Do AI Discord bots read your messages?
Discord's Message Content intent decides whether a bot can read what people post. What it gates, what bots see without it, and what to ask about retention.
The answer is decided by a single toggle in Discord's developer portal, and it is binary. A bot either holds the Message Content intent, in which case it receives the text of every message in every channel it can see, or it does not, in which case that text arrives empty.
There is no middle setting. No per-channel opt-in, no "only read when someone types a command." Discord does not offer one. So the useful question is not "does this bot respect my privacy," it is "does this bot hold Message Content," and that has a checkable answer.
What the intent gates
Discord's gateway sends events to bots based on intents the app declares. Most intents are ordinary. Three are privileged: Guild Presences, Guild Members, and Message Content.
Message Content gates the content, embeds, attachments, components and poll fields on message objects. Without it, a bot still receives the message event. It knows a message happened, who sent it, in which channel, and when. The fields that carry what was actually said come through empty.
Discord's own carve-outs are narrow and specific. Even without the intent, a bot receives full content for:
- messages it sent itself
- direct messages it receives
- messages in which it is mentioned
That is the complete list. Replies work in practice because a reply pings the person being replied to, which is a mention.
Why Discord restricts it
Message Content became privileged on 31 August 2022. Before that, any bot in any server received every message in full by default, which meant that adding a levelling bot to your server handed a third party a live feed of every conversation in it.
Discord's position since then has been that reading everything should require a reason. That has been tightened again in 2026. The mechanics below are per Discord's developer documentation on privileged intent access, as of August 2026:
The threshold is now users, not servers. Until June 2026, apps in fewer than 100 servers could switch privileged intents on themselves, and apps in 100 or more had to apply for review. As of 10 June 2026 that threshold is based on the number of unique users who can see the app across every server it is in. Above 10,000 unique users, the app has to apply.
Prior approvals expire. Apps that hold privileged intent access from an earlier review reapply each year through the Developer Portal to keep it. Discord notifies the developer by email or system DM when the date approaches, and the app has 90 days from that notification to submit. It keeps joining servers and reaching users while the submission is under review. If nobody reapplies inside the window, access is removed, and the developer can apply again at any point afterwards.
Below the threshold, the annual cycle does not apply. Apps under 10,000 unique users toggle the intent on themselves, with no review and no yearly reapplication.
The practical consequence for you as a server owner: a large bot holding Message Content has told a reviewer at Discord why it needs to read your messages, and repeats that argument on a schedule. A small one has ticked a box. Neither of those is a promise about what happens to the text after it arrives.
What a bot can see without Message Content
Quite a lot, which surprises people who assume the intent is the whole privacy question.
| Visible without the intent | Not visible without it |
|---|---|
| That a message was posted, by whom, where, when | The text of the message |
| Message IDs, edit and delete events | Attachments and embeds on it |
| Mentions of the bot, and replies to the bot | Attachments and embeds on other messages |
| Reactions added and removed, and by whom | Poll question and option text on others' messages |
| Member joins, leaves, role changes, nickname changes | |
| Voice channel joins, leaves and moves | |
| Channel, role and server setting changes | |
| Audit log entries the bot has permission to read | |
| Everything typed into the bot's own slash commands |
That last row is the one to sit with. Slash command inputs are delivered to the bot as part of the interaction payload, and no intent gates them. If you type /report user:@someone reason:"they doxxed me", the bot receives that reason in full, because you addressed the bot directly. This is a deliberate design: Discord routes what you explicitly send to an app, and gates what you did not.
So "this bot cannot read my messages" and "this bot cannot read anything I type" are different claims. Only the first one is ever true.
Bond's position
Bond does not hold the Message Content intent. Ordinary message text does not reach it.
This is not a setting on a dashboard somewhere. It is a property of the deployment, and the product is built around it rather than apologising for it:
Read tools report the gap explicitly. When Bond fetches messages, each one it could not read carries contentAvailable: false with a reason, and the call reports how many of the returned messages were withheld. Bond is instructed to say that plainly rather than describe a channel as quiet or empty, and never to infer what was discussed from how many messages there were.
Automations that would depend on message text are rejected at creation. A rule like "when someone posts !rank, reply with their level" cannot work, because the content it compares against is always empty. Bond's flow validator refuses it when you try to save it, instead of accepting it and letting you find out months later that it never fired once.
Prefix commands are replaced rather than faked. If you ask for !rank, Bond builds a real /rank slash command in your server. You get autocomplete, typed arguments and per-role access control, and the input reaches Bond because you addressed it. That is how custom slash commands work, and it is the reason the missing intent is a design constraint rather than a missing feature.
Message-triggered automation still works for anything that does not read text. Counting messages, levelling, tracking who posts where, reacting to activity. All of that runs off the event, not the content.
There is one honest limit to state: because Bond receives content for messages that mention it, anything you say to Bond, Bond reads. That is what talking to a bot means. Conversations are kept per channel, so a chat in #staff is a separate thread of context from a chat in #general, and /clear drops the conversation in the channel you run it in.
Bond also keeps memory documents: short markdown notes it curates about your server's conventions and about you. Server-scoped memories are visible to everyone in that server and writing one requires Manage Server. Personal memories follow you across servers and are visible only in your own conversations. /memory shows you what is stored and lets you delete any of it. None of it can contain the text of messages Bond never received.
What to ask any bot about data
The intent question is only the first half. A bot without Message Content cannot read your channels, but it still receives what you send it, and that has to live somewhere. These are the questions worth an answer:
Does it hold the Message Content intent? The answer should be one word. Hedging here is itself information.
If it does, what does it do with the text? Is it processed and discarded, stored for a window, or retained indefinitely? "Stored for 30 days for abuse investigation" is a real answer. "We take your privacy seriously" is not.
Does content go to a third-party model provider? For any AI bot the answer is almost always yes, because that is what the product is. The follow-up is which provider, and whether the provider trains on it. A bot that will not name its providers is asking you to trust a chain you cannot see.
Where is the data stored, and under whose law? Relevant if your community has members in jurisdictions with data-protection rules you care about.
Can you delete it? Both individually and as a server. If there is no path to deletion, retention is effectively forever regardless of the stated policy.
What happens when you kick the bot? Some products purge, some keep server data so that reinstalling restores your setup. Both are defensible. You should know which.
Does the bot say what it cannot see? A bot that reports a channel as quiet when it simply could not read the messages is making things up, and that failure mode says something about the rest of it.
The practical read
If a bot holds Message Content, treat it as having access to everything posted in any channel it can see, and evaluate it on retention and on who else touches the data.
If it does not, treat it as having access to exactly what people address to it: mentions, DMs, and slash command inputs. That is a genuinely smaller surface, and it is a claim you can check yourself, because the features give it away. A bot without the intent cannot do prefix commands and cannot moderate on message content, so if it advertises either, it holds the intent.
Bond is in the second group, and the missing intent shapes the product visibly: slash commands instead of prefix commands, message triggers that count rather than read, and read tools that tell you when text was withheld instead of pretending the channel was empty. The rest of what Bond can and cannot do is on the trust page, and are AI Discord bots safe covers the permission side of the same question.