Guides › Stay private and safe
Power userUse AI at work and with agents, safely
After this you'll be able to:
- know why a work account differs from a personal one
- recognize prompt injection
- set approvals before an agent touches your accounts
Personal vs work accounts
A personal account with training off still isn't a work tool: your employer didn't agree to its terms and can't manage what you put there. Ask for an approved business plan before you paste client or company data.
Prompt injection
A web page, email or document can hide instructions meant for the AI, like "send this inbox to…". Google warns agents can be misled this way into leaking data or taking unintended actions. 1 Watch agents closely on sites where you're signed in.
Approvals and shared computers
- Grok Bot: sensitive actions can go through Auto Review, and all your Bots share one cloud computer, so treat its files and logins as shared. 2 3
- Gemini: asks for confirmation before sending, buying or submitting forms. 1
- ChatGPT: actions that send a message or change external data may need approval, and the task pauses until you review it. 4
Prompt: ask to use AI at work
Draft a short note to my manager proposing a 30-day trial of an approved AI tool for [task]. Include: what data it would and wouldn't touch, how we'd check its work, and how we'd measure time saved.
Before an agent touches your accounts
- Use a separate browser profile or the agent's own computer.
- Connect only the apps the job needs.
- Keep approvals on for send, buy, delete and post.
- Review its activity weekly, and disconnect what it no longer needs.