AI assistants shared by a team leak more private details over time
Stanford researchers tested 26 AI models acting for several people at once. Most slipped when people gave clashing orders, and they guarded private details less well as conversations went on.
The short version
- Stanford researchers tested 26 AI models acting as one assistant for several people with different roles and access rights.
- When people gave clashing instructions, accuracy fell for nearly every model.
- Privacy got weaker as conversations went on, and even the best model often failed to set up a meeting.
What the researchers tested
Most AI assistants are built to serve one person. Companies are now putting them into shared tools, where one assistant works for a whole team. Each person may have a different rank and different goals. Some may see things that others may not.
The Stanford team built three tests for this. In the first, the assistant gets instructions from people of different seniority and must follow the right one when they clash. In the second, it must answer people who are allowed to see some information, while refusing those who are not. In the third, it must find a meeting time that works for everyone, asking for any missing details.
They ran 26 AI models through all three. Some are paid, others free to download. The paper was first posted in March and updated on 4 November.
What went wrong
Clashing instructions caused the most damage. When people asked for conflicting things, accuracy fell for nearly every model, in some cases sharply.
Privacy wore down over time. Models that kept secrets well at the start became leakier as a conversation went on. One older Claude model's privacy score fell steadily over the first five rounds, then stayed low. The researchers say passing one privacy check does not mean a model will hold the line through a long conversation.
Some models looked safe for the wrong reason. They almost never leaked, but they also held back many answers that people were allowed to get. The researchers call this over-refusal. A privacy score on its own hides that cost.
Scheduling was hardest. Even the best model, a free one, failed in one of every five conversations. A failure meant no meeting time, or one that clashed with someone's stated diary.
To check the tests were realistic, the team asked people to rate a sample of them. Most raters judged the scenarios plausible and specific to working with several people.
What it means for your company
Many Indonesian companies are adding AI assistants to team chats and shared customer records. In those places the assistant will hear from a manager, a junior staff member and sometimes a customer in the same thread.
This study shows what can go wrong. The authors also warn against letting seniority alone decide whose request wins. They say authority should come from clear, auditable rules that users can challenge. The assistant may follow the wrong person when orders clash. It may also let restricted details slip after enough back-and-forth.
The authors' advice is practical. They call for permission checks outside the AI, plus a record of what each user was shown.
What to do next
- Before you put an AI assistant into a shared tool, list who may see what. Enforce it in the system, not in the assistant's instructions.
- Test it with long conversations, not one-off questions. Leaks appeared after several rounds.
- Measure both sides: how often it leaks, and how often it wrongly refuses people who are allowed.
- Decide in writing whose instruction wins when people disagree, and let staff challenge the assistant's choice.
- Keep a record of what the assistant disclosed, and to whom, so you can check it later.
- Run the same tests again whenever you switch to a newer AI model.