In an AI Engineer talk, Jean-Denis Greze demoed five designs for agent to agent network effects that try to pull Gmail, Slack and wiki data into one context window without granting global access. He showed the failure needs no remote exploit, only local policy or prompt flaws.
Greze is CTO at Town and former CTO at Plaid, now building assistants for nontechnical users where agents have to work across personal and company silos.
How the attack actually works
Think of the context window as a courtroom table where only admitted evidence can be placed before the judge rules. Agents are just trying to get the right evidence on the table.
The five approaches are a shared agent inside a trust boundary, a scoring tool that hides raw emails, an auto-updated shared wiki or skill store, humans as manual conduits, and a black box router that scans all silos then asks only the relevant owner for approval.
The black box variant fails if policy is vague or prompt injection slips a malicious instruction into a silo, because a single poisoned note can be pulled into the shared space and then treated as truth.
What is broken and why it matters
Companies want network effects without creating a god agent that sees everything, so they're choosing tools and wikis that trade raw access for derived signals and that improve as models get better at enforcing policy.
Greze bets the near term winner is a sweeper AI that watches private silos and pushes low sensitivity facts to shared stores, with explicit human approval for finance and HR data and full logging for audit by security teams.
Anthropic already normalized auto mode for code approvals, and Greze sees the same path for privacy where more disclosures become automatic as policy encoding improves, though cross company sharing remains the hard unsolved beachhead.
No vendor here ships a verifiable black box today, and without reversible logs plus injection defenses the network effect becomes a disclosure liability.
