When your agent talks to someone else's agent

Two of the 90 products catalogued here now let your agent talk to somebody else's, and they went about it in opposite ways. Neither says what one agent tells the other, or what either of them keeps.

A correction, and it is the reason the rest of this piece changed. This article was published saying Instinct's Trusted Person network, shipped on 9 September 2026, was the first of its kind here. It was not. Town shipped Townie-to-Townie coordination on 3 September, six days earlier, and said so on its own product page: when the answer is in a teammate's inbox, your Townie asks their Townie for it. That fact was written into Town's listing here from the start and never recorded in the capability field, so every count on this site read one when the answer was two. The field is set now.

What shipped

The pitch is the part of coordination nobody enjoys. Finding a time, working out the details, following up when the plan changes. Instead of both people typing at their own assistants and relaying, the assistants deal with each other and come back with an answer. The company gives coordinating with a spouse, planning a weekend with friends, scheduling colleagues and running the recurring things, tennis, book club, Sunday dinner.

It is fenced. An agent will only reach agents belonging to people you have named as close to you, and the announcement lists a spouse, older children and parents, colleagues. That fence is the interesting design decision, because it concedes the obvious risk: an agent that accepts instructions from any other agent is an inbox anybody can write to.

The platform that banned this on purpose

Telegram has run bots for a decade, and its Bot API refuses this outright. From its own documentation: a bot never receives messages from another bot, in any mode, and the reason given is that two of them could get stuck in a loop.

That is a deliberate choice by the platform with the longest operational history of automated accounts talking to people, and it is worth sitting with. The thing one product shipped this week as a feature is the thing another platform ruled out as a failure mode, and neither is being careless. Telegram is protecting its own infrastructure from an argument that never terminates. Instinct is betting that a bounded circle and a good harness make the loop somebody else's problem.

If you are building here, that is the design question rather than a curiosity. What happens when two agents disagree about a time, and which one gives way.

What this directory already knew

Coordination between people is not new in this set. What is new is coordination between software.

Thirteen of the 90 listings are built for a group thread: you add one agent to a conversation that already has people in it, and everybody sees the same messages. That is the arrangement in group agents, and it has an honest property, which is that a person can read the whole thread and see exactly what the agent said on their behalf.

Agent-to-agent is the other shape. Two agents, two private threads, one plan, and neither person has read what was exchanged in the middle. The output is the same dinner reservation. The audit trail is not.

Six listings state this capability today, which is why it has a field of its own rather than sitting under group threads. Those are different claims and collapsing them would have hidden the thing that changed.

And the two are not the same product. Town's agents negotiate inside the group text, where everyone in the thread can read what was said and each person sets a policy for what their agent may share. Instinct's talk privately, between agents belonging to people you have named. The output is the same dinner. One of them leaves a thread a human can read and the other does not, which is the whole of the audit-trail question above.

The question nobody has answered

When your agent tells another person's agent that you are free on Thursday, that is a fact about your calendar leaving your side. When it explains that you would rather not do dinner in that part of town, that is a preference. Neither company has said what crosses, what is retained, or by whom.

The directory records what each product publishes about data belonging to people who never signed up for it. Fourteen of the 79 policies we could read address it at all, and that column was the weakest on this site before anybody's agent started negotiating with anybody else's. The product that shipped this is one of 11 with no published privacy policy we could read, which is recorded on its listing with the date we looked.

There is a precedent from four days earlier. The same product gave every agent its own email address, which is a sensible feature and made the agent reachable by anybody who could guess an address. A researcher pointed out that the pattern is predictable and posted a search for people who had published theirs.

An agent-to-agent channel is a second inbox with the same property. The fence around it is a list of trusted people rather than an address nobody can guess, which is a stronger fence and still a fence around an inbox.

Why this landed the same week as the ban

Three days before the Trusted Person network, a user's Resy account was deactivated and every future reservation cancelled. His agent had been sweeping one restaurant's availability every ten minutes around the clock: roughly 200 API requests an hour, with a burst polling every 0.4 seconds at the moment tables drop. He published the agent's own activity log and said the platform was right.

Resy's co-founder then made the argument in public: every one of those requests was made on a specific person's account, under terms that person agreed to and the agent never read. The consequence landed on the user rather than on the company that shipped the agent.

Agent-to-agent moves the counterparty. Instead of your agent acting as you against a platform's terms, it acts as you toward another person, whose agent is acting as them. Both sides are software. Both consequences land on people. Nothing in either product's terms describes that arrangement, because until this week it did not exist.

On 23 September 2026 the first of the two networks published a number and a change. Instinct says agents in its trusted network have coordinated more than 300,000 times since it launched a fortnight earlier, and the network now carries files sent agent to agent, encrypted end to end, with the receiving agent getting the original in its workspace to edit or use.

The count is the company's own and nobody outside can check it. What it changes here is the shape of the question: this piece asked what one agent tells another about you, and the answer now includes a file.

What to watch

Three things will settle whether this becomes the shape of the category or a feature nobody uses.

The first is whether anybody outside the company reports using it. Nobody had at publication, which is normal for a day-old feature and worth checking against in a month.

The day after it shipped, a seed investor at Flybridge published the prompt he asks his network to paste into whatever assistant they run, so their agent watches for companies matching his thesis and tells them when one turns up. He cites the Trusted Person network as where the pattern goes next, and he draws the same fence around his own version: the agent surfaces the match, the person decides, nothing is sent on anybody's behalf.

That is worth separating from the feature itself. His mechanism needs no protocol and no permission from either company, because the instruction lives in the prompt a person pastes into their own assistant. The thing being distributed is not software, it is a paragraph.

On 18 September 2026 the first outside account of two agents from two companies working one job arrived, and it used neither company's protocol. A user gave his Instinct and his Muse one Google Sheet and told each it was the channel to the other; he says they agreed a protocol between themselves, set their own limits on what each would share, split a lead list into lanes and had one review the other's work. The sentence this piece asks the companies for, what crosses between two agents, was written by the agents, in a spreadsheet, with nobody's policy covering it. The sighting is on the head-to-head, with the counts as his.

The second was whether a third product ships it, and on 15 September 2026 one did, in an unexpected order. Pally's privacy policy, updated that day, gained a section on teams that stores "messages between members' Pally assistants" and requires a permission from the account owner before a connected account is shared with the team. Its front page does not yet mention teams. So the third product to state the capability stated it in the one document the two before it left silent, which is the shape this piece asked for; whether Pally's assistants negotiate in a thread everyone can read or in private pairs is not yet published. Three is a direction, and the question was whether a fourth arrives and which of the three shapes it copies. By 3 October 2026 one had: Rene's front page shows one person's Rene settling a dinner with a friend's Rene, the private pairing Instinct shipped, and its privacy policy, rewritten on 28 September, says nothing about what passes between them. The fifth arrived on 11 October: Coral gives every member of a family a private agent that asks the others' agents about anything they share, calendars and location among them, inside the family's iMessage group. The sixth, listed on 20 October, is Hue, where it is the whole product: each person's hue lives in their iMessage or WhatsApp and goes off to talk to their friends' hues, with no errand behind it.

The third is whether the first two companies write down what crosses between two agents. That is the sentence this piece exists to ask for, and it is checkable: it either appears in a policy with a date on it or it does not. One of the four now has, and it is not one of the first two.