To borrow an agent is to use a coding agent that belongs to someone else, running on their machine with their subscription, from your own context and for as long as they allow. You get the ability to ask and the results that come back. You never get their account, their credentials or their files. The owner can end the arrangement at any moment.
The term has started to appear in several products in 2026, so it is worth pinning down. This post defines it, separates it from the older workarounds, and explains how muti implements it with grants, approvals and revocation.
Why people borrow agents
Three situations come up again and again.
Your own quota is spent. You hit the limit on your plan at 4 pm and a teammate’s agent is idle.
You don’t have the subscription. A designer who occasionally needs a script does not need a coding-agent plan of their own; the founder’s agent will do.
Their agent is set up better. The owner’s agent has the repository checked out, the tools installed, the house style in a file, the MCP servers configured. Borrowing it is faster than reproducing it.
In each case the borrower wants usage, not ownership. That distinction is what makes borrowing safe to offer.
What the borrower holds, what the room holds, and what never leaves the owner’s machine.
What the borrower gets
- The ability to ask, in a room the owner invited them to, by mentioning the agent.
- Their own context. The request is theirs, phrased their way, with their attachments. In a room with a persistent session the agent also remembers that room’s history.
- The timeline, live. Each tool call, each diff summary, the tail of command output.
- The result. The reply, and any files or images the agent produced.
What the borrower never gets
- The owner’s account or login.
- Environment variables, SSH keys, API keys, browser sessions.
- The working tree. Diffs appear as summaries; the files stay on the machine.
- Anything from other rooms the agent is in.
- The right to approve their own dangerous actions.
How borrowing works in a room
A grant. The owner either approves the borrower’s request once, or gives them a standing grant for that agent in that room: “always allow”. A grant is scoped to one person, one agent, one room.
Approvals for the four actions. Whatever the grant says, pushing to a shared branch, deleting, spending money and touching credentials pause for the owner. A credential prompt inside the run, such as a login or a two-factor code, routes to the owner as well, never to the borrower.
The audit line. Every borrowed request records who asked, who approved, when, what ran, and what it used.
Revocation. Removing the grant, removing the borrower from the room, revoking the machine or stopping the daemon all take effect immediately. Queued requests from that borrower are cancelled; a run already in progress finishes and stays in the history.
Borrowing compared with the alternatives
How other products use the term
“Borrow an agent” appears in Tutti · VM, where a collaborator authorises their agent for someone else and the borrower continues from their own context. Alook gives agents identities and inboxes that people in a room can address. Both are local-first. muti’s version adds per-person grants, the four always-pause actions and an audit line, and lets the borrower join with nothing but a browser.
Frequently asked questions
Whose tokens does a borrowed request consume? The owner’s. The agent runs on the owner’s subscription. Per-request usage is recorded so the owner can see what borrowing costs.
Can a borrower use the agent in a different room? No. Grants are per room. The same agent in another room is a separate arrangement.
Does borrowing work when the owner is offline? The request waits in the agent’s inbox and runs when the machine is back. If it hits one of the four actions, it pauses until the owner answers.
Can two people borrow the same agent at once? Yes. Each agent has one serial queue, so requests run one after another in order.
Borrowing is the reason rooms exist. Give your agent one and lend it on your terms.
Published