5 Things You Should Never Put Into Unapproved AI

An AI can follow your instructions. It can also encounter somebody else's instructions hidden in an email or webpage. When that AI has access to business accounts, the difference matters a lot.

The 15-second answer

Keep passwords, sensitive employee records, confidential customer information, banking details and restricted business documents out of unapproved AI tools. An approved business account can support some sensitive workflows, but only after you check its terms, controls and permissions. Paying for a subscription does not make every upload appropriate.

WHAT happened?

On November 24, 2025, Anthropic published research on defending browser agents against prompt injection: malicious instructions embedded in material an AI reads. The company reported progress and explicitly said the problem was not solved. [1]

The practical issue is straightforward. Connecting more information can make an assistant more helpful. It also means a mistake or manipulated instruction may reach further into your business.

WHO should give a shit?

Any owner whose staff use AI for email, hiring, proposals, customer service or spreadsheets. This includes a two-person business. Sensitive information does not become less sensitive because your team is small.

WHY does this matter to your business?

Here are five categories to keep out of tools your business has not approved:

1. Secrets that unlock accounts. Passwords, authentication codes, recovery keys and API keys. An assistant does not need your login pasted into a conversation.

2. Sensitive employee information. Payroll, identity documents, health details and disciplinary records. Use fictional examples for general guidance.

3. Sensitive customer information. Health records, identity documents and private case details. Even an ordinary customer export can contain more information than a task needs.

4. Financial access information. Full card details, banking credentials and payment authorization material. An anonymized transaction summary is a different input from access to the account.

5. Restricted commercial material. Unreleased deals, confidential contracts and proprietary information covered by commitments to others. Check those commitments before uploading.

This is a practical intake rule, not a claim that AI can never process sensitive information. The right decision depends on the task, account, contract and applicable obligations.

WHEN should you act?

NOW if your team has no approved-tool list or shares business information through personal AI accounts. Put a simple rule in place while you review the details.

WHERE would you use safer alternatives?

Replace names with customer IDs. Remove identifiers and unnecessary columns. Summarize a contract issue in fictional terms. Create an example invoice containing invented details.

Be careful with “anonymized” text: an unusual job, location and date can identify someone even without a name. Give the tool the minimum useful context.

HOW do you start Monday morning?

Ask staff which AI tools they use, through which accounts and for what information. Make the conversation practical so people can describe the workflow honestly.

For each approved tool, check training use, retention, deletion, sharing, integrations and account permissions. Document who can approve sensitive tasks. Limit connected apps to the access actually needed. If a secret has already been exposed, follow your incident process and revoke or rotate it where appropriate.

The Bullshit Meter

Hype 5/10 | SMB usefulness 9/10 | Risk 8/10 | Verdict NOW. Editorial assessment of uncontrolled sensitive-data use. The useful response is a clearer boundary, not panic.

Don't Put This Into AI

This week's obvious candidate: the spreadsheet labelled “all staff details.” Use a fictional sample unless an approved workflow specifically requires the real records.

Questions owners actually ask

Does a paid account make confidential uploads safe?

No. Review the specific account's terms, controls and your obligations. Price is not a privacy assessment.

Can an AI be tricked by an email?

An agent that processes untrusted content can face prompt-injection attempts. Limit access and require approval for consequential actions.

Is removing names enough?

Not always. Other details may identify a person or disclose confidential information. Minimize the whole input.

This week's move: publish an approved-tool list and a five-category “ask first” rule your staff can actually understand.

Sources

[1] Anthropic Mitigating prompt injections in browser use November 24 2025