Secure AI Use Checklist

Before you paste

• No passwords, API keys, or credentials — ever, in any AI chat.
• No customer data, medical, financial, or legal records in consumer tools.
• Company material only if your workplace AI policy allows it (and you've read it).
• Checked this tool's data settings: training opt-out on, or a business tier with no-training terms.

Before you connect

• This integration/plugin comes from an official source with a named publisher.
• Access requested matches the job (a summarizer doesn't need send-email rights).
• Confirmation prompts stay ON for actions that send, buy, delete, or publish.
• Calendar reminder: review and revoke unused AI integrations every few months.

While an agent works

• The less I trust what it's reading (random web pages, strangers' emails), the less it should be able to do — hidden instructions in content can steer AI tools (prompt injection).
• If it does something I didn't ask for: stop it, check what it just read.
• Irreversible actions get my explicit click, not blanket auto-approve.

Before you trust the output

• Facts that matter → verified against a primary source.
• Citations, cases, and package names checked — models fabricate them, and fake package names are a real attack vector.
• AI-generated code → run, tested, and reviewed like human code (ask the AI to check it against the OWASP Top 10:2025).

Account basics that back it all up

• Unique passwords from a password manager; 15+ characters where there's no MFA.
• Multi-factor authentication on for every AI account (they hold your chat history).

---

Go deeper: the full reasoning behind every line is in Using AI Tools Safely, with The OWASP Top 10 in Plain English and Modern Password Rules as companions.

Sources: OWASP Top 10 for LLM Applications (2025 edition, genai.owasp.org); NIST SP 800-63B Rev 4. Facts verified July 2026.