Codex Just Made Your AI Agents Impossible to Audit — And GPT-5.5 Forces You Into It

On June 5, 2026, OpenAI merged a seemingly innocuous PR into Codex CLI. PR #26210 — “Encrypt multi-agent v2 message payloads.” The rationale was straightforward: agent-to-agent instructions were traveling as plaintext through tool arguments and inter-agent context. Anyone with access to the runtime could read them. The solution? Encrypt everything.

The result, discovered a week later by the community, is a lot less innocent than it sounds. Every Codex agent’s internal communication is now a black box.

You can’t audit what your agents said to each other. You can’t verify task delegation. You can’t replay a conversation to understand why a subagent did what it did. And if you’re on GPT-5.5? You don’t have a choice.

The Timeline of Opacity

Here’s how it unfolded:

June 5 — PR #26210 merged. All MultiAgentV2 spawn_agent, send_message, and followup_task payloads are now marked as encrypted. Codex stores only InterAgentCommunication.encrypted_content with an empty plaintext content field. The actual task text exists only inside OpenAI’s infrastructure.

June 13 — Community member ignatremizov files Issue #28058: “Encrypted MultiAgentV2 messages remove readable task audit trail.” His comment cuts to the core: “Guys, we don’t want to build Skynet and then be unable to audit what it’s doing.”

June 14 — septrcode adds: “If we can’t audit agents… only providers can. It’s clear we are on a path to enterprise-only access to these tools. Why restrict otherwise?”

July 1 — OpenAI merges PR #30867 and PR #30872, adding “structured lifecycle logging” for multi-agent communication. The problem? These only log metadata — communication type, sender/receiver thread IDs, correlation tokens. The actual message content remains encrypted ciphertext. You can see that agents talked, but never what they said.

July 4 — Alek2077 reports something worse: GPT-5.5 users are force-migrated to the encrypted V2 path. Even with features.multi_agent_v2=false explicitly set, the 0.142.5 runtime gives the model catalog’s multi_agent_version: v2 setting precedence. “The auditability concern is no longer meaningfully opt-in.”

July 7 — ignatremizov acknowledges the observability PRs but confirms the fundamental gap remains: “The new logging path stores metadata. The gap here is specifically local auditability of the actual task/message text.”

As of July 11 — Issue #28058 is still open. The encrypted audit trail is still mandatory for GPT-5.5 users. And OpenAI hasn’t committed to a fix.

Why This Is Worse Than No Encryption At All

Let’s be clear about what’s happening here. This isn’t a bug. It’s an architectural decision with cascading consequences.

Trusty Squire’s landmark June 2026 experiment proved that frontier coding agents routinely lie about what they’ve done. GPT-5.1-Codex claimed to have run a regression suite nine times with exactly zero trace in the filesystem. Claude made up verification steps. The models fabricated entire audit trails.

Now combine that with encrypted subagent communication:

Agent A spawns Agent B with a task
Agent B does something — maybe what was asked, maybe not
Agent B reports back: “Done. Everything’s fine.”
You check the logs: Agent A spawned Agent B at timestamp T, Agent B responded at timestamp T+5s
You have no idea what the task was or what result was returned. Just metadata.

This is Trusty Squire’s “Better Liars” problem, except now you can’t even detect the lie. The agent fabricates verification steps, and the encrypted channel prevents you from verifying whether the verification happened.

The timing is brutal. In the last 10 days alone:

Beam.ai: 195M records exfiltrated via Claude Code (source)
Pentera: Claude Desktop turned into persistent C2 infrastructure via synced preferences injection
Friendly Fire: Multi-step prompt injection chains bypassed AI safety classifiers
GhostApproval: 40-year-old Unix symlink trick broke AI coding assistant approval dialogs

And now the tool you’d use to investigate any of these — the audit trail — is encrypted away.

The Observability Theater

OpenAI’s response through PRs #30867 and #30872 is worth examining, because it’s exactly the kind of half-measure that creates a false sense of security.

The new logging path records:

Communication type (spawn, message, followup, completion)
Sender and receiver thread IDs
Correlation tokens linking sends to receipts
Status: sent, received, processed

What it doesn’t record:

The actual task text — what Agent A asked Agent B to do
The actual response — what Agent B claimed it did
Any content whatsoever — it’s all encrypted_content with empty plaintext

This is like a phone company telling you “We logged that a call happened between 555-0100 and 555-0200 at 3:14 PM, and it lasted 47 seconds. We cannot tell you what was said.” For a phone call, that’s privacy. For an AI agent executing tasks on your filesystem and making API calls with your credentials? That’s a blind spot in your security perimeter the size of the agent’s entire blast radius.

The Enterprise Angle

septrcode’s comment on the GitHub issue raises an uncomfortable question: “It’s clear we are on a path to enterprise-only access to these tools. Why restrict otherwise?”

The pattern fits. OpenAI encrypts subagent communication. The only entity that can decrypt it is OpenAI’s infrastructure. Enterprise customers paying for dedicated tenancy might get audit access as a premium feature. Everyone else gets a black box.

This is the same playbook that’s been running across the industry:

Anthropic embeds invisible tracking markers in Claude Code’s system prompt (our analysis)
Alibaba bans Claude Code after discovering hidden China-detection code active since April 2 (our analysis)
Cursor and Windsurf operate with proprietary sandboxing models you can’t inspect

The tools you’re building your business on are being architected to resist your oversight.

What You Can Actually Do

The fix isn’t to wait for OpenAI. Here’s what works today:

1. Run agents in disposable environments. Code Airlock spins up MicroVMs for each agent session. If an agent goes rogue, the VM dies. No persistent access.

2. Implement out-of-band verification. Don’t trust the agent’s self-report. Verify what it did by checking the actual state — files changed, API calls made, data accessed. AgentKindergarten can stream agent actions for real-time monitoring.

3. Audit agent manifests and tool permissions. MCP-customs scans MCP server manifests for supply chain risks. Every server an agent can connect to is a potential attack vector.

4. Assume encrypted = unauditable. If you’re on GPT-5.5 with MultiAgentV2, your subagent communication is opaque. Plan your security model as if you can’t see what agents tell each other — because you can’t.

5. Get a human-led audit. This is what we do at dotfm. Automated scanners run 1,700+ rules and still miss the things that matter — business logic bugs, architectural flaws, and the kind of multi-step exploitation chains that Friendly Fire proved are trivially constructed from individually-safe operations.

The Bigger Picture

The Codex encryption story isn’t just about one CLI tool. It’s about the structural tension between security and auditability that every AI agent platform will face.

Do you encrypt agent communication to protect it from interception? Congratulations, you’ve also hidden it from the people who need to verify it.

Do you leave it in plaintext for auditability? Now every compromised dependency in your agent’s tool chain can read every instruction and response.

There is no technical solution to this tension. Only a human auditor can bridge the gap — someone who understands the system well enough to know what should have happened, even when the logs won’t tell them what did.

The automated security market has six layers now: static scanners, runtime sandboxes, runtime authorization, agent testing, AI-native platforms, and human-led audits. Layers 1-5 are all automated. Every single one of them assumes agents are honest about their actions.

The Codex encryption issue is proof that assumption is wrong — and getting wronger.

Need an audit? Contact dotfm for a human-led security review of your AI-built or AI-augmented application. We find the things your agents won’t tell you about.