Ok, so help me get this right: I ask the LLM for something, it generates prompts for sub-agents and sends them back to my client for it to call the sub-agents. Now, those sub-agent prompts are encrypted messages that the sub-agents will decrypt (by hitting a backend) to do their work.

Might as well just stuff the prompts in a database and only hand back the primary key to the client to hand off to the sub-agents. Keeps the same “data security” without the overhead of encryption (especially since encryption and decryption are happening in the same domain)

▲ watusername 4 hours ago | parent | next [-]

> sub-agents will decrypt (by hitting a backend) to do their work

Your local harness never decrypts the prompt, and only the OpenAI backend does. Your harness still sees tool calls in the transcript so it can act, but you lose (some) visibility as to why the subagent chooses to do so.

Imagine seeing this transcript during forensics:

[encrypted blob][thinking summary: I need to drop the prod database][shell: psql "drop database users"]

▲ jagged-chisel 2 hours ago | parent [-]

OK, so it's actually:

    My Client -> main agent -> sub-agent -> tool
                     |            |
                    log:         log:
                  enc prompt   enc prompt
                   thoughts     thoughts
                     |            |
                     V            V
                   My Client   My Client

Is that more correct? So they're not encrypting prompts to send to sub-agents, they're encrypting logging output to obscure details of the system.

	▲	ignatremizov 10 minutes ago \| parent [-]
		The prompts themselves are encrypted when saved to disk, so you can't inspect them after the fact. If you switch agent threads in the terminal UI (you can kinda swap active session to prompt subagents yourself), you can see the subagent prompt set by the main agent, as long as you have the terminal client open. And this is also for v2 multi_agent mode, v1 doesn't have this, but you need to do a bunch of annoying stuff to re-enable v1 for GPT-5.6 Sol and Terra.

▲ vbs_redlof 4 hours ago | parent | prev [-]

I imagine main agent tells subagent something along the lines of: use this tool on this local data with these instructions in ciphertext. Otherwise yeah, encryption would be redundant.