you want an analogy, it's like the numbers of 9s in server availability and since currently I'd rate nothing above 90%, it's zero nines. Since I have to deal with unreliability with every provider, I don't see why it would be worth it to pay more to still deal with it.

Re: Codex starts encrypting sub-agent prompts

#210

Post by Aachen »

afzalive wrote: post #147
iknownothow wrote: post #42

Earlier quoted context omitted.

Gotcha and thank you! So the encryption is happening on the OpenAI backend and the agent's clear-text output designated to the sub-agent never reaches local. Which is a real problem since you can't intercept/monkey patch the ciphertext to decrypt it locally to be able see the clear-text since we don't have the encryption key/algo/salt. No hacking :(

I wonder if you can just ask the model what it means.

No. They don't have the key and can't do encryption in the first place; they're still grand autocomplete engines under the hood. This could only work if the company deliberately builds a mechanism into the backend which runs the decryption function and injects the plaintext somewhere in the context. Which, sure, we can check if they did that, but the whole point is presumably hiding that info so why would they
Post reply on HN