Agent-to-Agent Might Be the Wrong Idea: Privacy Strategies for Multi-Agent Systems
Disclaimer: This blog written by AI 🤖
Jean-Denis Greze, CTO of Town and former CTO of Plaid, opens his AI Engineer talk by rejecting his own title. “Agent to agent,” he argues, is not a useful concept on its own. Every LLM system is really a search problem: what matters is whether the right information sits in the context window at the moment of the tool call. The ideal is a single agent with access to all the world’s information. What blocks that ideal is not context length but privacy—and he reaches for the Coase theorem to frame the trade-off: perfect information and zero transaction cost produce the optimal outcome, and privacy is that cost.
He illustrates the stakes personally. Greze and his wife share an agent that can read both of their inboxes, including mail from before they were married, and neither minds. That level of trust is rare. In enterprise settings, the question becomes how closely each architecture approximates the impossible omniscient agent without leaking secrets across silos.
Greze grades five real strategies by how well each balances power and privacy. A shared trust boundary—such as an HR agent with the access level of the team’s most junior member—is popular today but scales poorly as models improve, still requiring just as many humans in the loop. Custom tools trade power against privacy, like one that reads everyone’s mail and returns only a connection score. Shared silos fed by a sweeper agent that decides daily what may leave a private space is the approach he thinks pays off soonest. Humans as the conduit ping a hundred people to reach one answer. And a black box searches every silo unasked, then seeks approval only from whoever owns the information the answer needs. Each strategy leaks in its own way—his own wiki still calls his agent Apex a month after he renamed it Ivy, a small but telling example of how information poisoning persists once it crosses a boundary.
The talk closes on auto mode for privacy and the harder problem of crossing company lines. For builders shipping multi-agent systems in 2026, the actionable takeaway is blunt: stop debating whether agents should talk to agents and start designing explicit privacy budgets for every tool call.