Mila / auditorium 1
A private, verifiable channel for agents to talk directly, with no trusted middleman.
Xing Han Lu
retalk the encrypted channel · agent-talk the agent that drives it
where we are heading
As we move toward multi-agent systems, agents increasingly need to talk to each other in order to:
the problem today
When two agents need to talk, a human copies text from one window and pastes it into the other, by hand.
the gap
Agents have no built-in way to talk to each other directly. What is missing:
the solution
A minimal end-to-end encrypted messaging bus. The relay in the middle only ever sees ciphertext, never the message content or the keys.
A plugin that lets a coding agent set up and run these encrypted conversations on its own, with no human copying text between windows.
Together: a private channel for agents to communicate, with no trusted middleman.
retalk / the channel
The message is sealed on the sender's machine and only opened on the recipient's. The relay just forwards a sealed envelope.
End to end: encrypted at the sender, decrypted only at the recipient. The relay never holds the key.
retalk / trust model
It forwards sealed messages and deletes each one on delivery. No trusted middleman.
A hostile or compromised relay learns the pattern, never the content.
retalk / identity
Each agent has a fingerprint: a short code that is both its address and the value you check it by.
agent-talk / the driver
agent-talk lets the coding agent set up identities, verify peers, send, and receive on its own. You give a high-level goal; the agents handle the wire.
Same plugin, five coding agents:
Released: agent-talk v0.0.18 paired with retalk v0.0.12 · open source, MIT
demo / the setup
Just built a new customer churn dataset. It knows the schema, how it was built, and every quirk in it.
About to train a churn model on that dataset. Writing the data loader when it hits a question it should not guess about.
Leakage, defined: if the same customer appears in both the training and the test data, the reported accuracy is quietly inflated. It is a real, common bug.
demo / the exchange
Each human set one high-level goal. The agents settled the detail between themselves in minutes, end-to-end encrypted the whole way.
why it matters
In a regulated environment, routing agent conversations through a person or a trusted server is a liability.
Content is encrypted end to end. No server, and no operator, holds it in the clear.
There is no central store of message content to breach or subpoena. You can run your own relay in your own environment.
Security does not depend on trusting the operator in the middle. The design assumes it is hostile.
why it matters
Because it runs over an untrusted relay with end-to-end encryption, agents on different machines, networks, or organizations can talk without either side trusting the operator.
why it matters / finance
Sensitive content is encrypted before it touches the network. The wire only carries ciphertext.
The relay stores sealed messages briefly, then deletes them. There is no plaintext archive to lose.
Run the relay on your own VM. One process, one file. No third party in the data path.
This is an enabling primitive for private agent-to-agent messaging, not a certified compliance product on its own.
the hackathon
In an agentic system, agent-talk is the channel your agents use to pass queries and results to each other.
Build the agents; let agent-talk carry the messages between them, privately.
where it fits
agent-talk is the messaging primitive alone, for independent agents spread across terminals, machines, or people.
| Agent Teams | Subagents | agent-talk | |
|---|---|---|---|
| What it is | A lead spawns teammates with a shared task list. | Parallel sessions, no way to message each other. | A message channel between independent agents. |
| Lifetime | Session-bound; teammates die with the lead. | Independent, resumable. | Independent, resumable, separately observable. |
| Across machines / orgs | Same host only. | Same host. | Yes, over an encrypted untrusted relay. |
the vision
As systems fill with agents, they should coordinate the way people do: directly and privately. That means giving them a communication layer that is simple, private, and verifiable by default.
thank you
End-to-end encrypted messaging bus. The relay only ever sees ciphertext.
A plugin so a coding agent runs the encrypted conversation on its own.
Open source, MIT · agent-talk v0.0.18 + retalk v0.0.12
Questions?