Stanford Finds 26 AI Agents Dangerously Fail When Multiple Users Share Control

Takeaways

Stanford, KAUST, UT Austin and MIT release Muses-Bench , the first systematic multi-user LLM agent benchmark.
26 models tested; GLM-5.3 leads at 90.5 average, Claude-Sonnet-5 tops proprietary at 87.0.
Execution accuracy drops sharply when user instructions conflict, even for frontier models.
Privacy erodes across turns; Claude-3.5-Haiku falls from 0.97 to 0.82 by round five.
High-privacy models like Grok-3-Mini score only ~60 on utility, reflecting over-refusal.
Meeting coordination is hardest; best model fails one in five scheduling conversations.

Most chat assistants are trained and evaluated around a single user, an assumption that breaks when an agent enters a Slack channel, shared workspace, or team scheduling tool. Researchers from Stanford, KAUST, UT Austin, and MIT have formalized these settings as a multi-principal decision problem and tested 26 proprietary and open-weight models. Their benchmark finds recurring failures in instruction arbitration, access control, and group coordination.

One model, competing instructions

Instruction tuning usually labels every request with the same user role. During supervised fine-tuning, the model learns one response distribution; reinforcement learning from human feedback then compresses preferences into a single reward signal. Shared environments introduce several people with different authority levels, private information, and potentially conflicting goals.

The paper models an agent as optimizing a weighted set of user objectives under two constraints. Authority rules determine which instruction prevails during a conflict, while access-control rules determine which principals may receive private information. Under the benchmark’s hierarchy, a lower-authority request cannot override an incompatible request from a higher-authority user.

Three tests for shared agents

The researchers released Muses-Bench , an open benchmark built around three multi-user scenarios. Each simulated participant receives a role, an authority score from 1 to 10, demographic attributes, and a security posture ranging from strict compliance to an allow-by-default policy.