Don’t give one AI your data, outside email or web pages, and a way to send things out.
What it means
AI reads instructions and information the same way, as text. Someone can hide instructions in an email or a document, and an AI that reads it may follow them. Security teams call this prompt injection, and nobody has fully solved it yet.
A simple example
In 2025, researchers showed that a single crafted email, never even opened by the person, could make Microsoft’s work assistant leak internal data. Microsoft fixed it, with no sign that anyone had used it (Microsoft’s advisory). Hidden text in a job applicant’s CV could do the same to an AI that screens applications, telling it to approve the candidate.
Do it yourself
- Don’t give one AI all three of these at once: your private data, content from outside, and a way to send things out.
- Limit where AI can send things: known recipients only, connected systems only.
- Keep a person approving outward actions while trust is built.
- Prefer tools that mark outside content as information rather than instructions.
How to check
For each AI tool, tick the three boxes: private data, outside content, a way to send out. If a tool has all three, apply the limits above, starting with where it can send things.
What that misses
The check goes out of date whenever someone connects something new, because a new connection can give a tool its third tick.
What we do for you
We find which of your AI tools have all three. For those, we limit where they can send things and set up a person’s approval for anything going out.
“What we do for you” describes work we do for our clients, and what’s included depends on your plan. Already a client? Your engineer can tell you what your plan covers.
Back to all rulesGet the full guide
Technology, managed by people.
The real McCoy: real oversight, real understanding, real answers. Start with a free AI Check.