OpenAI Codex: AI Instruction Encryption Starting in June

OpenAI Codex: Encryption of AI Instructions Starting in June

OpenAI's coding tool, Codex, now encrypts the instructions exchanged between AI agents, rendering developers blind to the internal delegation of tasks.

Encryption is mandatory for the larger models GPT-5.6 Sol and Terra, but users report that this sometimes leads to failed transfers.

OpenAI has not explained this change. Developers suspect it is either a basic privacy measure or an attempt to prevent competitors from using internal communication to train their own models.

Since early June, Codex has been encrypting the instructions that a main agent transmits to its sub-agents. Coding tools are increasingly transforming into agentic systems that break down tasks, delegate parts to sub-agents, and make autonomous decisions in the background. This makes it even more important for users to be able to track these internal processes.

Since this change, the session history displays an unreadable string instead of a readable task description. Developers can no longer verify what their agent delegates to each sub-agent. A bug report on GitHub highlights this issue, asking OpenAI to store a readable copy of the task locally alongside the encrypted version.

For a time, GPT-5.5 did not even allow developers to disable encryption via the dedicated button, cutting off all visibility. OpenAI has apparently since restored GPT-5.5 to the readable path. Forced encryption now affects the larger variants GPT-5.6, Sol, and Terra. Only the smaller variant, Luna, still uses the open path.

The new system also appears to be unreliable. Several developers claim that the encrypted transfer to a sub-agent fails because the content cannot be decrypted. In some cases, this occurs even when the main agent and the sub-agent are using the same model.

Encryption May Block Distillation, But Privacy Could Be the Simplest Reason

OpenAI has not explained why it encrypts communication between agents. Only the change itself has been confirmed.

Community members suspect that the company treats these instructions as raw reasoning traces and wants to prevent competitors from using them for training. This suspicion is not unfounded. The model GLM-5.2 from Zhipu AI was recently suspected of being distilled from GPT-5.5 and Opus 4.8. Agent-to-agent communication constitutes valuable training data that can help elevate a weaker model to the level of a stronger model. Encrypting it would keep this material out of reach of competitors.

A simpler reason is equally plausible. OpenAI's API already encrypts intermediate states so they can be transmitted in follow-up requests without storing plaintext on its servers. We are still waiting for OpenAI to confirm whether this change pertains to protection against distillation, data privacy, or both.