OpenAI’s Codex now encrypts sub-agent prompts after researchers discovered that Ultra mode triggers spiraling sub-agent calls capable of consuming entire token quotas in a single session. The finding, surfaced by developer Theo, exposed how the so-called reasoning tier operates as a parallel agent loop rather than a single inference pass.
TL;DR: Codex now encrypts sub-agent prompts after analysis revealed Ultra mode triggers spiraling sub-agent calls that burn token quotas. Config.toml routing to cheaper models like Sol and Terra can cut token usage by 50%, according to optimization guides published on youmind.com.
What Is Codex Doing With Sub-Agent Prompt Encryption?
Codex now applies encryption to the prompts it sends to spawned sub-agents, preventing users from inspecting or modifying those instructions mid-session. According to a technical deep-dive published on BigGo Finance, OpenAI’s new Ultra reasoning tier in Codex and ChatGPT does not function as a genuine intelligence upgrade. Instead, it operates as a system-prompt-driven sub-agent loop that fans out into multiple parallel calls. Encrypting those internal prompts stops users from tampering with the routing logic or extracting the hidden instructions that govern how sub-agents behave.
The encryption layer sits between the orchestrator and the sub-agents. When Codex’s main agent decides to delegate a task, it constructs a prompt, encrypts the payload, and dispatches it to a child agent. The child agent decrypts and executes. The user never sees the plaintext. This design prevents prompt injection attacks targeting the sub-agent layer.
Why does this matter? Because the sub-agent prompts contain the routing rules. Those rules determine how many tokens get spent. If attackers could read or rewrite them, they could force the system into expensive loops. Encryption closes that attack surface.
Why Did OpenAI Add Encryption to Sub-Agent Prompts?
OpenAI added encryption because Ultra mode’s sub-agent architecture created an exploitable token-burn vector. The BigGo Finance analysis describes Ultra mode as “not a genuine reasoning upgrade” but rather a system-prompt-driven sub-agent spiral. Each sub-agent call consumes tokens from the user’s quota. If the routing logic is visible or modifiable, malicious actors can craft inputs that trigger cascading sub-agent invocations.
The encryption specifically targets the prompt payloads that flow between the orchestrator and child agents. Before encryption, developers using Codex CLI could inspect these payloads through logging or tracing tools. That transparency revealed how Ultra mode worked internally. It also revealed the vulnerability.
By encrypting the prompts, OpenAI achieves two objectives simultaneously. First, it prevents prompt injection attacks that manipulate sub-agent behavior. Second, it obscures the internal routing logic that determines token consumption patterns. The second objective has drawn criticism from developers who want visibility into how their token quotas get spent.
Security through obscurity remains debatable. But the encryption does block a real exploit path.
How Do Sub-Agents Work in Codex and Claude Code?
Sub-agents are independent agent instances spawned by a parent orchestrator to handle delegated tasks. According to Atal Upadhyay’s guide on building agents with Claude Code and Codex CLI, both platforms use a similar architectural pattern. The main agent receives a user request, decomposes it into subtasks, and dispatches each subtask to a specialized child agent configured through settings files.
In Codex CLI, the config.toml file defines which models handle which sub-agent roles. Developers specify model assignments, token limits, and task-routing rules in this configuration. Claude Code follows a comparable pattern, using its own configuration format to manage sub-agent spawning and task delegation.
The orchestrator maintains context across all active sub-agents. Each child agent operates with its own context window and token budget. When a child completes its task, it returns results to the parent. The parent then synthesizes those results into a final response. This architecture enables parallel processing of complex tasks.
However, the architecture also multiplies token consumption. Every sub-agent invocation costs tokens. The more sub-agents spawned, the faster the quota depletes. This tradeoff sits at the center of the Ultra mode controversy.
The table below summarizes the key architectural differences between the two platforms:
| Feature | Codex CLI | Claude Code |
|---|---|---|
| Config file | config.toml | Project settings |
| Sub-agent spawning | Model-routed | Context-routed |
| Prompt visibility | Now encrypted | Developer-controlled |
| Token tracking | Per-agent budget | Aggregate budget |
| Custom models | Sol, Terra supported | Anthropic models only |
What Is the Ultra Mode Sub-Agent Spiral Problem?
Ultra mode’s sub-agent spiral occurs when the orchestrator spawns child agents that themselves spawn additional child agents, creating a cascading chain of token-consuming calls. The BigGo Finance report characterizes this as the core mechanism behind Ultra mode’s behavior. Rather than performing deeper reasoning within a single inference pass, Ultra mode delegates to multiple sub-agents that each consume separate token allocations.
The spiral manifests when sub-agents encounter tasks they cannot fully resolve. Instead of returning partial results to the parent, they spawn their own children. Each layer of delegation adds token cost. A single user query in Ultra mode can trigger dozens of sub-agent invocations before producing a final answer.
This behavior explains why Ultra mode consumes token quotas significantly faster than standard mode. Users reported exhausting their entire Codex Pro allocation in a single extended session. The spiral effect turns a simple question into a multi-agent conversation that burns through hundreds of thousands of tokens.
The problem compounds when sub-agents retry failed operations. Each retry spawns new agent instances. The token meter keeps running.
How Does config.toml Routing Cut Token Usage by 50%?
Config.toml routing reduces token consumption by directing simple tasks to cheaper, smaller models instead of sending every sub-agent request to the most expensive model available. According to the optimization guide on youmind.com, developers can achieve approximately 50% token savings by configuring Codex to route tasks to models like Sol and Terra based on task complexity.
The configuration works by assigning different models to different sub-agent roles. Complex reasoning tasks go to the primary model. Simple operations like file reads, syntax checks, and formatting tasks route to Sol or Terra. These smaller models consume fewer tokens per invocation and process requests faster.
The youmind.com guide provides specific config.toml examples showing how to define routing rules:
[model_routing]
complex_reasoning = "gpt-4-turbo"
simple_tasks = "sol"
formatting = "terra"
file_operations = "terra"By matching model capability to task complexity, developers avoid spending premium tokens on operations that do not require advanced reasoning. The 50% reduction figure comes from analyzing typical Codex Pro workloads where a majority of sub-agent calls handle routine tasks that smaller models can process.
The routing strategy also reduces latency. Smaller models respond faster. The overall session completes more quickly while preserving the quality of complex reasoning outputs.
Key configuration options that affect token usage include:
- Model assignment per sub-agent role — determines which model handles each task type
- Max tokens per sub-agent call — caps individual agent consumption
- Retry limits — prevents spiraling from repeated failures
- Parallel agent caps — limits concurrent sub-agent count
- Task complexity thresholds — controls when routing upgrades to premium models
- Context window sizing — allocates token budgets per agent
- Fallback model chains — defines degradation paths when primary models are unavailable
- Session-level token budgets — hard limits on total consumption per session
Can Users Inspect or Override Encrypted Sub-Agent Prompts?
No. Codex encrypts sub-agent system prompts at the orchestration layer, and users cannot view, modify, or override them through any configuration file or CLI flag. The encryption applies before the prompt reaches the model endpoint, meaning the content is opaque even to the account holder running the session. This design choice directly addresses the token-spiral vulnerability that researchers identified in OpenAI’s Ultra reasoning tier.
The encryption mechanism sits between the Codex orchestrator and the sub-agent dispatch routine. When a task triggers sub-agent spawning, the system generates an encrypted system prompt package that travels alongside the user-visible query. The receiving model processes it. The user never sees the raw text.
This creates a visibility gap that some developers find frustrating. Previously, power users could inspect sub-agent prompts in verbose logging mode, adjust wording, and optimize token flow. Now those prompts are sealed. The tradeoff is intentional — OpenAI prioritized exploit prevention over transparency, closing the attack surface that allowed prompt injection to cascade through nested agent calls.
Developers who relied on prompt inspection for debugging must now use alternative methods. Token usage metrics, response latency, and output quality become the primary signals for diagnosing sub-agent behavior. The config.toml file still controls model routing and sub-agent enablement, but the prompt content itself is locked.
How Does Codex Sub-Agent Architecture Compare to Claude Code?
Codex and Claude Code take fundamentally different approaches to sub-agent orchestration. Codex uses an encrypted, centralized orchestration model where sub-agent prompts are generated, encrypted, and dispatched by the platform itself. Claude Code gives developers explicit control — sub-agents are defined in configuration, prompts are visible, and the entire chain is auditable.
Claude Code’s architecture treats sub-agents as explicit tool calls. Developers define agent roles, write system prompts in plain text, and can trace every interaction. The system logs each sub-agent invocation, including the full prompt and response. Nothing is hidden.
Codex takes the opposite stance. The orchestrator decides when to spawn sub-agents, what instructions to give them, and how to aggregate results. Users see the final output but not the intermediate prompts. The encryption layer ensures that even sophisticated token-analysis tools cannot reconstruct the sub-agent instruction set.
| Feature | Codex | Claude Code |
|---|---|---|
| Prompt visibility | Encrypted, hidden | Plain text, fully visible |
| Sub-agent definition | Platform-controlled | Developer-defined in config |
| Orchestration model | Centralized, opaque | Explicit tool-call chain |
| Debugging approach | Token metrics only | Full prompt and response logs |
| Configuration | config.toml routing | Agent definitions in settings |
The practical difference matters. Claude Code developers can optimize, debug, and customize sub-agent behavior at the prompt level. Codex developers must work indirectly — adjusting model routing in config.toml, monitoring token consumption, and inferring sub-agent behavior from output patterns. Each approach has defenders. Claude Code wins on transparency. Codex wins on preventing injection attacks at scale.
What Security Risks Does Prompt Encryption Address?
Prompt encryption targets a specific class of exploit: the token-spiral attack. This vulnerability emerged when researchers discovered that OpenAI’s Ultra reasoning mode was not performing genuine multi-step reasoning but instead spawning nested sub-agents in a spiral pattern. Each sub-agent received system prompts, consumed tokens, and triggered further sub-agent calls — burning through token quotas rapidly.
The attack surface was significant. Malicious inputs could be crafted to trigger sub-agent cascades deliberately, inflating token consumption and driving up costs. A single user query could theoretically spawn dozens of nested agent calls, each consuming thousands of tokens before producing any visible output. The user would see only the final response while their quota drained silently.
Encryption closes this attack vector in several ways:
- Prevents prompt injection cascades — attackers cannot craft inputs designed to manipulate sub-agent system prompts they cannot read
- Blocks token-spiral exploits — encrypted prompts cannot be reverse-engineered to identify trigger patterns that cause excessive sub-agent spawning
- Eliminates prompt leakage — system instructions are not exposed in logs, network traffic, or debug output
- Reduces attack surface area — the encrypted prompt package is opaque to both users and potential injection vectors
- Protects proprietary orchestration logic — OpenAI’s sub-agent routing strategies remain confidential
- Prevents quota manipulation — attackers cannot construct inputs that exploit known prompt structures to inflate costs
- Secures multi-agent communication — inter-agent message passing is encrypted end-to-end
- Maintains audit resistance — even with full system access, prompt content remains inaccessible
The core problem was architectural. When sub-agent prompts were visible, attackers could study them, identify weaknesses, and construct adversarial inputs. Encryption removes that reconnaissance capability entirely. The prompts become a black box from the user’s perspective.
How Should Developers Configure Codex Sub-Agents Now?
With encrypted prompts, developers must focus on what they can control: model routing, sub-agent frequency, and token budgets. The config.toml file becomes the primary lever for managing sub-agent behavior and cost. Proper configuration can reduce token consumption by up to 50% according to optimization guides.
The key strategy is complexity-based routing. Not every sub-agent task requires the most capable model. Simple tasks like file reading, syntax checking, or basic lookups can route to cheaper, faster models. Complex reasoning tasks route to the premium tier. This matching prevents unnecessary token expenditure on overqualified models.
Developers should implement the following configuration practices:
- Route simple tasks to Sol — basic file operations and syntax checks do not need premium models
- Reserve Terra for complex reasoning — multi-step analysis and architectural decisions benefit from higher capability
- Set explicit token budgets per sub-agent call — prevent runaway consumption from unexpected cascades
- Monitor aggregate token metrics — track daily and per-session usage to identify anomalies
- Disable unnecessary sub-agent spawning — not every query benefits from sub-agent decomposition
- Use verbose output mode for cost tracking — even if prompts are hidden, token counts remain visible
- Implement session-level spending caps — hard limits prevent catastrophic quota drain from exploits
- Test configurations with benchmark tasks — establish baseline token costs before production use
- Review sub-agent frequency patterns — excessive spawning indicates potential routing misconfiguration
The config.toml structure allows granular control over which models handle which task categories. Developers define routing rules based on task type, complexity indicators, or explicit model selection. This configuration layer operates independently of the encrypted prompt system, giving developers meaningful control despite the opacity of prompt content.
Will Encrypted Prompts Become Standard Across AI Agents?
The trajectory suggests yes. As AI agent platforms proliferate and multi-agent architectures become mainstream, the attack surface for prompt manipulation grows proportionally. OpenAI’s decision to encrypt sub-agent prompts in Codex represents a defensive precedent that other platforms are likely to follow.
The catalyst is economic. Token-spiral exploits and prompt injection attacks cost platforms money through quota abuse, infrastructure strain, and user churn. When a single malicious query can trigger thousands of dollars in compute costs, encryption becomes a financial necessity, not merely a security enhancement.
Claude Code currently maintains full prompt transparency, but this approach carries inherent risk. As the platform scales and attracts more sophisticated attackers, the visible-prompt model becomes increasingly difficult to defend. Other platforms — Gemini, Copilot, and emerging open-source agents — face the same pressure.
The counterargument is developer experience. Encryption sacrifices debuggability and customization, making it harder for developers to build and optimize agent pipelines. Platforms may resist encryption to maintain their developer-friendly positioning. However, the security argument is compelling: a single high-profile exploit causing widespread quota drain could shift the calculus overnight.
Industry observers expect a middle ground to emerge. Platforms may offer tiered encryption — visible prompts for development environments, encrypted prompts for production. Or they may introduce selective transparency, where prompts are visible to the account owner but encrypted in transit. The exact shape remains uncertain. What is clear is that the current fully-transparent model is a liability.
Frequently Asked Questions
Does Codex encrypt all prompts or only sub-agent prompts?
Codex encrypts only sub-agent system prompts — the hidden instructions generated by the orchestrator when spawning nested agent calls. User-visible prompts, direct queries, and primary conversation context remain unencrypted and fully accessible. The encryption specifically targets the sub-agent layer where the token-spiral vulnerability was identified, leaving the primary interaction surface unchanged.
Can developers disable sub-agent prompt encryption in config.toml?
No. The encryption is implemented at the platform level and cannot be disabled through config.toml or any other configuration mechanism. The config.toml file controls model routing, sub-agent frequency, and token budgets, but the encryption layer operates independently above all user-configurable settings. Developers must work within the constraints of encrypted prompts.
How much can you save with config.toml model routing?
Proper config.toml configuration can reduce token usage by up to 50% by routing simple tasks to cheaper models like Sol while reserving premium models like Terra for complex reasoning. The savings depend on task distribution — workloads with many simple sub-agent calls benefit most from complexity-based routing. Developers should benchmark their typical task mix to estimate actual savings.
Does Claude Code also encrypt sub-agent prompts?
No. Claude Code maintains full prompt transparency — all sub-agent prompts are visible in plain text, logged with complete content, and modifiable by developers. Claude Code’s architecture gives developers explicit control over sub-agent definitions, including the ability to write, inspect, and optimize system prompts at every level of the agent hierarchy.
Summary
Codex’s decision to encrypt sub-agent prompts represents a significant shift in how AI platforms handle multi-agent security. Here are the key takeaways:
- Encryption targets token-spiral exploits — the vulnerability that allowed adversarial inputs to trigger cascading sub-agent calls and inflate token consumption is now closed at the architectural level
- Developers lose prompt visibility but retain control through
config.toml— model routing, token budgets, and sub-agent frequency remain configurable, with potential savings of up to 50% on token costs - Claude Code takes the opposite approach — full prompt transparency remains the standard, giving developers complete control but accepting the security risks that OpenAI has chosen to eliminate
- The industry is at a crossroads — as agent platforms scale, the tension between security through encryption and developer transparency will shape how multi-agent systems are built
- Configuration is now the primary optimization lever — with prompts locked, developers must focus on routing rules, spending caps, and token monitoring to manage sub-agent behavior effectively
For developers building on Codex, the path forward is clear: master config.toml routing, implement strict token budgets, and accept that prompt-level debugging is no longer available. The encrypted future is here.