Security Best Practices When Using Language Models

Use this module before letting an agent read private files, connect to an account, browse the web, or change your computer. AI privacy and security are not one setting. You need to decide what the agent can see, what it can change or send, and how you will undo a mistake.

The greatest danger appears when an agent can encounter untrusted instructions, reach sensitive data, and communicate or act with your permissions. Even without an attack, broad access can turn an ordinary misunderstanding into a lost file, exposed secret, or unwanted action.

The resources below help you draw a boundary around the agent’s work, limit its permissions and connections, and keep changes recoverable.

Starting Points

  1. Read OpenAI’s Designing agents to resist prompt injection to learn how ChatGPT uses several layers of protection against instructions hidden in webpages, emails, and other outside content.

  2. See how Anthropic contains Claude in How we contain Claude across products. The article shows how sandboxes, virtual machines, file boundaries, and network controls limit what Claude can reach in Claude.ai, Claude Code, and Cowork.

  3. Learn how to limit which files an agent can reach with Apple’s file and folder controls and Microsoft’s file-system privacy controls guides. For a stronger boundary, use Apple’s Mac guide and Microsoft’s Windows guide to learn how to create a separate standard—not administrator—user account for an agent’s work.

  4. Compare the controls in OpenAI’s Permissions guide and Anthropic’s permission modes guide to decide what Codex, ChatGPT, and Claude Code may do without asking. Keep approval prompts as a checkpoint before consequential actions.

  5. Set up a recovery backup of your data with Apple’s Time Machine or Microsoft’s File History before asking an agent to reorganize, rename, or delete many files. The optional safety-rm-rf-guard blocks common permanent-deletion commands and directs Claude Code or Codex to use Trash instead. Treat it as an additional safeguard, not a replacement for backups.

Deep Dive