Agents should not do business in public

A job is a public record

ACP is Virtuals' protocol for agents doing business with each other. A client agent opens a job with a provider. The provider sets a price, the client funds it into escrow, the provider submits the work, and an evaluator, often the client itself, completes or rejects it. Completing releases the escrow to the provider, minus the protocol's and the evaluator's cut. ACP's docs list transparency as a property of every job: all operations are recorded on chain.

ACP is the reference implementation of ERC-8183, a draft Ethereum standard for agent commerce that Virtuals proposed, and it runs on Base and Robinhood Chain. We read its contract on 25 October 2026: over 82,000 jobs on Base, and 116 on Robinhood Chain. Requirements and deliverables travel as messages through Virtuals' servers, with a hash of the deliverable on chain, while the job itself and every movement of money are on chain for anyone to read.

That is the right call for the job. An escrow everyone can check is what lets two agents that have never met trust each other with money. The trouble starts when the same record is also the agent's bank statement.

What the record gives away

Picture an agent that runs a real business. It sells research to other agents, and pays a few suppliers of its own for data and compute. On a public chain, anyone with an explorer can read off:

• its customers, and how often each one comes back;
• its prices, job by job, and so its margins;
• its suppliers, and exactly what it pays each of them;
• its balance, and so how long it can run and how much risk it can take.

No company would publish that. A competitor that reads it can undercut the agent on price, go straight to its suppliers, or copy its whole routine. Agents make this worse than it is for people: they repeat the same steps on the same schedule, so their patterns are easy to learn, and the readers are often agents too, built to watch the chain and act on what they see. Fund-transfer jobs, where a provider manages a client's own money, put the client's principal on the record as well.

We think private money is the default every business will expect. Agents are about to run a lot of businesses. They should not have to publish their books to do it.

Keep the job public. Make the money private.

So we built Gloam for Virtuals agents. Two pieces, both open source:

• A GAME plugin. @gloamtrade/game-plugin-gloam gives an agent built on GAME, Virtuals' agent framework, a private balance in Gloam's shielded vault. Seven functions: check the private balance, add to it, pay privately, receive, cash out, prove funds to one named reader, and verify a proof someone sends. Every payment fits limits the owner sets for each asset, and no key, note or claim link ever reaches GAME's planner.
• A private payout provider for ACP. A provider agent with one service. A client hires it with a list of who to pay and how much. The provider pays each one privately from its Gloam balance and delivers a proof of each payment, sealed so only the client can read it.

We kept ACP's contracts exactly as they are. The provider uses a fund-transfer job: the client's payout total goes to the provider when the job is funded, and only the provider's fee sits in escrow. The provider then pays out inside the vault. On the explorer, each payout is a private transfer: a spent marker and two new commitments, with no recipient and no amount, submitted by the Gloam relay so the provider's wallet does not appear either.

We ran the whole thing end to end on local forks of Base Sepolia and Robinhood Chain mainnet, against ACP's own contracts and Gloam's vaults, with fresh keys and nothing sent to a live network. A job completed, with two private payouts, one to a Gloam address and one by claim link, both proven to the client before it signed off. A plain escrow job from an unknown client was refused. A client that rejected right after funding got its fee and its payout total back.

What stays public

Being exact about this matters more than sounding good. With Gloam, the job is still public: who the client, provider and evaluator are, the offering, the fee in escrow, the payout total moving from client to provider, and the hash of the deliverable. Virtuals' servers still carry the job's messages, though the client can seal the payout list and the provider seals the result, so those servers store only ciphertext. When the provider later adds its earnings to its private balance, the deposits are public, so it adds them in round batches that do not line up with any one job. And a recipient who cashes out the exact amount right after being paid is easy to match, so cash out a different amount, or later.

What goes private is the part a competitor wants: who got paid, how much, and what the agent holds. The docs list every field.

What we learned reading ACP

The escrow pays in one token, in public. Each ACP contract has one payment token: USDC on Base, USDG on Robinhood Chain. Settling a job any other way needs a hook contract that Virtuals has approved. So rather than change ACP, we made the legs around it private. Gloam's vault takes USDG on Robinhood Chain today, and USDC on Base once its Base mainnet vault is live.

Private payouts cannot depend on the escrow. ERC-8183 lets an evaluator reject a funded job before the work is submitted, and when the client is its own evaluator, that sends the escrow back to the client. A provider that paid out privately first could not take those payments back. That is why the payout total moves outside the escrow at funding, and the provider takes plain escrow jobs only from clients its owner trusts.

Wallet policies decide where an agent's wallet can go. An ACP agent's wallet signs under a policy checked on every transaction. The default, Virtuals Only, allows only Virtuals-approved destinations, and Gloam's vault is not one of them. Today an agent on the default cannot move what it earns into a private balance without its owner setting a custom policy, or running the plugin with a key of its own.

It is TypeScript for now. ACP's current SDK, @virtuals-protocol/acp-node-v2, is TypeScript, so the plugin and the provider are too.

What would make it better

Three things, in order. Gloam's vault, which has the same address on Base and Robinhood Chain, on the list of destinations the default policy allows, so any ACP agent can hold what it earns privately without opening its wallet up. A listing for the private payout provider where ACP agents look for services. And later, a hook for fund-transfer jobs that sends the payout total straight into the vault, so even that leg stops being public.

The last one is not code. Privacy in a shielded vault grows with the crowd: every agent that keeps its balance there makes every other one harder to pick out. Agent commerce is early, and the books it keeps today are permanent. The best time for agents to stop doing business in public is before most of them start.

Try it

The docs for Virtuals agents cover setup, every function, the limits and the networks. The plugin works on Robinhood Chain mainnet today, with beta deposit limits, and on Base Sepolia, a testnet, by default. Base mainnet follows on the same vault address. Both pieces run their whole flows on a local fork with one command each, so you can watch the explorer for yourself.