alphaPlan · Cybersecurity · Cheat-sheet 07
Using AI Safely
Use approved AI tools, keep secrets out of them, doubt what comes back, and remember that AI is a helper, a target and a tool for attackers all at once.
Ideas to remember
- 01Shadow AI is using tools your workplace has not approved; what you paste in leaves your control and may be stored or used for training.
- 02Prompt injection hides instructions in text an AI reads, and anything your AI reads, your AI might obey.
- 03Adversarial inputs that look normal to you can push a model to a confident wrong answer, so one AI decision is never the final word.
- 04Defensive AI spots phishing, unusual behaviour and new malware at a scale no human team could, but it supports human judgement rather than replacing it.
- 05AI systems are targets too: poisoned training data bends a model's behaviour, and trained models get stolen or copied.
- 06Organisations that rely on AI have to protect it like any other critical asset, and you can expect that of them.
Words
- Shadow AI
- Using AI tools and services your workplace has not reviewed or approved.
- Prompt injection
- Planted instructions in a web page, email, document or file that an AI assistant treats as commands.
- Adversarial machine learning
- Crafting inputs so a model gets the answer wrong on purpose while looking normal to a person.
- Data poisoning
- Slipping bad examples into the data a model learns from to quietly bend its behaviour.
- Malware
- Harmful software; defensive AI can flag it by what a program does, not only by a list of known files.
Do this
- Use the AI tools your workplace has chosen, and ask IT before pasting anything sensitive into any other.
- Keep passwords, codes and secrets out of AI assistants, and limit what access they hold on your behalf.
- Check important claims yourself before acting on an AI summary of outside documents, web pages or emails.
- Keep a human in the loop and a way to question any automated decision that matters.
- Before trusting an AI service with your data, check whether the provider says how the model and your data are protected.
Watch out
- A data leak through an unapproved tool is still a leak even though nothing was 'hacked', and nobody knows the information went out.
- An AI that suddenly makes an odd, urgent or out-of-character recommendation may be following someone else's hidden instructions.
- A fooled model gives its wrong answer with full confidence; 'the system said so' is not the end of the conversation.
Found something unclear, outdated or improvable? Suggest an improvement