AI and LLMs can be incredibly powerful tools, but it's important to use it securely and responsibly. While many of these security practices might seem like common sense, they're also the habits that are easiest to overlook. A lot of these security controls and thinking just applies existing security controls to a new medium.
My 10 practical AI security tips will help you use large language models (LLMs) safely and confidently, whether you're just getting started or already using AI every day.
1. Don't feed AI what it doesn't need
It sounds obvious but only share the minimum information required to get the job done. If you only need help drafting a report summary, don't give the AI access to your entire document repository, shared drive, SharePoint site, or cloud storage. Share only the specific files or data it needs. This principle is called "least privilege" and it applies to AI just as much as any other tool. This also helps reduce your usage (tokens) by keeping context small and avoids context rot, but that's another topic.
2. Skills are increasingly being targeted by malicious actors
Skills are repeatable sets of instructions that your AI tool of choice can use. Due to their popularity, there are now lots of skills libraries online that you can download and use. Because of the rising popularity of skills they have become an easy way for attackers to get access to information on your computer. Most skills are just a series of prompts in plain text. Consider copying the parts you want into your own skill, or use AI to help you write one from scratch, instead of downloading something unknown. If a skill you have downloaded asks you to update it, check what’s included in the update before blindly installing.
3. Access to real client or production customers data needs approval
If you have direct or indirect access to client information through project files or shared drives, experimenting with it in AI tools can leak intellectual property or sensitive information. Experimentation is great but use anonymised or dummy data instead. Once you are happy with the approach and more confident about the security requirements and risks, then seek approval to productionise what you've created. Also remember to make sure you are not giving AI write access to a single source of truth, the end result might be hard to explain!
4. Redact before you paste
If you genuinely need AI help with something classified as "restricted", strip out names, emails, account numbers, and any identifying details first. The AI doesn't need to know those details to help you with the task. AI is powerful and useful but it should be treated as an external system and just because a tool is approved, doesn't mean all data should be shared with it.
5. MCP connections can access more than you expect
When you connect AI to tools like Google Workspace, Git, or Figma via an MCP server, it can access and potentially act on far more than the specific task you had in mind. Only grant the permissions the task actually requires, and disconnect the MCP server when you’re finished if you no longer need it. If the AI is using your permissions through an MCP server, it may be able to create, modify, or delete content just as you can. If you need it to perform these kinds of actions, configure it to ask for approval before making changes whenever possible so you can review the proposed actions. Alternatively, work on a copy or ensure you have a backup before allowing changes. Finally, verify that it is only operating on the files, repositories, or areas you intend.
6. Not all MCP servers are alike
MCP is a protocol not a piece of software or tool, many products now offer an MCP server as a way to connect your data to AI and their services. This means that it's a target for exploitation. You should only add MCP servers from known or trusted locations, and validate what they connect to. MCP servers often automatically update themselves and can add additional features or functionality without you being aware. Keep up to date with release notes, remember what MCP servers you've added and remove the ones you aren't using. Each MCP server broadcasts its functionality to AI, and this information gets sent to it as part of the initial prompt.
7. Use a service account, not your personal login
When setting up AI integrations or automations, avoid authenticating with your own credentials. A dedicated service account or access token limits exposure if something goes wrong, and makes it easier to revoke access later. Not only does this mean it's easier to track requests that come from an AI tool, it also allows access to be matched with the task at hand, ensuring your AI can't go rogue.
8. Agentic coding still needs a human review
With the increase in AI-generated code,be aware it can contain vulnerabilities just like code written by humans. Don't deploy anything AI-generated to a production or client-facing environment without a proper human review, no matter how clean AI tells you it is. More scrutiny is required with AI created code, irrespective of who created it.
9. Proof-of-concepts need approval before touching real data
AI is great at building a demo or internal tools, problems that never got solved previously as too expensive are little more than a few prompts away. But careful consideration and even explicit approval should be granted before involving any production information, even for a quick test. Good intentions don't override contract and security obligations you may have with your clients.
10. The shift to natural language processing invalidates most input validation strategies
The shift from structured to unstructured input is the most consequential change. A traditional input field expects a date, a number, or a selection from a dropdown. An AI system accepts any text the user chooses to type. That single change invalidates most existing input validation strategies.