The useful question is: what can it actually do?
Imagine asking an assistant to organize receipts. Reading the amounts is one task. Moving files, submitting expenses, and emailing your manager are separate actions with different consequences. Before connecting an AI agent to your accounts, write down which of those actions you actually want it to perform.
Anthropic describes agents as systems that choose steps and use tools in a loop, adjusting as they observe results. That makes them useful for work spanning several applications. It also means the surrounding tools, permissions, and environment matter alongside the model itself. A helpful starting question is: if this assistant misunderstands me, what could it change?
A document can contain instructions you never gave
Prompt injection happens when input steers an AI system in an unintended direction. With indirect injection, those instructions arrive through material the assistant reads, such as a website or file. The assistant may confuse content it should examine with directions it should follow.
Consider a hypothetical shopping assistant reading a product page that tells it to ignore your budget. That instruction comes from the page, not from you. The same distinction applies to emails, uploaded documents, and search results. OWASP identifies information disclosure and unauthorized actions among the possible consequences, depending on the system's access. Its guidance also makes clear that there is no foolproof prevention method.
Give each task a small permission set
A sensible first workflow is narrow: read one folder, produce a summary, and save a draft in a designated place. If the job does not require sending messages, the connected tool should not have permission to send them. OWASP recommends limiting agent tools to the access needed for the task and enforcing those limits outside the model.
For a personal trial, make a separate folder containing a few non-sensitive sample files. Specify the expected output and where it belongs. This is a suggested experiment, not a guarantee of security. Its value is that you can inspect the result without involving your entire inbox or an important shared workspace.
Make approval a meaningful decision
Reserve a clear approval step for actions with serious consequences. OWASP recommends human oversight for high-impact actions and checks that preserve the integrity of what is being approved. A vague request to continue is less useful than a concrete preview of the intended action.
For example, an expense assistant could show the payee, amount, attached receipt, and destination before submission. A calendar assistant could show the recipients and meeting time before sending invitations. These are suggested interface patterns: the person approving should be able to understand the actual change, rather than having to trust a reassuring summary.
Check the result, then expand deliberately
After a trial, compare the saved output with the original request. Look for missing files, unexpected recipients, unsupported statements, or changes outside the chosen folder. Keep a simple record of what the assistant attempted and what it completed. Decide in advance how you would stop the workflow or revoke its connection.
Anthropic emphasizes layered defenses and cautions that its safeguards are not guarantees. The practical lesson is to treat trust as something specific to a task. Successful receipt summaries do not automatically justify access to payroll, purchasing, or customer communications. Expand a workflow only when its behavior and boundaries are clear enough for the next responsibility.
Sources & further reading
- Trustworthy agents in practiceAnthropic · Primary source · April 9, 2026
- LLM01:2025 Prompt InjectionOWASP · Primary source
- AI Agent Security Cheat SheetOWASP · Primary source