OpenAI has introduced encryption for inter-agent payloads in Codex’s MultiAgentV2 version (post-0.137.0), making messages exchanged between parent and child agents opaque. The content field in spawn_agent, send_message, and followup_task messages now remains empty, with readable text replaced by encrypted_content. The change arrived with PR #26210 merge on June 5, 2026.

Why this matters to you. If you use agents that delegate tasks to sub-agents, you can no longer read in logs what was delegated, which message was sent, or why a child thread existed. Basic debugging questions—“what did I ask the child agent?”, “why did this spawn fail?”—now require decrypting the payload or reconstructing context from observed behavior. It’s a change that makes it harder to understand and improve complex agentic workflows, precisely as production adoption grows.

GitHub issue #28058 requests maintaining a readable audit field separate from the encrypted message delivered to the model, preserving transparency without compromising inter-agent communication security.

In detail

Context. Codex is OpenAI’s AI editor (not the 2021 Codex model, now deprecated). The MultiAgentV2 version lets an agent spawn sub-agents, delegate tasks, and send messages across threads. Before PR #26210, delegated messages were readable in plaintext in local logs, rollouts, and debug traces.

What changes. From version 0.137.0 onward, inter-agent message payloads are encrypted end-to-end. The InterAgentCommunication.content field (previously readable) now remains empty, with actual text moved to encrypted_content. This applies to all agent coordination calls (spawn_agent, send_message, followup_task). The encryption is understandable as privacy hardening—it prevents sensitive data in delegated tasks from ending up in unprotected logs—but it also removes human audit capability.

The practical problem. When agent A spawns agent B with a specific task, anyone reviewing the rollout afterward no longer sees “analyze this CSV and return rows with anomalies”, only ciphertext. If B fails, you don’t know whether the task was poorly formulated, too broad, or contained parameter errors. If you have ten sub-agents running in parallel, you can’t compare their tasks to improve decomposition. Telemetry becomes opaque precisely where transparency was needed: at handoff points, which are the most frequent failure points in multi-agent systems (as documented in the paper on why agents fail).

What remains open. The issue suggests adding a separate audit field that stores the task in plaintext for local inspection, while the encrypted payload remains for delivery to the receiving model. This would preserve inter-model communication security without sacrificing debugging. At publication time (July 14, 2026), the issue is open with 156 comments on Hacker News, a sign it resonates with community needs. It’s unclear whether and when OpenAI will respond: the original PR was merged without prior public discussion.

Implications for builders. If you’re taking multi-step agents to production, this changes how you debug failures. You’ll need to rely on application-level structured logs (captured before passing the task to the sub-agent) or external observability tools that log payloads before encryption. It’s an additional complexity tax on operations, stacking on top of already-known multi-agent orchestration challenges.