OpenAI's Codex now encrypts the instructions its AI agents pass to one another, and developers who rely on local logs to see what their coding agents are doing have lost that visibility. The change ships in the Codex CLI through a protocol OpenAI calls MultiAgentV2, and it drew a public complaint on July 15, 2026 when The Register reported that the readable task text sub-agents exchange is now gone from local history. For anyone building or auditing multi-agent workflows, this is a meaningful shift in how much you can trust and inspect your own tooling.
What Happened
Codex splits large jobs across a parent agent and spawned sub-agents that hand tasks back and forth. Until recently, the messages between them (the actual "do this next" instructions) were written to your local rollout history as plaintext, so you could open the log and read exactly what one agent told another. That transparency is what MultiAgentV2 removes.
The change arrived in pull request #26210, which encrypts the payloads of the three calls agents use to coordinate: spawn_agent, send_message, and followup_task. The PR merged on June 5, 2026 and shipped in Codex CLI 0.138.0 on June 8. The mechanics are simple and, from an audit standpoint, unfortunate: the local object now holds only ciphertext while the ordinary plaintext field it used to populate sits empty. Delivery to the recipient agent still works, so nothing breaks functionally. What breaks is your ability to read along.
Why It Matters for Builders
If you orchestrate agents, the log is not a nicety, it is your ground truth. When a run goes sideways, the first thing you do is open the trace and read what the parent actually delegated. Ignat Remizov, CTO at payment firm Zolvat, filed issue #28058 making exactly this point: developers and maintainers now have less information to assess the instructions an agent received and the actions it took. As of the reporting, the issue remained open with no linked fix.
The stakes scale with what you build. A solo developer debugging a flaky refactor loses a convenient window into the model's reasoning. A team shipping agents into production loses an audit surface that compliance, incident response, and prompt-injection forensics all depend on. As InfoWorld noted, the concern is less about the encryption itself than about the missing plaintext companion that used to make delegation legible. OpenAI has not published an official rationale, though observers speculate it protects proprietary orchestration details from competitors. If your work touches guardrails or agent safety, this connects directly to the tradeoffs we covered in our look at AI agent guardrails across Claude Code, Cursor, and Codex.
Codex vs Other Coding Agents on Local Observability
Observability is now a real point of difference between agentic coding tools, not a footnote. Here is how the picture looks after the MultiAgentV2 change, based on public reporting and each tool's documented behavior.
| Tool | Inter-agent messages in local logs | Where the trail lives | Auditability today |
|---|---|---|---|
| OpenAI Codex (0.138.0+) | Encrypted ciphertext, plaintext field empty | Local rollout history | Reduced: delegation content not readable |
| OpenAI Codex (pre-0.138.0) | Plaintext | Local rollout history | Full: every handoff readable |
| Claude Code | Readable tool-call and sub-agent transcripts | Local session transcript | Full: transcripts inspectable |
| Cursor agents | Readable in-app agent trace | App-side trace UI | Partial: readable but UI-bound |
The takeaway is not that Codex became a bad tool. It remains one of the strongest coding agents available. The takeaway is that "can I read what my agents said to each other" is now a spec-level question you should ask before you commit a workflow to a given tool, the same way you would ask about rate limits or model tiers, as The Decoder framed the transparency concern.
How to Keep an Audit Trail When Your Agent Goes Dark
You do not have to accept a blind spot. Here is a practical workflow to preserve observability even while the encrypted-delivery behavior stands.
- Pin your Codex version deliberately. If plaintext delegation logs are essential to your compliance posture, know that the readable behavior existed before 0.138.0. Pin the version you validated rather than auto-upgrading, and document why.
- Wrap the agent, not the model. Run Codex behind your own orchestration layer that records the prompts you send and the diffs and commands it produces. You control that boundary even when the internal handoffs are opaque.
- Capture inputs and outputs at the filesystem edge. Log every file write, shell command, and git operation the agent performs. The internal chatter may be hidden, but its effects on your repo are fully visible and are what actually matters for review.
- Add a record-and-replay harness. Deterministic capture of a session lets you reproduce and inspect behavior after the fact. We walked through this pattern in our guide to Codex record-replay and reusable skills.
- Track the issue upstream. A plaintext companion field would restore local inspectability without rolling back encrypted delivery. Subscribe to issue #28058 so you know the moment OpenAI ships a fix or a flag.
What This Enables and What to Do Next
The practical outcome is a cleaner mental model: treat the coding agent as a component with a defined, logged boundary rather than a glass box you can peer inside at will. Teams that adopt that discipline end up with more portable audit trails anyway, because they no longer depend on any one vendor's log format. Audit at the edge you control, pin versions you have validated, and keep one eye on the upstream issue for the plaintext companion that would make this a non-problem. If OpenAI ships that field, you lose nothing by having built the wrapper; if it does not, you were never blind.
Frequently Asked Questions
Does the encryption break Codex functionality?
No. Messages are still delivered to the recipient agent and runs complete normally. Only the human-readable copy of inter-agent instructions in your local history is affected.
Which Codex version introduced this?
The change merged in pull request #26210 on June 5, 2026 and shipped in Codex CLI 0.138.0 on June 8, 2026. Versions before 0.138.0 wrote the delegation messages as plaintext.
Which calls are encrypted?
The MultiAgentV2 path encrypts the payloads of spawn_agent, send_message, and followup_task, the three primitives Codex agents use to coordinate work.
Can I still audit what my agent did?
Yes, at the boundary. You can log every file change, shell command, and git action the agent performs, plus the prompts you feed it. What you cannot currently read is the plaintext of the internal messages agents pass to each other.
Has OpenAI said why it made this change?
No official rationale has been published. Developers speculate it protects proprietary orchestration details, and the open issue requests a plaintext companion field to restore local inspectability without undoing encrypted delivery.
Do other coding agents have the same limitation?
Not in the same way. Claude Code keeps readable local session transcripts and Cursor exposes an in-app agent trace, so inter-agent visibility is currently a point of difference between tools.
