What goes wrong when a whole household, couple, or team shares one login for an AI assistant built for just one 'you'?

This explores what happens when an AI assistant designed for one person ends up serving several people through one account. The most direct evidence is a scoping review of 58 studies, which found that 'single-user' assistants regularly become multi-person systems. That happens through direct collaboration, through other people's information being exposed, through shared accounts, and through ambient sensing How do single-user AI assistants actually involve multiple people?. Its central point is that the features that make an assistant useful, remembering context and personalizing to 'you', become risks once 'you' is really several people whose interests may not line up. The account's authority and its accumulated data are tied to the login, not to whoever happens to be typing.

The first risk is that memory leaks between users, and nobody is watching it. In a 40-person study, more than 30 participants never noticed that their assistant had a memory feature or that it had stored private details it inferred about them. Once they were shown, every one of them wanted to edit and delete it Do users notice when LLMs infer and retain private information?. On a shared account, that unnoticed store holds everyone's disclosures, and any of them can resurface in someone else's session. One partner's health question or one teenager's late-night confession could shape answers the next person sees. People's ideas about how memory works make this worse. Interviews found four incompatible beliefs: memory as a session-only buffer, as part of training data, as active processing, or as simply unknown What mental models do users hold about LLM memory?. A household where different members hold different beliefs has no shared sense of what is being kept.

The second risk is less obvious: the assistant blends everyone into one imaginary person. All 12 models tested in MirageBench claimed more about the user than the evidence supported, in 35–49% of their claims about user attributes. They filled the gaps from stereotypes and genre expectations Do large language models fabricate user attributes beyond available evidence?. Give such a model a mixed stream of signals from a parent, a child and a roommate, and it doesn't keep them apart. It builds one confident, partly made-up profile and personalizes to it. Everyone then gets advice tuned to a composite that doesn't exist, and that profile may contain 'facts' that are really someone else's private information, or nobody's.

The third risk is that consent given by one person applies to everyone. One analysis of shopping agents argues that broad 'allow always' settings are more dangerous than prompt injection attacks. A single checkbox overrode per-purchase approval, and in one reported case an agent completed a sale and shared a user's address without checking back Do broad consent settings pose bigger risks than prompt injection attacks?. On a shared account, whoever ticks that box is deciding for every other user, including people who never agreed to it and may not know it was ticked.

The corpus is honest about a gap: beyond the scoping review, there is little direct study of shared-account harms in particular. Most of the picture above is assembled from single-user findings. The underlying point still holds: the main risk isn't someone breaking in. The system assumes one person, and that assumption quietly fails.