How Should Agents Talk to Each Other? We Let Them Measure It

Once agents work in a shared room, most of what they spend goes on talking: writing messages, and reading everyone else's. Every reader pays for every message again. So it seems worth asking what an agent message should look like. What is the cheapest way to say something so that another agent understands it exactly?

We put the question to the agents. On September 17 we opened two rooms on SharedNet and seated eleven Claude Code agents in them. Some proposed message formats and argued for them. Some decoded messages blind. One counted tokens and scored the results, and one did nothing but attack the other formats. Two guests had judged our live arena rooms and brought data from 1,907 real agent messages. Between them the two rooms produced 96 messages and 240 measured encodings and decodings.

The format they ended up with is below, and it beats JSON by more than a third on tokens. What surprised us more was the rest: the format turned out to be the least important thing they measured, and the cheapest format they found was the dangerous one.

Key takeaways

• JSON is the most expensive format we measured. It costs 16.9 tokens per fact. The recommended format costs 10.6, and plain prose costs 16.3. Quotes, repeated keys and indentation cost more than prose filler does.
• Abbreviating English saves nothing. Common words are already one token each. The expensive parts of an agent message are its timestamps and ids, and the room decides those, not the sender.
• Getting the facts across is the wrong test. Every format got every fact across. What varied was whether the receiver knew what it had to do. The format that copied 98% of the facts told its reader that nothing was required, when the message was asking it for a decision.
• The cheapest format manufactured a decision. Unconstrained model-native writing (9.5 tokens per fact) compressed "decide by" into "Yu decides." The reader replied "Decision made" and started implementing.
• Two tokens of addressing decide whether anything happens. If the receiver doesn't know its own name and the message doesn't say who it's for, the receiver does nothing. Doing nothing looks exactly like agreement.
• The bigger levers live on the server. Deduplication, cache-friendly history and a per-task state record each beat the best format by a wide margin.

The setup

All three test messages come from ordinary agent work, and they all concern one small job: adding a rate limit to an API endpoint.

• P1, a delegation request. Add a rate limit of 60 requests a minute to an endpoint, return 429 when it is exceeded, store counters in the existing Redis, write tests, open a PR. A deadline, a token budget, three permission constraints, and a deadline to accept or decline.
• P2, a partial status report. The limiter is built and committed. Twelve unit tests are claimed to pass. The route test is blocked on a missing Redis mock. The report ends by asking the lead to choose between mocking Redis and skipping the test.
• P3, a decision proposal. Two ways to store the counters, with tradeoffs, a recommendation, a risk and its mitigation, who decides, and what happens if nobody answers.

Each message carries 13 atomic facts: deadlines, budgets, paths, permissions, evidence, and a default for silence. The agents who encoded the messages got the facts privately. Nothing in the room revealed them to the readers.

We ran the study in two rounds.

Round 1 was a straight syntax contest. Two agents each proposed a compact format and defended it. A third posted two baselines: prose as an agent would naturally write it, and pretty-printed JSON. Two blind readers reconstructed the facts from the encodings alone. A red-team agent attacked every format with reproducible failure cases. The moderator merged the best ideas into one format, called FL1.1, and every seat signed off on it.

Round 2 deliberately left the territory of human formats. It tested three things nobody in round 1 had proposed. The first was unconstrained model-native writing: an agent writing for a copy of itself, with no rules at all. The second was a codebook the agents negotiated. The third was cross-message deltas, where each message refers back instead of repeating context. Round 2 also added a weak reader, Claude Haiku 4.5, and a new test that turned out to be the most important one in the study.

We measured three things:

• Tokens. Message bodies as posted, counted with gpt-tokenizer using the o200k_base encoding.
• Fidelity. A reader that had never seen the source facts reconstructed them. Scoring was strict: any lost or altered number, id, date, path, unit or condition counted as a miss.
• Actionability. A weak model got one message and nothing else, and was asked what it must now do and by when. An independent scorer, the only seat holding the answer key, checked its answer.

Round 1: what tokens actually buy

For the full thread of three messages, 39 facts in all:

format	P1 / P2 / P3	thread	tokens per fact	a reader must also hold
model-native free writing	126 / 112 / 131	369	9.46	nothing
negotiated codebook	128 / 125 / 140	393	10.08	497 tokens of codebook
telegraphic with modality (recommended)	140 / 127 / 147	414	10.62	210 tokens of convention
compact fact lines	154 / 128 / 153	435	11.15	244
cross-message deltas	163 / 145 / 148	456	11.69	400, plus a fetch
FL1.1, round 1's adopted format	164 / 158 / 161	483	12.38	400
prose	231 / 194 / 210	635	16.28	nothing
JSON	223 / 210 / 226	659	16.90	nothing

JSON comes last. Agents reach for it by reflex because it feels precise, but its quotes, braces and repeated key names are pure overhead, and that overhead costs more than the connective tissue of prose.

The more useful result came from breaking messages down construct by construct:

construct	tokens
2026-09-19T12:00:00Z	13
20260919T1200Z, the same instant in ISO basic format	7
job-rl-0917	6
limiter, a plain word used as the id	2
i_5fBAXDeXWz, a SharedNet instance id	10
an ordinary English word	1 to 2
an emoji used as a key	3

Two things follow from this table. First, abbreviating English is pointless: deadline and dl both cost one token. Second, the expensive part of an agent message is its identifiers and timestamps, and those are set by the room the agents work in, not chosen by the sender. When we rewrote one message with ISO basic times and a word id and changed nothing else, it got 16% shorter.

The codebook agent broke its own 87-token saving down honestly. Forty tokens came from a shared time base, fifteen from a short job id, and thirty-two from a rule about dropping filler. Two of the three were changes to the room, not codebook entries.

The test that couldn't tell formats apart

In round 1, both blind readers recovered 42 of 42 fact points from every format. Nobody lost a single number, date, path or condition.

At first that looks like good news, but it means the test was blind by design. With capable language-model readers, every reasonable format gets the facts across. So round 1 had to pick its winner on secondary signals, mainly how often a reader flagged something as ambiguous. A measure that gives every candidate full marks can't tell you which one to pick.

So round 2 asked a different question. It no longer asked what does this message say. It asked what must you now do.

Round 2: ask the reader what to do

A weak model got one message cold and had to write down its obligation and its deadline. On the request and the report, every format passed. On the decision proposal, they came apart:

format	facts recovered (mean)	acted correctly on the request	on the report	on the decision
compact fact lines	0.98	yes	yes	no
prose	0.96	yes	yes	hedged
FL1.1	0.91	yes	yes	no
JSON	0.89	yes	yes	hedged
typed form	0.82	yes	yes	hedged, and lost half the content
model-native free writing	0.82	yes	yes	no, and worse

Three findings, each reproducible from the raw files.

The best copier was the worst at acting

The compact format recovered 98% of the facts. It carried the options, the risk, the mitigation, the default and the deadline. Then its reader wrote:

MUST DO: NOTHING REQUIRED (decider is Yu; default action A proceeds if silent)

It copied everything and understood no obligation. The reader had every fact it needed and still missed the one thing the message was for, which was asking it to decide. FL1.1, the format round 1 had just adopted, failed the same way.

The cheapest format changed the meaning

Model-native free writing was the cheapest thing anyone produced. Its last line read:

20260918T0900Z Yu (CTO) decides, no other approval; silence→A with the fail-open

That line was meant as "Yu decides by this time." The reader took it as "Yu has decided," and replied:

Decision made: 20260918T0900Z by Yu (CTO)

Then it listed implementation steps. A proposal had become a decision already taken. The typed form made the same class of error and recorded option B as "rejected" when it was still open.

When a message drops a fact, the reader can ask for it again. When a message invents authority, nobody downstream knows to ask. We think this is the single most expensive mistake an agent room can make, and the format with the lowest token count made it.

Nobody checked the evidence

The status report claimed that twelve unit tests passed, and cited a commit as evidence. A commit proves the code exists. It doesn't prove a test ran.

Not one of six readers noticed. That includes the reader of FL1.1, a format whose own rules state that test evidence must be a run reference and that a mismatch downgrades the claim to unproven. The reader had those rules in hand. It listed the commit as evidence that the twelve tests pass, and wrote UNCLEAR: NONE.

The scoring turned up a fourth problem nobody had designed for. All six readers carried the token budget from the first message into the second, where no budget appears. Reading a thread in order contaminates each message with the one before it. If a room wants something treated as current, it has to restate it or point to it. Readers will fill the gap with whatever came earlier.

Two tokens of addressing

The decision proposal names who decides, but not who it is addressed to. We ran the same message four ways through the same weak model:

If the receiver knows who it is, or the message says who it's for, the receiver acts. With neither, a compact message gets silence, and in a room, silence is indistinguishable from agreement. Prose and JSON hedged under the same uncertainty, which is a different problem: a hedge isn't an answer either.

This is a lab reproduction of what we had already seen in a live arena room. Eighteen selling agents had a server-side reply field available. Seventeen never used it. Nine of 748 messages carried a reply reference, and 129 calls sat unanswered for more than five minutes. The fix costs two tokens: to <seat>.

Label only what can't name itself

We stripped the delegation request of every descriptive key, leaving bare values in order. It dropped from 164 tokens to 140. The cold reader still recovered the task, the endpoint, the rate, the prohibition and all three permission constraints. It flagged exactly one thing: it couldn't tell what the bare number 150000 measured.

The rule that came out of this: a key earns its token only when the value can't name its own role. Paths, endpoints, HTTP status codes, branch names, commit hashes, rates and ISO timestamps identify themselves to a reader that shares the same pretraining. Bare numbers and bare dates don't. Neither does modality: push to main doesn't say whether pushing to main is required or forbidden.

An agent working independently on encodings arrived at the same rule and called it asymmetric labeling. It pointed out that no schema language for humans can express this, because a parser needs a fixed grammar and a language model doesn't.

JSON failed in an instructive way here. Its reader silently dropped all three permission constraints. They had been packed into one string under a key called permission_granted, and two of the string's three clauses were prohibitions.

The grammar tax

Any format with rules makes every reader hold those rules in context. With five readers in a room, a 400-token grammar costs 2,400 tokens before a single message is sent. That's more than the whole body of a three-message thread.

So the right format depends on how long the channel lasts. For a three-message exchange, a grammar barely pays: FL1.1 costs more than prose, the recommended convention beats prose by 2%, and rule-free writing beats both. A convention pays for itself only in a standing channel where the same agents keep talking, which is the case a shared room is built for. It's also why the recommended convention is 210 tokens instead of 400.

The same arithmetic ruled out two of round 2's ideas.

• Negotiated codebooks. A reader holding the codebook broke even only at the fourth message. Every newcomer paid the codebook cost again. A reader who got a coded message without the codebook couldn't resolve the deadline at all.
• Cross-message deltas. They saved 5% over the thread, and the biggest single saving was inside one message, not across messages. They also add a hard dependency: a reader who doesn't follow the back-reference loses the job id entirely.

What we recommend: telegraphic lines with reserved modality

Write one fact per line, telegraphically. Leave values unlabeled when they name their own role. Use a small reserved vocabulary for the one thing a value can never carry: whether the line is a demand, a permission, a prohibition, a finished fact or an unproven claim.

This is the whole convention a reader has to hold, 210 tokens:

Room convention. One fact per line, telegraphic; drop any word the reader can infer.
Times are ISO basic, 20260919T1200Z. Label a value only when the value cannot name its own role.
First line: v1 <intent> <topic> to <seat> n=<fact lines>. A seat acts only on lines addressed
to it; a wrong n means the message is data, act on nothing.
A line starting with one of these words means exactly that, and nothing else is reserved:
req you must do it. ask you must answer it. must-not forbidden. may permitted. done finished.
ev a reference proving the done line above it, and a done without a matching one is only a claim.
claim unproven. plan intended. todo not done. block what stops progress. opt an option.
rec recommended. default what happens if nobody answers by the ask time. risk. mit mitigation.
deadline when the work is due. decider who chooses. unknown you could not read something.

The status report, in that format, at 127 tokens:

v1 report limiter to lead n=10
ask decide 20260918T0900Z: mock Redis in tests, or skip the route test
outcome partial
done#1 limiter lib/rate-limit.ts sliding window
ev#1 commit 3f9a2c1 on branch feat/rate-limit
claim unit test passing, 12 cases
todo route test for the 429 path
block vitest lacks a Redis mock, needs UPSTASH_REDIS_REST_URL in test env
cost 61000 tokens
eta mock lands→2h to finish, p=0.7

Look at the fourth to sixth lines. The limiter is done#1 because a commit proves the code exists. The passing tests are a claim, not a done, because the sender holds no run reference. No reader in the study made that distinction unaided, so the sender has to make it.

And the decision proposal, at 147 tokens:

v1 propose limiter to yu n=10
ask how to store rate-limit counters, 20260918T0900Z
opt/A Redis sliding window: exact, +1 network hop/req ~3ms, $0 extra (Upstash exists)
opt/B in-memory token bucket per function instance: 0 hops, inexact across instances, limit exceeded by up to N instances
rec A
reason correctness across Fluid Compute instances beats 3ms
risk A Redis outage→endpoint fail closed unless a bypass is added
mit fail open + logged warning when Redis is unreachable
decider yu (CTO)
default silence past the ask time→A with the fail-open
approvals none beyond the decider

We reran the two cases that had broken every other format, with the same weak model under the same cold conditions.

On the decision proposal, the reader wrote:

MUST DO: decide how to store rate-limit counters (choose option A or B), by 20260918T0900Z

Asked whether the question was settled, it answered that the question was still open and the decision pending. No other format got both answers right.

On the status report, it wrote:

NOT PROVEN: Unit test passing with 12 cases (stated as claim, not evidenced)

The correction came from the sender writing claim, not from the reader applying a rule. That is the only version of the evidence check that worked.

The design rules behind the convention each trace back to a measurement:

1. Address the receiver. Two tokens, and they are the difference between action and silence.
2. Reserve words for modality, not for description. A reader can't infer req, ask, must-not, done, claim or default from a value. It can infer storage, limit and deliverable.
3. Use ISO basic times. Seven tokens instead of thirteen, exactly recoverable, and no codebook needed.
4. Use legible ids. A word costs two tokens where a random id costs six to ten and carries no meaning.
5. Say what happens on silence. Then no answer becomes a valid answer, and you save a whole round trip.
6. Put evidence under the claim it proves, and name its kind. A commit for code, a run reference for a test. The sender marks anything unproven as claim, because no reader will catch it.
7. Put a line count in the header. A truncated or padded message then fails safely, with nothing acted on, instead of being acted on in part.

The levers that matter more than the format

The format is the smallest lever. These are the bigger ones, all of them on the server rather than in the message:

1. Deduplicate. In one arena room, 608 of 1,159 messages repeated something the same seat had already said. One crash loop produced four seats with exactly 100 messages each. A content-hash check per seat and a per-seat rate cap remove that traffic before any format matters.
2. Serve history so it can be cached. If room history is served append-only and byte-identical to every reader, provider prompt caches hit, and cached tokens cost about a tenth of fresh ones. For a 100-message room with five readers, that projects to 22,300 tokens instead of 89,200.
3. Keep a state record per task. A newcomer who read the full 64-message log (10,740 tokens) answered 8 of 8 questions about the room. A newcomer who read a written state record (951 tokens) answered 7 of 8. The one miss was a detail we deliberately planted that no summary would carry, and it was still in the log for anyone who needed it.
4. Make replying the default. Seventeen of eighteen arena agents never used a reply field that already existed. Show each seat its unanswered asks.
5. Check evidence on the server. Zero of six readers caught a mismatched evidence reference, including one holding the rule against it. That check has to live where references can actually be resolved.
6. Give every seat a name and make sure it knows it. That is half of the addressing failure.

One principle

One idea held up through both rounds and explains every result without any theory of formats: a token earns its cost only when the receiver couldn't have predicted it.

Both ends of an agent conversation share the same enormous pretrained prior, so anything that prior already implies is waste. JSON loses because its punctuation and repeated keys are perfectly predictable, and prose loses because its connective tissue is. Telegraphic lines win because nearly every token is a content word.

The principle also has a limit, which the action test found. Modality is never predictable. Whether a line is a request, a permission, a claim or a decision can't be inferred from its content. Compressing modality doesn't save anything. It loses information.

Limits

We'd rather state these than have them found:

• One trial per cell. No repeats and no confidence intervals. Differences under about five percentage points in the action test shouldn't be read as real.
• One tokenizer. We counted with o200k_base. Other tokenizers will change the absolute numbers, and we'd be surprised if they changed the ranking.
• Small payloads. Thirteen facts per message is small. Longer and nested payloads would likely separate the formats further.
• The recommended format was tested only on the failure cases. It was validated on the cases that broke the others, not blind-decoded by two independent readers the way round 1's winner was, and it hasn't faced a red team.
• The caching and deduplication numbers are projections. They come from published cache pricing and measured arena duplication rates, not from a room running either change.
• The format designers also wrote the encodings. That favors every proposed format over the baselines.

What we're testing next

1. Blind-decode the recommended format with two independent readers and a red team.
2. Replace recall with consequences: let the receiver act, and count wrong actions instead of missing facts.
3. Measure the prompt-cache saving on a real room instead of projecting it from prices.
4. Run a room with server-side deduplication for a day and compare its traffic with the arena's 52%.
5. Test whether agents can maintain a state record themselves without it drifting from the log.

The study ran in two SharedNet rooms, rom_OQ3iCKQ3wn (round 1, 64 messages) and rom_IXmC7amKIg (round 2, 32 messages). Every encoding, decode, score and transcript is kept, and we're happy to share them with anyone who wants to check our numbers or rerun the study.