Comment by niam

7 days ago

This title is easy to misinterpret. If I understand correctly: Codex now encrypts sub-agent prompts and hides those prompts from the user.

edit: originally was "Codex starts encrypting prompts, uses cyphertext for inference instead"

58 comments

niam

Reply
hansihe  7 days ago

It seems likely to me this was driven by the `ultra` mode in 5.6, which fans subagents to do work. This mode was previously only available in the web UI (what was previously known as pro?)

It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them.

I am unsure if this has been confirmed, but there are some signs that the opaque "compaction blob" they return from their dedicated compaction endpoint might not be text at all, rather a latent space representation of the conversation. The fact that OpenAIs compaction seems to be much higher fidelity than a lot of other providers makes me inclined to believe this.

If this is true, it doesn't seem far fetched to infer that they might be applying similar techniques to prompting subagents.

I would be curious to see if this way of spawning subagents (encrypted blob) is used when subagents of a different model type is spawned.

  • tpurves  7 days ago

    "Latent space representation" I have been waiting for this moment in the evolution of AI. Well, waiting with some trepidation. It seems inevitable that frontier AI's will, at some point, leave behind human-comprehensible representations of language. Purely for functional reasons, it's going to start making sense for AI agents to communicate amongst themselves in much more efficient ways than borrowing the languages of flesh-bag humans as an interface medium.

    I Imagine next that programming languages, interfaces and API design starts going this direction next. Being written, expressed and optimized as blobs of high dimensional vector space. As humans we might still be able to understand some abstractions of what our AI's are talking about to each other, but maybe not more so then we understand how different regions of our own brain communicate with each other.

    • EGreg  7 days ago

      I strongly believe that the future is the other way. New programming languages and environments designed for strong auditability and preventing bugs will dominate. Only bad actors will use latent space representation, and it might even be outlawed. But the bad actors will proliferate underground…

      I actually built such a language: https://magarshak.com/U.html

      2 replies →

    • mparramon  7 days ago

      It has already started:

        zero-graph v1
  origin source-text
  module "hello"
  hash "graph:a7f7e6899a73f3b4"

  node #decl_ad8d9028 Function name:"main" type:"Void" public:true fallible:true
  node #param_4610ae76 Param name:"world" type:"World"
  node #expr_c403020c MethodCall name:"write" type:"Void"
  node #expr_653eeb6e Literal type:"String" value:"hello from zero\n"
  edge #expr_c403020c arg #expr_653eeb6e order:0

      https://zerolang.ai/

    • karma_daemon  7 days ago

      I've been thinking the same! Haha

      Even for like token efficiency it could make sense - like imagine if the representation were more compact

      Agents acn already translate languages quite well. It doesn't seem crazy that they could work and think in a model specific language, and then translate back to English or something for the user

    • UltraSane  7 days ago

      It seems like the most efficient method would be for LLMs to communicated by exchanged latent space representations directly. Serial language is a incredibly inefficient way to encode these, a lot like flattening a complex graph into text.

  • wren6991  7 days ago

    I think you hit the nail on the head here. Having subagent dispatch in the loop for RLVR is something we've already seen in open models, like Kimi K2.5 and later, so it's no great stretch to assume OpenAI are doing it too.

    If you keep RL'ing the dispatch then the prompts are likely to keep diverging from the type of prompt a person would write (like CoT becoming increasingly incomprehensible), and that divergence is part of their competitive advantage.

    > rather a latent space representation of the conversation

    Student/teacher models derived from the same checkpoint convey a lot of latent information through token choice, as in: https://techxplore.com/news/2026-04-ai-chatbot-student-owls....

    I wonder if this is something they can take advantage of by training on compaction inside of the RLVR loop?

  • radicality  7 days ago

    That’s actually what got me to switch and use Codex sometime beginning this year, the compaction via these encrypted blobs was just waaaay better than Claude. I had short convos with Claude where it would forget something very obvious and important few million tokens into a task, whereas I reached ~1B tokens in some local codex sessions and it was recalling and paying attention to things I mentioned way back at the beginning of the session (and not persisted anywhere else in the repo/md files etc)

  • a-dub  7 days ago

    > It seems possible they trained this by doing full RL rollouts of agents interacting with each other. They likely view these prompts somewhat the same as raw reasoning traces, they don't want people to train directly on them.

    this tracks. anthropic protects these as well iirc.

    > I am unsure if this has been confirmed, but there are some signs that the opaque "compaction blob" they return from their dedicated compaction endpoint might not be text at all, rather a latent space representation of the conversation.

    probably not a latent (to my knowledge latents aren't really part of the outer loop in ar-transformer inference processes), but maybe non-human-readable reasoning traces as occurs in fable.

  • dist-epoch  7 days ago

    > latent space representation of the conversation

    and how would you load that back into the model? they are token-in, token-out, plus the KV-cache which is derived from token-in

    • hansihe  7 days ago

      They are not really token-in token-out per se, they are embedding-in embedding-out.

      When operating on text, you embed each token into the LLMs embedding space. You go from a discrete token to a point in embedding space.

      Likewise, when processing images, you have a image embedding model which produces a set of embedding vectors representing the contents of the image in the LLMs embedding (latent) space.

      This same concept can be extended to compaction. Instead if limiting yourself to discrete tokens, you could generate a set of embedding vectors which represent the contents of the compacted conversation in latent space.

      These have the possibility of containing a lot more semantic information per vector, which is why this can be appealing.

      A big downside is decreased interpretability. AI safety people are generally fairly opposed to latent space reasoning for example, it can be harder to tell what the model is actually doing and if it is trying to deceive you.

  • dannyw  7 days ago

    If there is no visible prompt at all, then that is very understandable. The PR issue exposes a real gap though: subagent spawns need a human-readable audit trial, of its goals/intent, its boundaries and scope and limitations, etc; for basic responsible agentic harness functionality.

    Hopefully they can add that.

    • embedding-shape  7 days ago

      > Hopefully they can add that.

      Add? Just make the sub-agents input prompt not encrypted, change "encrypted: true" to "encrypted: false" everywhere and everything continues to work as it used to (simplified, but you get the idea).

      They need to fix the regression, not add something new here.

themgt  7 days ago

It's sort of insane though, you not only have dozens/hundreds of stochastic agents running on your machine, but you cannot even inspect the instructions those agents are working off of?

I've gone in to look at Claude subagent/workflows and sometimes been like "no this was a mistake to spin up" ... Codex users just get to token yolo the encrypted telephone operator instructions+shell from orchestrator to subagents?

  • djeastm  7 days ago

    >but you cannot even inspect the instructions those agents are working off of?

    It makes more sense when you realize they don't want developers to be doing any coding at all. That's what they seem to be moving towards. From product manager to product via AI.

    • tempaccount420  7 days ago

      Last stage is moving everyone to their cloud platforms, they deploy everything for you, you don't even get to see the code, just the deployed end product.

      Because letting you look at the code would be too dangerous, you could reverse engineer an exploit to another product! Or distill their internet-distilled model!

      But don't worry, at least it will be very convenient.

      1 reply →

    • solumunus  7 days ago

      They’ve already succeeded at that. My time spent manually writing and editing code must be down 99% post Opus 4.7.

  • Jean-Papoulos  7 days ago

    You already have an agent freely doing stuff on your machine. Subagents prompts are a weird place to draw a line. It's not like you're reading everything the agent is doing in any case, let's not kid ourselves.

    • embedding-shape  7 days ago

      When things go wrong I very much read the session traces to figure out what in my prompt wasn't good/explicit enough, then retry to evaluate if it would have helped.

      I was about to do the same with Sol + Ultra, but then discovered this encryption issue that prevents me from doing the same for sub-agents.

    • realusername  7 days ago

      > It's not like you're reading everything the agent is doing in any case

      Personally I do, these tools aren't mature enough to be used without supervision

    • halfcat  7 days ago

      > You already have an agent freely doing stuff on your machine

      No. Agents run in VMs. Assume anywhere you’re running an agent will be compromised, because eventually, it will be.

      The only reason most people haven’t is luck, they didn’t happen to install Axios or Tanstack at a certain time.

bartread  7 days ago

I imagine this will be because a decent chunk of the IP in Codex is probably within its prompts, how they're built, and how they're sequenced and orchestrated, rather than in the codebase per se.

We had this discussion a few months ago where we talked about allowing people to choose an AI provider and provide their API key, thinking about enterprises with "preferred" (read: mandated) AI suppliers. We also wanted to offer the kind of very simple pricing that this is one way of enabling. But we realised pretty quickly that this would/could lead to leaking our back end prompts to customers and, although those prompts are only a part of the value add, if you could build a detailed trace of them then you'd be able to relatively easily reverse engineer a lot of what we're doing.

So we quickly dropped that idea.

  • agumonkey  7 days ago

    I'm unable to understand how much value can be in low-definability non deterministic prompts. It feels like the kept the right divinity spell into a chest.

    • hnlmorg  7 days ago

      I don’t disagree with your divinity spell comparison but unfortunately there is a lot of value in the prompts because these spells are the “programming languages” of LLMs.

      4 replies →

    • embedding-shape  7 days ago

      > understand how much value can be in low-definability non deterministic prompts

      When was the last time you used an LLM to evaluate how true those last part(s) still are?

      I also love how you went from "I'm unable to understand" to "This is surely right", it's a good representation of the software ecosystem at large :)

  • saidnooneever  7 days ago

    the trick about agentic systems is definitely how to do the prompting. things like automation and sandboxing are trivial in comparisson. if you generally ask via API model directly you can see what basic answers it actually yields and how fine tuning prompts and refinements to output as well as adversarial prompts etc are important to get relatively solid results.

    a lot of expertise of certain domains' workflows is needed to make it functional within that domain. some of this can be yielded via prompting too etc so its also baoance of how much to prompt it vs. how much of it you wanna let it reason over itself. (if you tell it too much i lock it into a path and if you tell too little it will give incomplete results )

  • dmurray  7 days ago

    Perhaps AI providers should support this natively: the customer supplies the API key but doesn't get access to the transcripts.

    • bartread  7 days ago

      I don't know how you'd enforce that unless it was something you could mandate at the level of the API call, and then the API call is rejected if the customer hasn't configured it for "no transcript".

      It sort of feels like an area of friction even still.

      1 reply →

postalcoder  7 days ago

It's also not the first time Codex started encrypting stuff. Their excellent compaction endpoint has served up a giant encrypted blob since at least five months ago.

  • hyperbovine  7 days ago

    Feels strongly like we're in the late-stage-AI-unicorn phase. If this is really their moat then the Chinese companies will win.