On 5 June 2026, OpenAI merged a pull request into Codex titled "Encrypt multi-agent v2 message payloads". After it landed, when a parent agent spawns a child, the task text no longer travels as ordinary tool arguments. The Responses API encrypts the message the parent model emits, Codex forwards only the ciphertext, and the API decrypts it internally for the recipient. Codex's own local record keeps the structured delivery but leaves the readable content field empty. The pull request's explanation is headed "Why" and does not contain a reason. OpenAI did not respond to The Register's request for comment.

Eight days later Ignat Remizov, CTO at the payments firm Zolvat, filed issue #28058 against the repository. His complaint is narrow and reasonable: keep the encrypted delivery, but persist a readable audit copy so a maintainer can answer "what task did this spawn_agent call give the child agent?" after the fact. The issue is still open.

On 30 July, Earendil, the company behind the Pi agent, put the pattern in a wider frame with The Session You Cannot Take With You. Its inventory is worth reading in full: reasoning tokens billed to the user but returned as opaque blobs, hosted searches where the retrieved passages never reach the client, compaction items that OpenAI's own documentation calls "opaque and not intended to be human-interpretable", and conversation state keyed by identifiers that live on the provider's servers. Earendil's name for it is provider-sealed state, which is better than "encrypted content", because the encryption does not hide anything from the provider. It hides it from you.

The pitch

The providers have three arguments and none of them is silly.

The first is privacy. OpenAI's stateless mode returns reasoning as encrypted content precisely so that zero-data-retention customers can carry reasoning across turns without the provider storing anything; the blob is decrypted in memory on the next request and discarded. Before that existed, a ZDR customer had to choose between statelessness and reasoning continuity, and took worse results for the trouble. That is a real gain for the customers who care most about retention.

The second is integrity. If a client can hand a model an arbitrary block of "prior reasoning", it can steer that model in ways the safety stack never sees. Anthropic's thinking blocks carry a signature field for exactly this purpose, and Amazon's Bedrock documentation describes it plainly: the full thinking content is encrypted into that field, and the field is used to verify the blocks were generated by Claude when passed back.

The third is competitive. Anthropic spent February 2026 describing alleged campaigns to harvest its outputs as "distillation attacks". Reasoning traces are the most valuable training exhaust a frontier lab produces. Sealing them is straightforward commercial self-defence, and The Register named it as a plausible motive for the Codex change even absent any statement from OpenAI.

Why the lock-in framing loses

The obvious reading of all this is vendor lock-in, and it is the reading almost everyone reached for. It loses, because the providers have a good answer to it. Hardly anyone switches models mid-session. Earendil concedes the point directly: "probably not". Lock-in arguments are about defecting to a competitor, and defection is a thing users mostly do not do.

Near as I can tell, that framing misses where the cost actually lands. Sealed state does not only stop you leaving for a rival. It stops you moving inside one vendor's own product line, and it stops you moving forward through that vendor's release calendar.

The mechanism is visible in Anthropic's stack, and it is not hypothetical. A thinking block's signature is bound to the model that produced it. Replay a block signed by one model against a different one and the request is rejected; harness maintainers have logged sessions permanently bricked when a foreign-signed block sits in a stored transcript and gets replayed on resume. The accepted fix is to strip the thinking blocks before switching. That is one vendor, two of its own models, and the remedy is to throw the reasoning away.

Now consider what a long-horizon agent actually is as a product. It is an accumulating working context: months of decisions, evidence, rejected approaches and half-finished threads. That accumulation is the entire pitch for agent memory, and it is the thing that makes the agent worth more in month six than in week one. Sealed continuity gives that asset a half-life, and the provider's deprecation schedule sets it. Models get retired on a calendar the buyer does not control.

The coupling nobody has to intend

What makes this tighten rather than stabilise is that no malice is required. Look at which features convert readable transcript into provider-bound state: reasoning continuity across turns, hosted search, server-side compaction, hosted multi-agent orchestration. That is a list of the features that make an agent good. Turn them all on and the agent performs better and its context becomes less inspectable, less transferable and shorter-lived. Turn them off and the transcript comes back, along with worse results and a larger bill.

Capability and captivity are being sold in the same switch. That is why the direction holds even for providers with no strategy at all about it.

The strongest case against

The best counter-argument is not from a lab. It is the technical one, and it is that portable sessions never existed. Tokenisation differs between models. Sampling is not reproducible, deliberately. Prompt caches have always lived on someone else's hardware. A summary written by one model does not reproduce another model's behaviour even when it is fully readable, so asking for a portable session is asking for a property the abstraction never had. Earendil grants most of this in its own post, which is to its credit.

I think that is right about equivalence and wrong about what is being asked for. Nobody is owed identical behaviour from a different model. What is at stake is intelligibility: whether a human, or any other system, can read what happened.

And the two classes of sealed content come apart cleanly. Safety, integrity and distillation defence are arguments about raw chain of thought. None of them covers the plaintext task a parent agent handed a child. None of them covers the passages a hosted search placed in the model's context. Those were shipped inside the same wrapper as the reasoning, and the justification for the reasoning was quietly extended to cover them.

The clearest evidence that this is a product decision rather than a constraint is that the same problem has two shipped answers. Anthropic's compaction API returns a compaction block with a readable content field holding the summary, and an instructions parameter that lets the client decide what the summary must preserve. OpenAI's compact endpoint solves the identical problem and returns an artefact its documentation says is not meant to be human-interpretable, to be passed to the next call as-is. Same requirement, same year, two answers, one of them readable.

There is a second piece of evidence, and it cuts finer. On 12 June, Codex merged a pull request titled "Support plaintext agent messages". Read the description and the scope becomes clear: send_message deliveries already reach the receiving model as encrypted content, while child-completion notifications are generated by Codex itself and were therefore already plaintext. The change gave both paths the same typed shape. The plaintext support was extended to the traffic that was never encrypted. The model-authored delegation, the part Remizov asked about, stayed sealed.

The bet

The cheap test here is a readable handoff sitting next to the sealed one. It costs a provider nothing in capability, nothing in distillation exposure worth arguing about for a compaction summary, and Anthropic already ships it. So there are two things to watch, and I would put the window at the end of 2026.

First, whether issue #28058 gets what it asked for: a non-encrypted audit field carrying the readable task text for model-authored agent messages, persisted in the local rollout. Second, whether any major provider ships a readable, provider-neutral summary alongside a sealed compaction or reasoning item, rather than instead of one.

If sealed item types keep multiplying while the count of readable handoffs at OpenAI stays at zero, then statelessness was the occasion and confidentiality was the point. If either lands, I am wrong about the direction, and the sealing really was incidental to the engineering. I do not have a clean read on which way OpenAI goes; the plaintext pull request in June suggests somebody inside is thinking about it, and its scope suggests they were not thinking about this.

Either way, there is a question worth putting to any vendor selling a long-running agent before the invoice is signed. If you deprecate this model, what happens to a six-month-old session? Today, at the two largest providers, the honest answer is: strip the reasoning, keep whatever plaintext survived, and hope the summary still makes sense to a model that did not write it.