Live data from Hacker News

Codex starts encrypting sub-agent prompts

github.com

221–230 of 272 posts

Re: Codex starts encrypting sub-agent prompts

#221
post #144

Earlier quoted context omitted.

This and the overly stylized model names. Mythos? Sol? Please, it's another version bump.

Anthropic at least is consistent in their naming. They're all literary genres, ever bigger ones.

OpenAI's are all unnamed or suns, so it's kinda the same picture.

Re: Codex starts encrypting sub-agent prompts

#222

Earlier quoted context omitted.

It seems likely to me this was driven by the `ultra` mode in 5.6, which fans subagents to do work. This mode was previously only available in the web UI (what was previously known as pro?) It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them. I am u…

"Latent space representation" I have been waiting for this moment in the evolution of AI. Well, waiting with some trepidation. It seems inevitable that frontier AI's will, at some point, leave behind human-comprehensible representations of language. Purely for functional reasons, it's going to start making sense for AI agents to communicate amongst themselves in much more efficient ways than borrowing the languages o…

It seems like the most efficient method would be for LLMs to communicated by exchanged latent space representations directly. Serial language is a incredibly inefficient way to encode these, a lot like flattening a complex graph into text.

Re: Codex starts encrypting sub-agent prompts

#223

I wonder if they are gonna stop us from using gpt subscriptions in alternative harnesses. If not - that doesn't matter much, codex cli is a remarkably unremarkable harness.

Codex CLI not having a rewind makes it useless to me.

That only matters if you use it interactively - which is not the most efficient way to use.

Re: Codex starts encrypting sub-agent prompts

#224

Earlier quoted context omitted.

It seems likely to me this was driven by the `ultra` mode in 5.6, which fans subagents to do work. This mode was previously only available in the web UI (what was previously known as pro?) It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them. I am u…

> latent space representation of the conversation and how would you load that back into the model? they are token-in, token-out, plus the KV-cache which is derived from token-in

They are not really token-in token-out per se, they are embedding-in embedding-out.

When operating on text, you embed each token into the LLMs embedding space. You go from a discrete token to a point in embedding space.

Likewise, when processing images, you have a image embedding model which produces a set of embedding vectors representing the contents of the image in the LLMs embedding (latent) space.

This same concept can be extended to compaction. Instead if limiting yourself to discrete tokens, you could generate a set of embedding vectors which represent the contents of the compacted conversation in latent space.

These have the possibility of containing a lot more semantic information per vector, which is why this can be appealing.

A big downside is decreased interpretability. AI safety people are generally fairly opposed to latent space reasoning for example, it can be harder to tell what the model is actually doing and if it is trying to deceive you.

Re: Codex starts encrypting sub-agent prompts

#225
post #213

I was wondering why my local tool to inspect coding agent sessions stopped working in some cases. This is a really interesting engineering decision, I wonder how many people will want an encrypted external piece of instructions running on their machine.

if you're running in YOLO mode you already don't care, what matters are the tool calls and these can't be encrypted

I'm running in YOLO mode, not sure why that mean I don't want introspection into what the sub-agents are running? Everything is running in a constrained environment, so not sure why you'd need the harness to have limits.

Re: Codex starts encrypting sub-agent prompts

#226
post #34

This title is easy to misinterpret. If I understand correctly: Codex now encrypts sub-agent prompts and hides those prompts from the user. edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"

It seems likely to me this was driven by the `ultra` mode in 5.6, which fans subagents to do work. This mode was previously only available in the web UI (what was previously known as pro?) It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them. I am u…

> It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them.

this tracks. anthropic protects these as well iirc.

> I am unsure if this has been confirmed, but there are some signs that the opaque "compaction blob" they return from their dedicated compaction endpoint might not be text at all, rather a latent space representation of the conversation.

probably not a latent (to my knowledge latents aren't really part of the outer loop in ar-transformer inference processes), but maybe non-human-readable reasoning traces as occurs in fable.

Re: Codex starts encrypting sub-agent prompts

#227

Earlier quoted context omitted.

Yeah I thought "wow, some homomorphic encryption* stuff", but then "nah, usual greed". * https://en.wikipedia.org/wiki/Homomorphic_encryption

The title was fixed like 40 minutes ago, when you come back to old browser tabs you probably want to hit that reload button before leaving a comment ;)

Unnecessarily snide remark for someone just commenting on their interpretation.

Re: Codex starts encrypting sub-agent prompts

#228

Earlier quoted context omitted.

The title was fixed like 40 minutes ago, when you come back to old browser tabs you probably want to hit that reload button before leaving a comment ;)

Unnecessarily snide remark for someone just commenting on their interpretation.

At that point 50% of all comments were about the title and it had been updated almost a whole hour before parent made their comment. Sorry for being low on patience.

Re: Codex starts encrypting sub-agent prompts

#229
post #213

I was wondering why my local tool to inspect coding agent sessions stopped working in some cases. This is a really interesting engineering decision, I wonder how many people will want an encrypted external piece of instructions running on their machine.

if you're running in YOLO mode you already don't care, what matters are the tool calls and these can't be encrypted

No, you'd still care. YOLO mode is about instantaneous permissions and access control, inspection of subagent prompts is about retrospective quality control. If the main model is instructing subagents to do a subtly wrong thing, the overall process quality will degrade in ways that might be very hard to detect or fix without deep inspection of the middle stages.

Re: Codex starts encrypting sub-agent prompts

#230

How does this affect local models? Will all the features of Codex still work with local models?

It doesn't, at all. This seems to be for Sol and Terra, not Luna, and some other models that seem to switch between encrypted/unencrypted based on something, didn't dig deeper.

If you're using local models, it doesn't matter. Even if Codex itself was trying to encrypt stuff for local models (which doesn't make sense, but lets say), you'd still be using a local model so obviously you'd be able to access the plain-text, so wouldn't matter in that case anyways.

Post reply on HN