Agents' next frontier: agent-to-agent and network effects — Jean-Denis Greze, Town
AAI Engineer
Computing/SoftwareManagementInternet Technology
Transcript
00:00:00You all hear me? All right. Well, first, thanks for coming. I can't believe there's anybody in the
00:00:18room, but that's very nice. My name is Jean Denis. I'm CTO at a company called Town. We're not going
00:00:25to really talk about Town, so you can go to town.com and check that out if you want, but that's not
00:00:29the point of the talk today. I was CTO at Plaid for seven years, and then I was at Dropbox before,
00:00:36and then before that, I built software for hedge funds. I've done lots of stuff in my career,
00:00:40and right now, I'm working on assistance agents for normal people, not for engineers, but for
00:00:47basically everyone in America and the world, and one of the things we've been working on are systems
00:00:53where agents work with other agents, so agent-to-agent, and the main idea is that we think there's huge
00:00:59network effects if agents can work together to get things done for people, because in the real world,
00:01:05the way most of us do work is with other people, right? More is better. But actually, I don't think
00:01:14agent-to-agent makes much sense as a concept, so I want to reframe the entire talk in terms of search.
00:01:20So I think most LLM systems are just a search problem, and what you're trying to do is you're
00:01:27trying to make sure the context window, right before you either return results to the user or before a
00:01:33tool call, you're trying to make sure the context window has the right information for the user. If you
00:01:37put the right information in the context window, then based on the intelligence, so to speak,
00:01:43of the LLM, you will get the best result possible. So, you know, four years ago, the way we did that is
00:01:49humans would populate the context window manually, then a couple years ago, most people were ragging,
00:01:55so they were like, "Let's have a tool, like a search tool that can look across systems and bring the data in
00:02:00there." And then people were like, "Well, that doesn't scale super well. It has issues." And now we're all
00:02:04about agentic search, which is the idea that you give the agent a lot of tools, and it will search
00:02:09through the space of all content, and then hopefully before it makes a tool call, it has exactly the
00:02:14right content to make the right tool call to return the right information to the user. And in this, by the
00:02:19way, there's no people. It's just a one LLM call, like the one that matters, having the right context.
00:02:25That's what you're trying to do. You're trying to engineer that system.
00:02:30Cool. So what does that have to do with agent to agent? So I want you to imagine the following world.
00:02:35There's not many agents that can do things. There's just one agent, right? And it has one context window,
00:02:43and it has access to all the information in the universe. It can look at any one person's email,
00:02:49can look at any company's information, can look at any government's information, and it has it right
00:02:55there in the context window. And then you ask it to do something, you have your little system
00:02:59prompt before all that data. And what's going to happen is it'll give you the best possible outcome.
00:03:05And that actually, that is a multi-Asian world. It's just an agent that has access to all the
00:03:10world's information. That's the natural state of things. That's the ideal state of things. There's a
00:03:14problem with this state of things. And the problem comes from a few, so you law in economics, something
00:03:21called the Coase theorem. And it says that basically, even humans, if they all have access to all the right
00:03:26information and there's no transaction costs, we get the economically ideal outcome out of a contract or
00:03:32negotiation. Well, it's the same thing. We can't put all of the world's contacts, we can't make it
00:03:37available to the LLM. Like theoretically, even with infinite context window, because of privacy and
00:03:42security. We're humans. I don't let you look at my email, so there cannot be an agent that I'm willing to
00:03:49just let it look at my email all the time. But if it existed, it would be very, very powerful. So I think
00:03:56this is like, this is the test for a multi-agent system, which is how well does it approximate this.
00:04:01If it approximates this, that means if you can get the same data in your window, that a perfect system
00:04:07that has access to all the world's data could, then you get the optimal outcome. That's what you need to
00:04:11try to do. So we're going to talk about five strategies that people use at various companies to try to get
00:04:17the right data into that LLM call with an externality. So the first one is approximate access to everything
00:04:26within a trust boundary. So my wife and I, we have an agent together. And that agent has access to my
00:04:33email and her email, including emails before we were married. And it's okay, she doesn't ask my agent
00:04:40questions about that. But she does ask about, you know, whether I like scheduled something for kids or,
00:04:45you know, if I followed up on some third party thing. And so the fact that our agent has access
00:04:49to both of our systems is wonderful. And the word context, this might be there's an HR team agent
00:04:56that has access to all the HR systems, just like an employee of the HR team would, or maybe as much
00:05:00access as the lowest employee in the HR team, all the employees in HR team have the ability to ask this
00:05:06agent questions, and boom, it gets pretty good results. And this is very popular right now.
00:05:12It's very popular with IT teams and security teams, because it's the same model as SAS for security. So it
00:05:19works really well. I think it has a problem, which is a fundamental problem that if I wake up in the
00:05:24morning, it's like basically the only thing I think about, which is, does it get over time? Does the system
00:05:29naturally require fewer humans? And then as the models get better, does this approach get better? And the problem with this
00:05:36approach is the answer is no to both. You still need humans to think about all the data. And you don't
00:05:42get magical de siloification of your data, you've just created a new silo because a human thought about
00:05:48it. So the problem with this is I do think if this is your approach to building better AI, you're going
00:05:53to be fucked in the next couple years. But that's okay, you're fucked is my opportunity. I'm just not an
00:06:02asshole. I'm sorry, that was mean. But like, I think it's not, I think it's a good now way to think about
00:06:06it. It's not the good end game way to think about it. The other approaches I think is a little more
00:06:10clever, and I'm going to try to explain it is basically you try to have tools that make a different
00:06:15trade off between power and privacy. So I'm going to give you an example here. The use case is I want
00:06:22to ask my agent, does anyone in my company, is anyone in my company connected to someone on the finance
00:06:27team at Acme Corp? And so the no silo way to do that is just give me access to everyone's Gmail in my
00:06:34company. I'll see who has emails with people from Acme Corp. Then I'll look at their profile on Google
00:06:40or LinkedIn. And then I'll be like, oh, you seem to email a lot with the CFO. Can you do the intro for me?
00:06:45But obviously, silos, we don't want that. So what if you built a tool? And what the tool did is it
00:06:52looked at everyone's Gmail. So that tool had access to everyone's Gmail, and it just returned a
00:06:56relationship strength score. So the tool, you would give it like a domain, and you would say, I'm
00:07:02looking for someone who's a CFO. It would look at everyone at the company who sent emails to that
00:07:06company. And then they would like rank their score, and they would give you back the score. And then the
00:07:11agent would get the score, and it would be like, cool. Then they would use a Slack tool to text that
00:07:15person at the company. It's like, hey, Bob, I see that you're connected with Jane, who's the CFO at
00:07:18Acme Corp. And then Bob would be like, yes, I am. And then your AI would be like, oh, can I draft
00:07:24an email? Or can you draft an email introducing me? And then Bob would say yes, and he would do that,
00:07:28and you'd be connected, and everything would be wonderful. So this is actually a very cool approach.
00:07:33I don't know how many of you do it. We do this at town for a few things that we see a lot of our users
00:07:37do. We ask ourselves, what is a privacy-preserving tool that all of our users would be okay existing? They can opt out if they
00:07:43don't want it. But it has a natural network effect, because it breaks through silos in an interesting
00:07:48way. Another one that's interesting here is letting other people put draft emails in your inbox. You
00:07:53let other people at your company draft emails on your behalf, because they're going to ask you to
00:07:57anyway to get intros if they're on the sales team. So might as well save yourself a few clicks. So the
00:08:02question here is, like, are people going to be okay with a privacy trade-off that you make within a
00:08:06corporation? Ah, bad, bad. Oh, boy. Within a corporation that will, you know, mostly it works.
00:08:17So the problem here, again, is it's, again, manual and not dynamic. It's manual because humans need to
00:08:22think about the tools. Maybe AI could build the tools. And it's also manual because you need to explain it to
00:08:28everyone that it's happening. Humans may not like it if this is happening. If they're not okay with the
00:08:32privacy security, the privacy kind of power trade-off that you've made. Cool. And again, this doesn't
00:08:37really get better as the AI gets better. It's just a problem. Cool. So now the third category. This one's
00:08:43super popular, but only mostly in the single user context. So this is, you know, like personal wikis
00:08:48in claw land. That's what we would call it. But it's across teams. So it's a shared silo. Create a new place
00:08:55where data accumulates within your company, within subgroups of your company. And you start to put more
00:09:01and more stuff there over time. And all the agents have access to that stuff because they have access
00:09:06to it. You no longer have information that would be okay to be shared that's stuck in a silo. It now
00:09:11automatically filters out into this public space. So examples, shared skills. If you code in an
00:09:17organization, probably in your repo, you have shared skills. Anyone can make them better. Someone has a
00:09:22better way to, you know, profile your database or whatever. They can write the skill. Next time
00:09:26someone's sitting there is like, oh my god, the database query is slow. It uses the profiling
00:09:31skill and everyone's a better engineer. So that's one version. The other one that's pretty popular is
00:09:35people decide they have some shared mediums like a wiki, air table, etc. And they have a skill that says,
00:09:41hey, put more data in there over time. So these are cool. And they work as long as your agents have
00:09:49those tools and also some trajectory incentives to really like get data out in and out of these shared
00:09:55silos. I think the next version of this that a few people are working on is like you have a sweeper AI.
00:10:02So this actually, if there's one good idea in this talk that I think works really well is this. It's a
00:10:08sweeper AI. So you have an AI inside each private silo. An AI has a policy about what has to stay in the silo.
00:10:17And then it also has a description of all the shared spaces that you have. And at the end of the day,
00:10:22it looks at new information in a silo. And it puts it in the public spaces. Well, public, public to your
00:10:27company. So this is the same as the personal wiki that you all have AI building for you at the end of
00:10:32the day, so that it knows your goals and your friends and all that stuff. But it's at the company level.
00:10:37The hard part is how do we pick what private information is okay to share and to put it in shared
00:10:43silos. And I think there's two approaches. There's the ask a human approach. So this is like the LLM
00:10:50comes up with a list of things to contribute. And then it asks the user, "Hey, are you okay with me
00:10:54putting this in the shared space?" And you read it. You're like, "Yeah, saved you a bunch of time."
00:10:59Right? I mean, you weren't going to do it otherwise. I think the other version is you actually ask the LLM
00:11:05to enforce a policy. And I think that actually is where things are going to go very, very quickly.
00:11:12And I think in the next six months, we'll have a bunch of systems where companies have trusted
00:11:16an LLM with a policy to automatically surface more and more information that otherwise would have been
00:11:21private into a public space. If you're like at a Fortune 500 enterprise company, unfortunately,
00:11:26I don't think that's going to happen for a while. But I think if you look at smaller companies like 10,
00:11:3050% employees, high trust, like low likelihood of something, one doing bad with the data,
00:11:35where it's really clear to know what data couldn't be shared, basically finance and HR data,
00:11:39you're going to see a ton of this. And the cool thing here is this really improves trajectories
00:11:44of systems on common work. That was third approach. Fourth approach is pretty obvious. Use humans as the
00:11:51conduit for information. So this is like traditional agent to agent. My agent, ask your agent, "Hey,
00:11:58who is connected to someone at the finance team at Acme Corp?" You as a human see the request,
00:12:05and you're like, "Yeah, I'm okay with that. Go and find the information inside of my email."
00:12:10And then it shows you the result. And then you're like, "Yes, I'm okay with that result,"
00:12:14going to the person who asked. The big problem with it is for any request that has low, where it's like
00:12:21only a few people will have the information, you're kind of spamming everyone the request. So if I ask this
00:12:25question, a hundred person company, a hundred people are being pinged on Slack, being like approved on
00:12:30these requests to like farm your personal network for this, for this, you know, for this, like the
00:12:36answer to this question, that's not very efficient. And so that's why there's a better version of it,
00:12:43which this is, this is very powerful, but I haven't seen it in practice much. It's, it's a black box
00:12:49approach. I wish I had a diagram for this. Unfortunately for you all, I do not. So here's
00:12:55what this means. The black box approach is where when you ask a question that can only be answered by
00:13:01looking at information in other people's silos, you have an LLM, the trace of which no one has access to,
00:13:08that gets access to all the data, and it gets to the answer.
00:13:13Right? Like by say, get to the answer either gets the answer or it's about to do the, the,
00:13:18any tool call that's a right. And then it looks at what information did it need to make that tool
00:13:23call. And it only asked the people who own that information for their approval to do the tool call.
00:13:30So in the example before that I gave, when I asked 100 people at my company, hey, do you know the CFO
00:13:35at Acme Corp? The request goes to everyone's agents in my company. All of their agents look in their
00:13:43Gmail and their private silos to see if they're connected to the CFO. That happens automatically.
00:13:48No, no human is being asked for approval for that to happen. Then it, the agent in the black box
00:13:55gets the list of the 20 people who are connected. It looks at contacts from the emails to determine
00:14:01who has the strongest connection. It determines that it's Bob. And then it just asks Bob, hey,
00:14:09Jean Denis wants you to introduce him to Jane, the CFO at Acme Corp. I know you're well connected to her.
00:14:15Am I okay sharing that bit of information with Jean Denis? And you're like, yeah, sure. You click yes,
00:14:20no big deal. The important thing is you have to trust the black box. So you have to trust that
00:14:25you can break down all the silos for an LLM that has full access and that doesn't ask for permission
00:14:33until there's a sharing moment or this right step. So actually within a company, this is not impossible
00:14:39to do. And actually your security and compliance team can get okay with it. You just have to have,
00:14:47you have to be sure that the human in the loop step is correct. And you have to be sure that you're not
00:14:53letting other information go through with the last answer. So, you know, like the nightmare scenarios
00:14:58and things like this or things like, sorry, I'm like, we have plenty of time, I'm almost done. So it's
00:15:06great. The nightmare scenarios with things like this is someone asks a question like, are you connected
00:15:12to a recruiter at the other company that you have no business being recruited to as a way for them to
00:15:17find out that you're interviewing somewhere else? Right? So, you know, there are, you can still
00:15:22sometimes with the black box inadvertently get information out that you shouldn't be able to, you
00:15:26have to really think about how you build a great system. So those are the, those are the approaches.
00:15:32I think if I were to bet on one that has immediate ROI that we're going to all see in both like open
00:15:38source claw-ish worlds and in like small companies, it's going to be the wiki that's automatically created by AI,
00:15:44like the information base that's kept up to date. I think there will be database versions of it,
00:15:48wiki versions of it. And I think more and more, we're going to trust LLMs to make the decision
00:15:52about what's okay to share and what's not. There are problems. So prompted junction in, in the silos can
00:15:59be a real problem, obviously. So if you have a silo that has like, that's more open and someone can put
00:16:05something bad in there, and then that, as part of the energetic search, you pull it out, you know, bad things can, can happen.
00:16:11You can have, it's very easy to have a shared wiki that just goes like totally off the rails,
00:16:17you know, like the information there, one piece of information there is incorrect because LLM made a
00:16:22mistake and then it like poisons it forever. I have a personal wiki that thinks my agent's name is Apex
00:16:27right now, but I renamed my agent a month ago to Ivy and like somewhere in memory bank of, of my like,
00:16:35set up, Apex lives. And so I can't get rid of it. That's fine for Apex. That's a funny one,
00:16:40but it's like much more difficult if it's a really wrong piece of information about your business.
00:16:46If you don't have human in the loop for any of the steps, obviously there'll be false positives and
00:16:51wrong disclosures. You know, sometimes when there's a wrong disclosure of information,
00:16:55someone gets fired, someone there's a wrong disclosure. It doesn't matter at all. Sometimes
00:17:00a customer sues you. So, you know, you got to be careful. And then I think this all sounds nice,
00:17:09but like who approves what, what's logged, what's reversible. The black box idea is really great,
00:17:13but it can't truly be a black box. Someone at your company will want to audit it at some point. They
00:17:19want to understand what's going in there, right? So at some level, there must be some person in the
00:17:23CISO suite or somewhere that has access to all the data. Yeah. So what do I think? Well, I do think
00:17:32the frontier is auto. So I've said that. I think in coding, we used to approve everything. Then we were
00:17:37like, YOLO, live dangerously. And now the gods at Anthropic have granted us auto mode. And auto mode
00:17:42tries to figure out when we're maybe being a little silly. And it tells us, well, I think A to A or cross
00:17:47information silos will be the same way. I think what's going to happen is we're going to get comfortable
00:17:52with low sensitivity information being pulled out and put into common spaces. And then we will have
00:17:57a place that's like human review or always human approved. And then over time, what's going to happen
00:18:02is the LLMs will get more powerful. We will be better at encoding safe policies within them. We'll be
00:18:07better at designing for the really hard areas tools that get the privacy trade off correct. And it'll just
00:18:14be more and more auto for building shared silos and even sometimes for deciding whether involve a human.
00:18:19So the example that I have is like, if I ask for notes from a weekly recurring call with, you know,
00:18:26a supplier of hours and their finance team, maybe the LLM is like, oh, well, given your role,
00:18:31I don't need to ask anyone on those teams for permission. I can just share the notes with you.
00:18:35It's like, it's fine. They can look at the content. They can see what my role is. They can decide
00:18:40from a risk perspective. I'm okay with that disclosure. And the cool thing about auto, by the way,
00:18:46is if you design your systems that way, it'll scale with model capacity. So my encouragement would
00:18:50be like, you need to start if you have agent to agent or work across silos, which I think the better
00:18:55way to think about it, definitely define a low sensitivity zone where you're okay with the LLM
00:19:00making a call and get okay with that. And then magically, as time goes on, it'll get bigger and
00:19:07your system will naturally get more powerful, which is what you want, because you want to be on a beach.
00:19:13That's what you want to do. That's what I want to be. My kids in Hawaii. Okay, network effects. I have one minute.
00:19:19This is the conclusion. So we talked about five approaches, blah, blah, blah, trust boundaries,
00:19:24custom tools, shared silos, humans in the loop, and this human in the loop black box version. I think
00:19:30this stuff is very powerful. I think the interesting questions a little bit are, within companies,
00:19:36I think this will all work very soon. The big question is, how comfortable are we with something
00:19:41like an auto mode around privacy? And I think the really interesting question that I don't have an
00:19:45answer for, but I think whoever does this will be wealthier than I am, is if you can think of
00:19:52scenarios where you can get multiple companies to agree to their information silos, having a common
00:19:59agent working across them. So there's like a company that I won't name in in in somewhere in the world,
00:20:05working on like finance stuff, where they have a lot of investment banks, and actually the investment
00:20:09banks, there's a benefit to them sharing private data about private companies for purposes of things
00:20:13like lending. And they're starting to look in this direction, where they're trusting each other's
00:20:18agents to be able to work across what before would have been private information, with agents deciding
00:20:23what can be accessed and not. And it's it's cool. It's very cool. And I think once you find some use
00:20:28cases across across companies, I think that would be a really good beachhead to to move more in this
00:20:35direction. So yeah, you know, as a human though, I ask myself, do I trust a future where agents make all the
00:20:43decisions around privacy? I don't know about that. I just think it's a it is for better or worse,
00:20:48the direction things are going. And I just I'm like so good on time. So I'm on time. Thank you for coming.
00:20:53I again. Yeah, thanks for being here.