It always depends on who you consider the user. The one who initiated the agent, or the one who interacts with it? Is the latter a user or a victim?