AI Cyber Safety

01 · Protect information

Before you paste

Share only what the task needs. Never paste passwords, one-time sign-in codes, recovery codes, or secret access keys into a chat.

Do not casually upload student records, patient information, financial details, confidential workplace documents, private messages, or proprietary and unpublished work. Check permission before using information covered by a school, employer, agency, contract, or policy—including information about someone else.

Use fictional examples or remove unnecessary details. Removing a name alone may leave someone identifiable through their role, location, dates, or other details.

Protections differ by product, account type, settings, retention rules, and organizational agreement. Check the current privacy and data controls for the exact service you use. Turning off model training does not mean nothing is stored or shared; a temporary chat is not permission to disclose restricted information.

Try this: Ask for help drafting a customer reply using a made-up situation, rather than uploading the customer’s full record.

02 · Check the evidence

Before you believe

A polished answer can still contain wrong facts, invented citations, or outdated instructions. Asking the same AI whether it is sure is not an independent check.

For an important claim, open the original source and confirm that it actually supports the answer. Check its date and whether it applies to your situation. Verify quotations, calculations, links, and citations before passing them on.

For decisions affecting health, money, legal rights, workplace policy, or someone’s opportunities, use current official information and qualified help where needed. Review generated documents before sharing them, including names, figures, embedded links, and private information.

Try this: If AI gives you a policy deadline, find that deadline on the responsible organization’s own website.

03 · Verify independently

Before you trust the person

Phishing is a deceptive message designed to make you reveal information or take a harmful action. AI can help scammers write convincing messages or imitate someone’s voice or appearance. A deepfake is synthetic or altered media that can make a person appear to say or do something they did not.

Detection is not verification. A familiar voice, realistic video, correct personal detail, or professional message does not establish who is making the request.

If someone asks for money, a password, a sign-in code, or an urgent account change, stop. Contact the person through a number you already know, or contact the organization through its official app, a statement, or another trusted source. Do not use the number or link supplied in the suspicious message. Keep sign-in codes to yourself.

Try this: A caller sounds like a family member and needs money immediately. Hang up and call that person on the number already in your contacts.

04 · Limit access

Before you connect

A connector or connected app lets AI work with another service, such as email, cloud files, or a calendar. The approval screen may use the term OAuth: it lets you authorize access without giving the app your password.

Read the requested permissions. Which account is selected? Can the app read all files, send messages, change records, or keep access after today? Ask your organization before connecting work or school accounts.

Choose the least access needed—called least privilege. Prefer a selected folder or read-only access when those options meet the task. Read-only access can still expose private information. If the required access is broader than you are comfortable granting, decline the connection.

Review connections periodically and remove those you no longer need. Learn how to disconnect in the AI tool and revoke access in the connected service. Revoking access does not necessarily delete information already transferred.

05 · Keep control

Before you let AI act

An AI agent can take steps through tools, browsers, files, or connected services. Before starting, check what it can see, change, send, delete, purchase, or approve. Know how to stop the task and revoke access.

Start with drafts and previews. Require your review before sending messages, sharing files, making payments, deleting information, or changing permissions. Check the actual recipient, content, amount, and scope; do not approve a vague request to “finish everything.”

External content can contain instructions aimed at the AI rather than you. This is prompt injection; when those instructions arrive inside a webpage, email, or document, it is indirect prompt injection. They may try to redirect the agent or expose data.

Keep unrelated sensitive accounts disconnected. Do not approve an unexpected action because a document or webpage says it is necessary. Permission settings and human checks matter; telling an AI to “be safe” is not a security boundary.

06 · Review before execution

Before you click, run, install, or deploy

Do not run a command, install a package, enable document macros, or grant administrator access just because AI recommends it. Verify the software or destination with its official source. If you cannot explain what a command changes, ask a trusted IT professional before running it.

For coding and technical work, review generated logic, dependencies, permissions, and configuration against current documentation. Use an approved test environment with sample data before deployment. AI assistance can be useful; its output still needs the same review and security checks as other code.