Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex starts encrypting sub-agent prompts

github.com

Post reply on HN
Print view View original

241–250 of 272 posts

Re: Codex starts encrypting sub-agent prompts

#241

Post by alansaber »

hansihe wrote: post #117
niam wrote: post #34

This title is easy to misinterpret. If I understand correctly: Codex now encrypts sub-agent prompts and hides those prompts from the user. edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"

It seems likely to me this was driven by the `ultra` mode in 5.6, which fans subagents to do work. This mode was previously only available in the web UI (what was previously known as pro?) It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them. I am u…

This sounds most logical to me.

Re: Codex starts encrypting sub-agent prompts

#243

Post by oblio »

literalAardvark wrote: post #221
oblio wrote: post #144

Earlier quoted context omitted.

Anthropic at least is consistent in their naming. They're all literary genres, ever bigger ones.

OpenAI's are all unnamed or suns, so it's kinda the same picture.

> OpenAI's are all unnamed or suns, so it's kinda the same picture.

Umm, no:

> GPT-1, GPT-2, GPT-3, GPT-3.5, GPT-4, GPT-4 Turbo, GPT-4o, GPT-4o mini, o1-preview, o1-mini, o1, o3-mini, o4-mini, o3, o3-pro, GPT-4.1, GPT-4.1 mini, GPT-4.1 nano, GPT-5, GPT-5.1, GPT-5.2, GPT-5.4, GPT-5.4 mini, GPT-5.4 nano, GPT-5.5, GPT-5.5 Pro, GPT-5.6 Luna, GPT-5.6 Terra, GPT-5.6 Sol

Besides the constant shifting of nouns and adjectives...

Luna is the Moon and Terra is Earth.

Re: Codex starts encrypting sub-agent prompts

#244

Post by Espressosaurus »

arjie wrote: post #238
pornel wrote: post #165

Earlier quoted context omitted.

Nothing by Alex Karp is aligned with any users. This guy is a mercenary, and he seems to be in this job for the love of killing.

Yeah but his users are hiring him to set up their killing machines so that they’ll do it better. So that makes him highly aligned with users. Besides, the SaaSification of these things is expected. When you run a model, the reasoning traces are an internal implementation detail of the program that then results in certain user-visible output. It can be used to distill etc and most users don’t care about it. It’s not s…

Except I care about the reasoning trace because I can stop a rathole that burns $50 of tokens as it chews for 10 minutes before I get the desired feedback that it’s done the wrong thing.

Re: Codex starts encrypting sub-agent prompts

#245

Post by smalltorch »

3form wrote: post #215
smalltorch wrote: post #125

Earlier quoted context omitted.

To actually make it work, you would need to preformat your data very specifically, and the data you want to allow to be processed would need a subkey to unlock the parts you want processed. I don't see a way to make it a open standard. The processing steps would need to be part of the key . Anyway If someone figured it out I would be very interested to be sure they weren't just trying to slap a it's encrypted to meet…

The point is to not have subkeys or any other way to access any part of the plaintex - as the goal is generally to offset the computation and the costs of it to another party. And yes, most likely it will require a very particular format of the data, and in all likelihood will allow only for a limited set of operations.

I wish I understood the actual data Alice needed processed to wrap my head around the problem space. Reading examples of what it could be used for leave me more confused.

Without knowing the actual pointed problem space the generalities of the schema just sounds like a snake game to me.

I can't get past where the veil is dropped for bob to take some ciphertext and operate on it in any meaningful way for him to create some machine that simultaneously can process encrypted data while being completely blinded to what the data is or the insights learned. Any form of ability to process a datum while simultaneously being blinded to it is logically incompatible to me.

Now, could we obfuscated it and lower the chances of an attacker being able to do anything useful with it or knowing what is being processed? Yes...but why muddy the definition of encryption in order to do this?

Re: Codex starts encrypting sub-agent prompts

#246

Post by ignatremizov »

Haha, wow, I didn't expect to get quoted on Hacker News. Hello!

I guess "helped make Skynet auditable" may become my most popular open-source contribution, so I'm putting it on my CV.

The thing is that the subagent prompts already pass through the client - they have to, since the TUI can switch between subagents while they work. The change is just to save a copy of the prompt on disk while keeping the encrypted delivery path if necessary for Responses API.

Personally, I use multi_agent_v1 anyways (doesn't have this issue), since v2 is unstable and is a token burner.

Hope they address it so I don't have to keep maintaining it in my fork

Re: Codex starts encrypting sub-agent prompts

#247

Post by ignatremizov »

embedding-shape wrote: post #230
MarsIronPI wrote: post #108

How does this affect local models? Will all the features of Codex still work with local models?

It doesn't, at all. This seems to be for Sol and Terra, not Luna, and some other models that seem to switch between encrypted/unencrypted based on something, didn't dig deeper. If you're using local models, it doesn't matter. Even if Codex itself was trying to encrypt stuff for local models (which doesn't make sense, but lets say), you'd still be using a local model so obviously you'd be able to access the plain-text…

it's the multi agent config - multi_agent_v2 btw is still marked "Under Development" and they've said not to open issues for it. Then they deployed globally Sol and Terra under v2 - forcefully, through the model catalogue json (meaning user configs are ignored). v2 encrypts messages, v1 does not. Thankfully, you can override the catalogue with your own copy and set Sol and Terra multi agent to v1 again.

Re: Codex starts encrypting sub-agent prompts

#248

Post by ignatremizov »

jagged-chisel wrote: post #214
watusername wrote: post #97

Earlier quoted context omitted.

> sub-agents will decrypt (by hitting a backend) to do their work Your local harness never decrypts the prompt, and only the OpenAI backend does. Your harness still sees tool calls in the transcript so it can act, but you lose (some) visibility as to why the subagent chooses to do so. Imagine seeing this transcript during forensics: [encrypted blob][thinking summary: I need to drop the prod database][shell: psql "dro…

OK, so it's actually: My Client -> main agent -> sub-agent -> tool | | log: log: enc prompt enc prompt thoughts thoughts | | V V My Client My Client Is that more correct? So they're not encrypting prompts to send to sub-agents, they're encrypting logging output to obscure details of the system.

The prompts themselves are encrypted when saved to disk, so you can't inspect them after the fact. If you switch agent threads in the terminal UI (you can kinda swap active session to prompt subagents yourself), you can see the subagent prompt set by the main agent, as long as you have the terminal client open. And this is also for v2 multi_agent mode, v1 doesn't have this, but you need to do a bunch of annoying stuff to re-enable v1 for GPT-5.6 Sol and Terra.

Re: Codex starts encrypting sub-agent prompts

#249

Post by fidotron »

b40d-48b2-979e wrote: post #188
airstrike wrote: post #175

Earlier quoted context omitted.

idk about you but I'd rather not be murdered regardless of who the perpetrator might be

That is not the argument being made and this interpretation feels entirely in bad faith akin to the other sibling comments.

False dichotomies, such as your original reply, hardly count as good faith.

And now that original has even been flagged . . . this place really has tanked.

Re: Codex starts encrypting sub-agent prompts

#250

Post by 3form »

smalltorch wrote: post #245
3form wrote: post #215

Earlier quoted context omitted.

The point is to not have subkeys or any other way to access any part of the plaintex - as the goal is generally to offset the computation and the costs of it to another party. And yes, most likely it will require a very particular format of the data, and in all likelihood will allow only for a limited set of operations.

I wish I understood the actual data Alice needed processed to wrap my head around the problem space. Reading examples of what it could be used for leave me more confused. Without knowing the actual pointed problem space the generalities of the schema just sounds like a snake game to me. I can't get past where the veil is dropped for bob to take some ciphertext and operate on it in any meaningful way for him to create…

One example I can think of: privacy preserving ML models. Company wants to keep their model safe and also perhaps not to force you to run some classification on your phone for battery savings. You want your inference features to be private, because they e.g. contain your location data. You send them encrypted, you get encrypted results back and decrypt them.

It could have been obfuscated, but assuming we have HmE, obfuscation is more tricky to be done right.

Do we change the definition of encryption meaningfully in this process, though? If so, I don't see how really. It's just that out of set of potential encryption algorithms, for this purpose we would pick ones that are fit for it. It wouldn't be AES I guess... But it would still be encryption. Maybe a weaker one, but that weakness could be coincidental. I'm not familiar with any theorems in that space.

EDIT: I see a note that we lose ability to verify integrity of the data with HmE, but I guess it's still not really changing the definitions - just most of encryption used today also provides integrity guarantees as a kinda nice and desirable side effect, but it doesn't change that the encryption that doesn't still is encryption.

Post reply on HN