A practical risk model
AI assistants fail safely until they are given two things at once: access to your private data, and untrusted text from the outside world. The combination is where incidents happen, because the model cannot reliably tell instructions from content.
- Prompt injection: instructions hidden in a web page, document or email that the assistant then follows
- Data leakage: private context being echoed into a reply, a log, or a third-party tool
- Over-permissioned integrations: a connector with write access when read access would do
- Silent retention: prompts stored and later used for training or support review
Controls that work
Treat everything an assistant reads as untrusted input, exactly as you would treat user input to an application. Keep secrets out of prompts entirely — never paste passwords, API keys, tokens or customer records into a chat box. Require a human confirmation step before any assistant-initiated action that sends money, changes permissions or emails a third party.