Give agents a short leash
Agents that read email and web pages can be tricked by hidden instructions. Limit their access and keep approvals on.
OWASP's 2026 list of the top risks for AI applications puts prompt injection first (hidden instructions in content the AI reads) and excessive agency third (an AI with more permissions or autonomy than it needs).
Practical rules:
- Connect only the apps and folders a task needs, and remove access when the task ends.
- Keep ask before acting switched on for sending, paying, deleting and posting. Claude asks before taking an action by default, and ChatGPT Work asks you to approve important actions.
- Use separate, limited accounts for agents where your tools allow it. Google's coworker agents, for example, get their own identity and only see what you share.
- Set spend limits on AI usage and review the bill monthly.
- Read what the agent did, not just what it says it did.
Sources
- OWASP Top 10 for LLM Applications 2026 OWASP GenAI Security Project, 2026
- OWASP LLM Top 10 2026: final entries (LLM01 Prompt Injection, LLM03 Excessive Agency) OWASP GenAI Security Project, 2026
- Claude Cowork and chat are now one Claude Anthropic, Sep 2026, updated 23 Oct 2026
- ChatGPT Work and Codex (Help Center) OpenAI, Oct 2026
- Gemini at Work 2026: Introducing Gemini agent Google Cloud, 8 Oct 2026
Learn it hands on, with us.
Free AI build nights in Kuala Lumpur. Bring one real problem and leave with a working tool.