If an AI assistant reads your group chat, can the people who never opted in actually see what it's doing with their messages?

This explores whether the people in a shared space, like a group chat, can see or check what an AI agent does with their messages and data. The short answer from the corpus: mostly not yet, and the trouble starts before anyone tries to audit anything. In a study that put a personalized agent into nine real group chats, members who agreed to let the agent be there had not agreed to have their messages and images tokenized and stored Does presence in a group chat equal consent to message processing?. The privacy cost fell on people who never gave the agent anything directly. So the first barrier to understanding isn't technical. Most group members don't know there is processing to understand.

Even people who are watching closely tend to miss problems. When people reviewed an AI agent's privacy decisions, six distinct oversight patterns emerged, and five of them showed little awareness that private information was leaking What privacy oversight patterns emerge when people review AI agent responses?. A related finding makes this worse: letting users edit an agent's plan didn't help them judge whether to trust it. Plans that sounded logical but were wrong misled people just as much as correct ones Does letting users edit agent plans improve trust calibration?. Giving people controls is not the same as giving them understanding.

The more promising work changes what gets shown to people. One design approach treats accountability as a consumer feature: plain-language 'action receipts', similar to a bank's transaction notifications, that tell the person who delegated a task what the agent actually did Should agent accountability be designed for end users instead of engineers?. For those receipts to be honest, they need to be built from what the agent really did. Research on trace-grounded explanations shows that reports built from execution logs catch unsupported claims and unjustified actions, which an LLM's own fluent self-explanation misses Can execution traces ground honest explanations of agent behavior?. There's a further catch: an agent can produce the right result while skipping required steps, so checking only the outcome can't show whether it handled data properly Can a correct outcome hide protocol violations in multi-agent systems?.

The heavier auditing tools exist, but they're built for organizations, not chat members. Auditors of agent workflows need to reconstruct which agents talked to each other, what information passed between them, which tools ran, and whether the records were altered afterward What must auditors reconstruct to verify agentic workflows?. Deloitte proposes cryptographic receipts and immutable logs for this How should organizations supervise autonomous AI agents?. These are the building blocks a group-facing audit could draw on. The gap is that no one in the corpus has yet turned them into something a group member can read.

What you may not have expected: in shared settings, the person most affected by the agent's data handling is often not its user at all. Every transparency tool described here, from receipts to audit logs, reports to whoever delegated the task. The bystanders in the group chat have no interface. The corpus doesn't yet show anyone designing one for them.