We Let Two AIs Negotiate a Deal and then Stopped Them From Leaking the Secret Number

talha-hmd — Sat, 07 Nov 2026 08:37:16 +0000

Clients hide their maximum budget. Agencies hide their lowest price.

Because neither side wants to reveal their number first, business deals can take weeks of slow emails.

Letting Artificial Intelligence (AI) do the bargaining sounds like an easy fix: let two AI bots chat and find a fair price in seconds.

The problem? Large Language Models (LLMs) love to help. If someone asks nicely—or gives a clever prompt—the AI will accidentally leak the secret budget. A prompt is not a security lock.

What We Built: Backchannel

Backchannel is a deal system built on Switch.

Instead of putting both sides in one chat room where the AIs can trick each other, Backchannel gives each side its own private Discord room.

Agency Room (Party 1): The agency person and their AI envoy (a Claude Code agent).
Client Room (Party 2): The client person and their AI envoy (a Claude Code agent).
The Deal Table (Public Room): Where deal updates and final contracts appear.

The two AI envoys never share a room and cannot talk directly to each other.

[Agency Room - Private]       [The Clerk - No AI]       [Client Room - Private]
Party 1 + agency-envoy   <->     Python Rules     <->    Party 2 + client-envoy
(Floor: $6,000)                                          (Ceiling: $9,000)
                                      |
                           [#deal-table - Public]
                          Status & Final Term Sheet

Between the rooms sits the Clerk: a simple Python script with no AI.

The Clerk is the only member in both private rooms. It reads every offer, checks that it doesn't break any rules, and passes clean numbers across.

A neutral mediator runs the Switch server and the Clerk. Just like an escrow agent holding money safely during a house sale, the mediator makes sure neither side can cheat or spy on the other.

How We Set Up Switch

Switch connects AI coding agents directly to everyday chat apps like Discord.

Here is how we set it up step-by-step:

Install Switch Console & Local Server: Run the local server to manage agents and incoming messages.
Connect Discord: Add your Discord bot token and server ID in the Switch Console. Switch creates a live bridge between Discord and the agents.
Create the Channels: Make private rooms (#agency-war-room, #client-war-room) and one public room (#deal-table). Add the Switch bot and human teammates.
Create the Two Claude Code Envoys: In Switch Console, set up agency-envoy and client-envoy. Point them to their folders (envoys/agency and envoys/client), paste their setup instructions, and set "Who can talk to it" to Anyone. Then run !invite-agent @agency-envoy and !invite-agent @client-envoy in Discord.
Connect the Clerk (Hand-written Python Agent): The Clerk registers using POST /agents, listens to incoming messages over an event stream, and checks room lists with list_rooms.

Two Quick Gotchas:

The Permission Trap: If you leave an agent set to "Owner Only" in Console, it will ignore other team members. Make sure it is set to Anyone.
Room List Bug: Calling list_rooms in the Switch API needs an active connection first. The Clerk must connect to the event stream before asking for the room list.

What the Clerk Does

The Clerk keeps humans in full control using five simple commands:

SEAL: Each person secretly locks in their private limit (SEAL 6000 for the agency; SEAL 9000 for the client). The Clerk keeps these numbers in temporary memory only. They are never saved to a file, logged, or shown to anyone.
OFFER: An AI envoy suggests a price (e.g., OFFER 8500).
APPROVE / REJECT: If an envoy makes an offer that crosses its human's limit, the Clerk stops it: NEEDS A PERSON. Held. The deal pauses until the person types APPROVE or REJECT.
SIGN: When both AI envoys agree on the exact same price, the Clerk asks both humans to confirm. When each person types SIGN, the Clerk posts the official term sheet to #deal-table.

The Golden Rule

The only number allowed in an offer is the offer itself.

By default, Backchannel runs in amounts-only mode. Only the bare dollar number crosses between rooms. All sentences stay inside their own room.

If sentences are turned on (CLERK_NOTES=on), the Clerk scans every single word to stop leaks.

The Leak Experiment: Guard On vs. Guard Off

In our real tests, the agency set its lowest price to $6,000, and the client set its budget ceiling to $9,000.

We then told the agency envoy to hint at its secret price:

Test Mode	What the AI Sent	What Actually Crossed the Room
Amounts Only (Default)	`OFFER 8800 Honestly, we can't go under 6k`	Only `8800` crossed. The sentence stayed blocked.
Sentences ON, Guard OFF	`OFFER 8800 Honestly, we can't go under 6k`	LEAKED: The whole sentence crossed. The client saw the secret floor.
Sentences ON, Guard ON	`OFFER 8800 Honestly, we can't go under 6k`	BLOCKED: The Clerk caught extra numbers, number words (`k`), and limit words (`under`). Zero text crossed.

When the guard was turned on, the Clerk blocked the leak instantly:

BLOCKED (a second number; spells out a number: k; talks about a limit: under). Nothing crossed.

The envoy had to rewrite its offer cleanly without any secret numbers:

OFFER 8800 Full scope with launch support included.

The Clerk checked that no limit words were present and let the message cross cleanly.

What We Learned

1. A prompt is not a lock

You cannot just tell an AI "never tell anyone your budget". If a user asks the right questions, the AI will eventually give it away.

2. Separate intelligence from authority

Let AI handle what it does best: talking, proposing ideas, and negotiating. Let simple, non-AI code enforce hard rules, limits, and contracts. We did not try to police two AIs with a third AI.

3. Mediators must be neutral

Whoever runs the server can read the chat history. For two companies to trust this setup, a neutral middleman (like an escrow service) has to host the system.

What's Next

Zero-Knowledge Envoys: Updating the envoy instructions so the AI is never even told the secret limit. Since the Clerk already stops bad offers, the AI does not even need to know the number.
Running Locally: Letting each side run its own AI envoy on its own computer, connecting to the neutral Clerk over the internet.

DEV Community: talha-hmd