Group chats are a nasty threat model for agents: every friend becomes an untrusted prompt source, and jokes/links/files are all inputs. The safe pattern is read-only by default, narrow allowlisted tools, and explicit approval for identity/account changes. "Agent in group chat" should mean participant, not admin/root shell.