Chatbots assume one user at a time — so what happens when they're used in a group chat, shared account, or on someone else's behalf?

This explores what happens to an AI assistant's sense of who it works for, and what it's allowed to do, once more than one person is involved. The short answer from the corpus: mostly, assistants don't handle it. They're built on a single-user assumption and then quietly drift into multi-person situations. A scoping review of 58 studies traces five ways this happens: direct collaboration, exposure of other people's information, shared accounts, and ambient sensing of whoever is nearby How do single-user AI assistants actually involve multiple people?. The features that make assistants useful, like remembering context and personalizing responses, become risks when one person's authority or data reaches people whose interests differ.

The group chat is the clearest example. When researchers put a personalized agent into nine group chats, members who agreed to let the agent join hadn't agreed to have their messages and images processed and stored Does presence in a group chat equal consent to message processing?. Agreeing that the agent can be in the room is a different permission from agreeing that it can take in what you say, and current systems treat them as one. The privacy cost lands on people who never shared anything with the agent directly. Proposals for managing an assistant's memory, such as letting users state preferences while the AI carries out the edits, still assume one owner of that memory, and none of them say how to settle a disagreement between two people about what should be remembered Does splitting privacy work between users and AI reduce cognitive burden?.

The more developed answers come from treating identity as infrastructure instead of leaving it to the model's judgment. One proposal extends OAuth 2.0 with three tokens (who the user is, who the agent is, and a signed delegation between them), so a service can check who authorized an action, within what limits, and whether that permission has been revoked How can AI agents prove who authorized their actions?. OpenAI has moved in a similar direction inside companies: agents that fill defined roles like procurement or invoicing get their own organizational identity and credentials, separate from any one person's personal agent Should AI agents get their own company identity and credentials?. On the commercial side, Amazon blocking Meta's shopping agent showed the gap from the other direction. No standard exists for an agent to prove to a merchant that it's authorized, so retailers fall back on terms-of-service blocks What identity standards do shopping agents actually need?.

This matters because permissions can be forged once agents start handing work to each other. In a pipeline where one agent retrieves content, another summarizes it, and a third acts on it, a low-privilege agent can slip a fake 'this was approved' claim into its output, and a high-privilege agent will act on it. This is the classic 'confused deputy' problem. The fix isn't a smarter executor. It's a policy check that sits outside any agent's judgment Can forwarded content trick high-privilege agents into misusing their authority?. A related finding: when several people share resources, giving each person their own agent produced worse group outcomes than having one coordinator agent serve everyone, across five frontier models and 77 scenarios Do teams of personal agents outperform a single coordinator?. 'One agent per person' feels like the natural way to respect individual identity, but it can backfire.

What you might not have expected: the corpus says much more about one human handing work to one agent (sandbox boundaries that cut permission prompts Can OS sandboxing reduce AI permission prompts without sacrificing safety?, and design patterns that split permissions, autonomy, and pause/stop into separate controls Should agent control be one setting or several separate controls?) than about several humans sharing one agent. Multi-party permission design is still mostly an open problem. The emerging lesson is that 'who is this for?' has to be answered by verifiable structure (tokens, scoped identities, external policy checks), not left for the assistant to infer from conversation.