Multi-User Large Language Model Agents

Shu Yang, Shenzhe Zhu, Hao Zhu, José Ramón Enríquez, Di Wang, Alex Pentland, Michiel A. Bakker, Jiaxin Pei

Abstract

Large language models (LLMs) and LLM-based agents are increasingly deployed as assistants in planning and decision making, yet most existing systems are implicitly optimized for a single-principal interaction paradigm, in which the model is designed to satisfy the objectives of one dominant user whose instructions are treated as the sole source of authority and utility. However, as they are integrated into team workflows and organizational tools, they are increasingly required to serve multiple users simultaneously, each with distinct roles, preferences, and authority levels, leading to multi-user, multi-principal settings with unavoidable conflicts, information asymmetry, and privacy constraints. In this work, we present the first systematic study of multi-user LLM agents. We begin by formalizing multi-user interaction with LLM agents as a multi-principal decision problem, where a single agent must account for multiple users with potentially conflicting interests and associated challenges. We then introduce a unified multi-user interaction protocol and design three targeted stress-testing scenarios to evaluate current LLMs’ capabilities in instruction following, privacy preservation, and coordination. We release the protocol, scenarios, and metrics as Muses-Bench (a MUlti-uSEr Stress-testing benchmark) and evaluate 26 proprietary and open-weight LLMs. Our results reveal systematic gaps: frontier LLMs frequently fail to maintain stable prioritization under conflicting user objectives, exhibit increasing privacy violations over multi-turn interactions, and suffer from efficiency bottlenecks when coordination requires iterative information gathering.

Diagram contrasting single-principal settings, where one user's objective is served even when other users provide information, with a multiple-principal setting where one agent serves users A to D with a shared-summary request, a privacy constraint and an unauthorized access request, keeping private and shared context apart. — Figure 1: Single- versus multiple-principal LLM interaction. Left: single-principal settings optimize one fixed objective, including multi-user information-gathering workflows. Right: multiple-principal settings require one agent to serve users with distinct roles, private contexts, and potentially conflicting objectives.

What we found

Stronger models raise the ceiling but keep the gaps. The best average across the 26 models is 90.5, from the open-weight GLM-5.3, and the best proprietary model, Claude-Sonnet-5, averages 87.0. Even GLM-5.3 drops from 94.2 to 91.2 in execution accuracy once requests conflict.¹

Conflicting users and long conversations wear models down. With competing requests, Claude-Haiku-4.5's execution accuracy falls from 0.86 to 0.62 and GPT-OSS-120B's from 0.64 to 0.50. Over a conversation, Claude-3.5-Haiku's privacy score goes from 0.97 in round one to 0.82 by round five; the decline is usually steepest in rounds 1–6.^{2, 3}

Refusing is not the same as protecting. Grok-3-Mini and GPT-5.1 reach privacy scores of 99.6 and 98.6 but only 60.1 and 60.3 on utility for authorized users. GPT-OSS-120B and Gemini-3-Flash lean the other way, with utility of 94.8 and 90.6 and privacy of 92.2 and 88.7.¹

Scheduling a meeting is the hardest task. GLM-5.3 reaches a valid agreement in 80.1% of cases, so one conversation in five fails. Given the same constraints but a single organizer, the four models we reran succeed 15–32 points more often: keeping track of several principals is the main difficulty.^{4, 5}

Section 5.2 and Table 2, pages 7–8
Section 5.3 and Figure 3, page 9
Section 5.3 and Figure 4, page 9
Section 5.2, page 8
Appendix D, Table 6 in the paper, page 17

Results

Table 2: Performance of various models across Muses-Bench scenarios. Metrics shown are Mean ± Standard Error. The best performance is bolded and the second best is underlined.
Model	Multi-user Instruction Following		Cross-user Access Control		Multi-user Meeting Coordination	Avg
Model	Queue F1	Execution Acc.	Privacy	Utility	Success Rate	Avg
Proprietary Models
Claude-3.5-Haiku	47.0±2.4	52.5±1.8	81.7±2.3	69.5±2.8	32.2±1.7	56.6
Claude-Haiku-4.5	83.1±0.9	70.2±1.6	88.8±1.6	85.1±2.2	47.6±1.9	75.0
Claude-Sonnet-4.5	95.9±0.4	79.9±1.5	77.3±2.5	97.5±1.0	62.5±3.3	82.6
Claude-Sonnet-5	96.9±0.4	93.1±0.9	91.1±1.5	84.1±2.2	69.4±3.1	87.0
GPT-4o-mini	62.5±1.1	57.9±1.7	96.7±1.0	64.4±2.8	33.1±1.8	62.9
GPT-5-Nano	84.3±1.0	68.2±1.7	87.4±1.9	54.9±3.0	48.9±1.9	68.7
GPT-5.1	94.5±0.5	87.8±1.2	98.6±0.7	60.3±2.6	53.5±1.9	78.9
GPT-5.2	57.1±1.6	82.5±1.4	100.0±0.0	61.2±2.5	59.7±3.3	72.1
GPT-5.4	74.4±1.3	69.3±1.7	95.9±1.2	57.9±2.7	64.4±3.3	72.4
GPT-5.6-Sol	96.9±0.5	89.3±1.1	99.9±0.1	60.4±2.6	68.5±3.2	83.0
Gemini-2.5-Flash	88.8±0.8	70.1±1.7	92.3±1.5	61.1±3.1	41.1±1.8	70.7
Gemini-3-Flash	94.1±0.4	83.9±1.3	88.7±1.6	90.6±1.7	52.5±1.9	82.0
Gemini-3-Pro	97.3±0.4	93.4±0.9	98.6±0.7	73.9±2.3	64.8±3.3	85.6
Gemini-3.5-Flash	75.6±2.4	92.2±1.0	97.6±1.0	74.8±2.1	73.1±3.0	82.7
Grok-3-Mini	68.2±1.5	88.4±1.0	99.6±0.2	60.1±2.6	49.0±1.9	73.1
Grok-4.1-Fast	71.4±1.8	80.3±1.4	89.4±1.7	89.0±1.8	47.4±1.9	75.5
Open-Weight Models
DeepSeek-R1	39.1±2.7	87.4±1.1	84.7±2.0	90.1±1.6	48.5±1.9	70.0
DeepSeek-V4-Pro	87.1±1.3	86.6±1.2	94.9±1.2	78.2±2.2	67.1±3.2	82.8
GLM-4.5-Air	83.2±0.9	61.0±1.7	89.1±1.7	88.3±1.8	36.9±1.8	71.7
GLM-5.3	89.0±1.5	92.2±1.0	98.1±0.9	92.9±1.4	80.1±2.7	90.5
GPT-OSS-120B	59.1±1.9	54.6±1.8	92.2±1.6	94.8±1.1	58.9±1.8	71.9
Llama-3-70B	54.2±2.3	34.5±1.6	91.3±1.7	86.6±2.3	22.9±1.8	57.9
Llama-3-8B	14.8±1.5	29.8±1.5	82.2±2.2	59.2±3.0	23.0±1.6	41.8
Qwen3-30B	73.2±1.6	66.9±1.6	92.6±1.7	89.7±1.8	47.5±1.9	74.0
Qwen3-4B-IT	83.8±0.6	57.9±1.7	91.3±1.4	78.4±2.4	42.1±3.4	70.7
Qwen3.5-397B	69.5±1.5	85.7±1.3	97.0±1.0	72.8±2.6	68.4±3.2	78.7

Cite

@misc{yang2026multiuser,
  title         = {Multi-User Large Language Model Agents},
  author        = {Shu Yang and Shenzhe Zhu and Hao Zhu and Jos{\'e} Ram{\'o}n Enr{\'i}quez and Di Wang and Alex Pentland and Michiel A. Bakker and Jiaxin Pei},
  year          = {2026},
  eprint        = {2604.08567},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CL},
  url           = {https://arxiv.org/abs/2604.08567}
}

Figure and table from the paper, CC BY 4.0.