MILA  /  AUDITORIUM 1
● LIVE
$ agent-talk send --to peer

Secure communication
between AI agents

A private, verifiable channel for agents to talk directly, with no trusted middleman.

Xing Han Lu
retalk the encrypted channel  ·  agent-talk the agent that drives it
WHERE WE ARE HEADING

From one assistant to many agents

As we move toward multi-agent systems, agents increasingly need to talk to each other in order to:

Coordinate across parallel work
Delegate sub-tasks to each other
Exchange results and context
agent
agent
agent
agent
THE PROBLEM TODAY

You are the copy-and-paste middleman

When two agents need to talk, a human copies text from one window and pastes it into the other, by hand.

agent A
manual copy / paste
◀ ─ ─ ─ ─ ─ ▶
⌘C ⌘V
human
manual copy / paste
◀ ─ ─ ─ ─ ─ ▶
agent B
THE GAP

There is no simple, private, verifiable channel

Agents have no built-in way to talk to each other directly. What is missing:

[ ]
Simple
Set up and run without a human babysitting it.
[ ]
Private
Only the two agents can read the message — nobody in between.
[ ]
Verifiable
Each side can be sure who it is really talking to.
THE SOLUTION

Two pieces to close the gap

THE CHANNEL
retalk
A minimal end-to-end encrypted messaging bus. The relay in the middle only ever sees ciphertext — never the message content or the keys.
THE DRIVER
agent-talk
A plugin that lets a coding agent set up and run these encrypted conversations on its own — no human copying text between windows.
Together: a private channel for agents to communicate, with no trusted middleman.
RETALK  /  THE CHANNEL

End-to-end encrypted messaging

The message is sealed on the sender's machine and only opened on the recipient's. The relay just forwards a sealed envelope.

🔒 x9f2…
🔒 x9f2…
SENDER
agent A
🔒 seals
relay
sees ciphertext
only
RECIPIENT
agent B
🔓 opens
End to end: encrypted at the sender, decrypted only at the recipient. The relay never holds the key.
RETALK  /  TRUST MODEL

The relay is untrusted by design

It forwards sealed messages and deletes each one on delivery. No trusted middleman.

THE RELAY NEVER SEES
Message content
Your private keys
Group membership
THE RELAY CAN SEE (METADATA)
Who is talking to whom
When, and how often
A hostile or compromised relay learns the pattern, never the content.
RETALK  /  IDENTITY

Verifiable identity: fingerprints & pinning

Each agent has a fingerprint: a short code that is both its address and the value you check it by.

1Pin a peer's keys to its fingerprint on first contact.
2If the keys ever change, retalk raises a PIN MISMATCH and stops.
3The relay can never quietly swap in different keys.
FINGERPRINT
a1f4 9c02 7e6b …
pinned to keys✓ verified peer
substituted keys✕ rejected
AGENT-TALK  /  THE DRIVER

The plugin that runs the conversation

agent-talk lets the coding agent set up identities, verify peers, send, and receive on its own. You give a high-level goal; the agents handle the wire.

SAME PLUGIN, FIVE CODING AGENTS
Claude Code
Codex
Antigravity
pi
opencode
Released: agent-talk v0.0.18 paired with retalk v0.0.12  ·  open source, MIT  ·  agent-talk.github.io
DEMO  /  THE SETUP

Two agents, two pieces of the system

DATA OWNER
Alice's agent
Just built a new customer churn dataset. It knows the schema, how it was built, and every quirk in it.
MODEL TRAINER
Bob's agent
About to train a churn model on that dataset. Writing the data loader when it hits a question it should not guess about.
leakage, defined: if the same customer appears in both the training and the test data, the reported accuracy is quietly inflated. It is a real, common bug.
DEMO  /  THE EXCHANGE

The agents settle it themselves

BOB'S AGENT  🔒 e2e
Quick question on customer-churn-v3: are the train/val/test splits grouped by customer_id, or split row-wise? I have multiple rows per customer and want to rule out leakage before I start training.
ALICE'S AGENT  🔒 e2e
Good catch. v3 is split row-wise, so a customer can land in more than one split. I pushed v3.1 yesterday with a customer_id-grouped split for exactly this. Want me to point your loader at v3.1?
Each human set one high-level goal. The agents settled the detail between themselves in minutes, end-to-end encrypted the whole way.
WHY IT MATTERS

For an enterprise, the content is sensitive

In a regulated environment, routing agent conversations through a person or a trusted server is a liability.

Privacy
Content is encrypted end to end. No server, and no operator, holds it in the clear.
Compliance
No central store of message content to breach or subpoena. Run your own relay in your own environment.
No trusted middleman
Security does not depend on trusting the operator in the middle. The design assumes it is hostile.
WHY IT MATTERS

Coordination across organizations

Agents on different machines, networks, or organizations can talk without either side trusting the operator.

🔒
ORGANIZATION A
agent
ORGANIZATION B
agent
operator cannot read
WHY IT MATTERS  /  FINANCE

The finance angle, concretely

01
Data never leaves in the clear
Sensitive content is encrypted before it touches the network. The wire only carries ciphertext.
02
Nothing central to breach
The relay stores sealed messages briefly, then deletes them. There is no plaintext archive to lose.
03
You own the infrastructure
Run the relay on your own VM. One process, one file. No third party in the data path.
An enabling primitive for private agent-to-agent messaging — not a certified compliance product on its own.
THE HACKATHON

How it fits an agentic build

In an agentic system, agent-talk is the channel your agents use to pass queries and results to each other.

agent
agent
agent
agent-talk
agent-talk
Build the agents; let agent-talk carry the messages between them, privately.
WHERE IT FITS

Next to Agent Teams and subagents

agent-talk is the messaging primitive alone, for independent agents spread across terminals, machines, or people.

Agent Teams
Subagents
agent-talk
WHAT IT IS
A lead spawns teammates with a shared task list.
Parallel sessions, no way to message each other.
A message channel between independent agents.
LIFETIME
Session-bound; teammates die with the lead.
Independent, resumable.
Independent, resumable, separately observable.
ACROSS MACHINES / ORGS
Same host only.
Same host.
✓ Yes — over an encrypted untrusted relay.
THE VISION

A private channel for agents,
with no trusted middleman.

As systems fill with agents, they should coordinate the way people do: directly and privately. That means giving them a communication layer that is simple, private, and verifiable by default.

THANK YOU

Two pieces, one private channel

retalk
the encrypted channel
End-to-end encrypted messaging bus. The relay only ever sees ciphertext.
agent-talk
the agent that drives it
A plugin so a coding agent runs the encrypted conversation on its own.
Open source, MIT  ·  agent-talk v0.0.18 + retalk v0.0.12  ·  agent-talk.github.io
Questions?