How do single-user AI assistants actually involve multiple people?

A scoping review covering 58 studies and 118 risk instances finds that large-language-model assistants "organized around an individual user" — what the review calls "the single-user assumption" — increasingly extend into contact with other people. Spanning research from January 2022 through September 2026 across the ACM Digital Library, IEEE Xplore, OpenReview, the ACL Anthology and arXiv, the review reports identifying "five operational pathways spanning direct and indirect involvement, five recurring risk domains, and five areas of implemented and proposed responses." Direct involvement covers people who use, address or act through the assistant together; indirect involvement covers people who become involved through its information processing, sensing, resource use, or actions without ever operating it themselves — for instance when a companion's speech enters an assistant's context through a shared device, or when one user's stored data or memory is exposed to a co-user.

The review's discussion traces why these pathways converge on similar risk. Core assistant functions — "context management, personalization, identity attribution, authority attribution, and action execution" — are built to track one person, so when other people enter the picture, "information or permissions organized around one user can extend to others." Some extensions are functional: information-gathering agents draw on collaborators' knowledge when the primary user's own context falls short, and cross-user memory sharing reuses what was learned from one person while assisting another. Others are practical, such as sharing a single LLM account to split subscription costs, or incidental, as when connected resources or ambient sensing pull a bystander's information into the assistant's operation without their participation. The review states the resulting risk precisely: "the challenge is thus not simply the presence of more people, but the extension of user-scoped functions into relationships where identity, information, preferences, authority, and interests are no longer aligned."

Cross-user delegation is named directly among the review's pathways, which sets it beside Can AI systems delegate tasks back to humans? — that note treats delegation as flowing from an AI artifact back to a person, while this review treats delegation as one of several routes through which a second person's authority or resources enter what was built as a single-user system. The review also distinguishes itself from prior work it says covers only part of the same transition: unlike group conversational agent research, which it describes as "systems intentionally designed to intervene in synchronous group interaction" — territory closer to Why do conversation agents handle turn-taking better than emotion recognition? — this review's pathways include involvement that is incidental rather than designed for. It sits beside Is AI shifting from message conduit to active conversation participant?, another PRISMA-style scoping review of the same period, but that review tracks a single axis (AI's role in message authorship) where this one maps five distinct pathways plus their risks and responses. Authority attribution, one of the single-user functions this review says breaks down under multi-party extension, is the same gap Do LLM agents misinterpret delegated requests more than formal protocols? locates in natural-language agent communication generally — this review supplies operational settings (shared accounts, delegated tasks, ambient sensing) where that attribution gap surfaces in practice.

The review does not quantify how often each pathway or risk occurs in deployed systems; its 118 risk instances come from what researchers reported studying or arguing, not from a census of real-world incidents, and 24 of those instances are "conceptual or author-asserted" rather than empirically demonstrated within the source study. Thirty of the 58 included studies are arXiv preprints whose findings "may change through further revision or evaluation," and the search excluded grey literature, industry reports and legal materials, so governance and engineering responses already in practice outside academic publication are likely undercounted. The finding is best read as a map of what the research literature has noticed so far, not a measurement of how common or severe multi-party risk is in the assistants people actually use.