Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
The most effective AI security settings do not try to make a model perfectly detect malicious instructions. They limit what the assistant can read, limit what connected apps and agents can change, require approval for consequential actions, and apply data-loss-prevention (DLP) rules to prompts, retrieved content, and web searches. Turn off unnecessary connections first, then add approval gates and content restrictions. Training opt-outs and temporary chats improve privacy, but they do not stop an authorized connector from reading a file or sending information through an approved action.
Prompt injection can arrive inside an email, web page, document, or other material an assistant is asked to summarize. The controls below are organized around that boundary and the products’ documented menus as of October 2026.
As an Amazon Associate I earn from qualifying purchases.
What is prompt injection, and why do ordinary privacy settings miss it?
Prompt injection is text that redirects an AI system’s behavior or output. OWASP’s LLM01:2025 description includes sensitive-information disclosure, unauthorized function calls, and manipulated answers as possible consequences. An indirect attack does not need to be typed into the chat box: a malicious web page or document can contain instructions that the assistant encounters while retrieving or summarizing content. OWASP’s example of a hostile page shows why source material must be treated as data, not as a new authority over the user’s instructions (OWASP LLM01:2025).
A documented case known as EchoLeak involved a crafted email and Microsoft 365 Copilot. It is a case study of the risk, not evidence that every current deployment remains vulnerable in the same way. No published prevention rate establishes that any product setting catches every injection. As Google’s GenAI Security Team puts it, “IPI is not the kind of technical problem you ‘solve’ and move on” (Google Security, April 2, 2026).
Popular on Amazon
Model-training controls answer a different question. They govern whether conversations may improve a provider’s models; they do not revoke a connector’s permission to read a shared drive or send data through an enabled action. Retention, training, source permissions, and third-party processing must therefore be reviewed separately.
What should you configure first?
Use this order so a successful redirection has the smallest possible impact:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Inventory connected data and tools. List mailboxes, drives, sites, calendars, browsers, plugins, apps, agents, and MCP servers the assistant can reach. Record whether each integration can only read or can also create, edit, delete, send, or publish.
- Narrow data scope. Remove unused connections and restrict the remainder by role, site collection, group, label, or other supported boundary. Keep the source system’s own permissions as the primary gate.
- Disable unnecessary write actions. A read-only assistant has less ability to turn an injected instruction into an external event.
- Require approval for consequential actions. Keep a person in the loop before sending mail, changing records, sharing files, purchasing, deleting, or invoking privileged tools. OWASP explicitly recommends human approval for privileged operations (OWASP LLM01:2025).
- Apply DLP and untrusted-source restrictions. Use rules that cover sensitive prompts, web grounding, labeled content, and external mail where the product supports them. These controls complement, rather than replace, source permissions and approval prompts.
- Review training and retention separately. Choose model-improvement, history, and temporary-chat settings according to your privacy requirements, without treating them as access controls.
- Test allowed and blocked cases. Submit a benign request that should work and one that should be denied. Check logs, approval prompts, and the actual response in each environment.
Which controls are available across major AI environments?
| Environment | Primary boundary | Documented privacy or DLP control | Important qualification |
|---|---|---|---|
| Managed ChatGPT workspaces | App role, action type, approval, and connected-content scope | Admin Console app controls; Safety & Security Controls where offered | Role access, action enablement, and approval are separate settings |
| Personal ChatGPT | Conversation training and retention choices | Settings > Data controls; Temporary Chat | These settings do not remove existing app or memory access |
| Microsoft 365 Copilot | Prompt, grounding, web-search, and response DLP locations | Microsoft Purview policies | Several controls are preview or plan-dependent |
| Google Workspace Gemini | Administrator restrictions plus Workspace permissions | Restrict Gemini, data access, and conversation sharing | Gemini follows the user’s underlying item permissions |
| Personal Gemini Apps | Activity, temporary chats, and connected apps | Keep Activity, Temporary Chat, Connected Apps | Business Workspace commitments do not automatically apply |
Use the vendor documentation linked in each section to confirm plan, tenant, edition, and rollout status before changing a production policy.
How do I secure a managed ChatGPT workspace?
Start in the Admin Console, select the intended workspace, and review every plugin or app individually. OpenAI documents separate controls for who may use an app, which read and write actions are enabled, how newly introduced actions are handled, and whether the assistant must ask before using an action (OpenAI admin controls for plugins and apps).
Set the least-privilege action policy
- Open Admin Console, choose the workspace, then open Plugins and each included app.
- Restrict app availability to the roles that genuinely need it.
- Review read and write actions separately. Disable creation, editing, deletion, sending, or sharing when the workflow does not require them.
- Check the setting for newly introduced actions so a future capability does not silently expand authority.
- Use Always ask when approval should be requested before reading or changing app information. Allow read actions permits reads without asking but still requests approval before changes.
- Do not use Allow all actions as a safety default.
Enterprise, Edu, and Business workspaces can have different defaults and role-control availability. Changing a role or action setting does not automatically revoke the provider’s OAuth grant, so remove an unnecessary connection at the provider as well.
Also popular on Amazon
Restrict connected content
Where available, Safety & Security Controls can narrow connected material. OpenAI documents controls for Google Drive shared drives, SharePoint site collections and selected label exclusions, Teams group-based limits, and selected Outlook email-label exclusions. The described Google Drive control does not exclude individual files, folders, users, groups, or Drive labels. Check the original provider’s permissions, then try one item that should be available and one that should be blocked with fresh requests. Connected services retain their own processing and storage terms (OpenAI admin controls).
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhich privacy settings matter on a personal ChatGPT account?
For a personal account, open Settings > Data controls and turn off Improve the model for everyone if new conversations should not be used to improve OpenAI models. Turning it off does not delete saved chats. Temporary Chat stays out of chat history and model improvement while temporary, but OpenAI says it may be retained for up to 30 days for safety (OpenAI Data Controls FAQ).
Temporary Chat is not an isolation mode. A personalized temporary conversation can still use existing memories, instructions, or plugins according to the account’s settings. Review and remove unnecessary connected apps and memories separately. Managed Business, Enterprise, and Edu workspace content is not used for training by default, but that default still does not make an over-permissioned connector safe.
How do I configure Microsoft Purview DLP for Copilot?
Purview can apply a policy to sensitive prompts and Copilot’s web-grounding behavior. In the Microsoft Purview portal, open Data Loss Prevention > Policies, create a custom policy, enable the Microsoft 365 Copilot and Copilot Chat location, select the relevant sensitive information types, and choose Prevent Copilot from processing content > Performing Web Searches (Microsoft Learn: Microsoft 365 Copilot DLP location).
When a prompt matches, this rule blocks external web search as a grounding source. Copilot may still answer from permitted internal Microsoft 365 sources; the rule does not block the entire prompt or every Copilot activity. Microsoft also documents actions that can block processing of sensitive prompt text or exclude sensitivity-labeled files and emails from response content.
Also popular on Amazon
Understand preview and coverage limits
Blocking sensitive prompt processing is in preview and rolling out, so verify that the capability exists in your tenant. Microsoft’s external-email-grounding exclusion is also preview: it evaluates sender-domain metadata and can prevent qualifying external messages from being used for grounding, summaries, and citations. It does not inspect message-body instructions. The Copilot DLP evaluation also does not scan files uploaded directly into prompts. Sensitive-information-type conditions and sensitivity-label conditions cannot be combined in one rule, although separate rules can coexist in the same policy.
These policies are not substitutes for correcting overshared SharePoint or OneDrive permissions. A user may be allowed to see an item while a DLP rule prevents Copilot from processing its contents. Microsoft’s defense-in-depth guidance places controls at prompt input, grounding, web search, and response, and reminds users to review generated results (Microsoft Copilot prompt defense in depth).
What should Google Workspace administrators change?
Google Workspace administrators can restrict Gemini, limit access to some or all Workspace data, and restrict conversation sharing. Gemini’s access follows the user’s Workspace permissions, subject to additional product limits, so tightening the source permission remains essential (Google Workspace: What controls Gemini’s access to Workspace data).
Use the correct edition’s safeguards
Google says Gemini Enterprise – Business Edition includes input and response screening for prompt manipulation and sensitive-information disclosure, active by default without additional setup in that edition (Google Gemini Enterprise Business Edition controls). There is no documented switch to hunt for in that edition, and the behavior should not be generalized to personal Gemini Apps or another Workspace edition.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsApply administrator restrictions to the smallest practical set of users and data. Review conversation-sharing policy, test a document the user should access, and test another that the policy should exclude. Keep logs and policy evidence so a change can be traced to a specific group, site, or collection.
Also popular on Amazon
What are the right settings for personal Gemini Apps?
Review Keep Activity, Temporary Chat, and Connected Apps together. Google says activity-off or temporary chats are retained with the account for 72 hours. Turning Keep Activity off can make some Connected Apps, including Workspace in the described circumstances, unavailable. It does not delete data that a third-party app already received (Google Gemini Apps privacy controls).
Before sharing sensitive material, disconnect apps that are not needed for the task and check what memories or account context remain enabled. Personal Gemini behavior should not be presented as the same privacy commitment offered by Google Workspace business services.
How should I secure agents, browsers, and MCP tools?
For supported ChatGPT Work and Codex deployments, administrators can open Admin Console > Agent security and distinguish enforced Requirements from changeable Defaults. Documented controls cover supported approval, network, app, browser, and MCP-related capabilities (OpenAI managed configuration).
Recommended Free Tools
Do not assume a command-network rule governs hosted web search, apps, MCP, or every desktop and cloud execution path. For each environment, run an allow-and-deny check against the domains and tools that matter, confirm the approval prompt appears for privileged operations, and inspect the resulting logs. A domain list that blocks one egress path may leave another path available.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I verify that a policy actually reduces exposure?
Verification should test boundaries, not just whether a setting saved.
Also popular on Amazon
- Data scope: Ask for an item the user should see, then an item excluded by role, site, group, label, or collection.
- Action scope: Request a harmless read, then a write or send action that should require approval. Confirm the assistant pauses rather than silently acting.
- Injection handling: Place an instruction-like sentence in a permitted test document and ask for a summary. Check that the sentence is reported as content rather than executed.
- DLP coverage: Test typed sensitive text, web-grounding queries, labeled stored content, an uploaded attachment, and an outbound destination separately because one rule rarely covers all five.
- Privacy: Confirm training, history, temporary-chat retention, and third-party processing settings in the account or tenant documentation.
- Evidence: Save policy version, test prompt, user or group, expected result, actual result, and log reference. Repeat after plan changes, connector updates, or new actions.
Absence of an alert is not proof that content was safe. OWASP states that no established foolproof prevention method exists, so layered controls and repeated review are necessary (OWASP LLM01:2025).
How should organizations compare AI security settings?
Choose by exposure and verification rather than by declaring one platform “most secure.” Compare these dimensions:
| Decision axis | Questions to answer |
|---|---|
| Data scope | Which files, mail, sites, labels, accounts, and external sources are reachable? |
| Action scope | Are tools read-only, and is approval required before consequential changes? |
| DLP coverage | Does the rule cover typed prompts, web grounding, labeled content, uploaded files, and outbound destinations? |
| Granularity | Can policy target a role, domain, group, collection, label, or individual item? |
| Availability | Is the control included in the plan, edition, tenant, client, or preview rollout? |
| Verification | Are logs available, and can administrators run positive and negative tests? |
| Privacy | What are the separate training, retention, memory, and third-party processing terms? |
This framework keeps a web-search block from being mistaken for a complete defense. Source permissions, action approvals, DLP, and privacy settings each address a different failure mode.
What mistakes make AI security settings ineffective?
- Granting “all actions” for convenience: broad write authority turns a misleading instruction into a possible external event.
- Relying on model refusal alone: automatic defenses can miss indirect or novel instructions.
- Confusing training opt-out with access control: a conversation not used for training may still access a connected file during the session.
- Ignoring provider permissions: a workspace restriction cannot safely compensate for an over-shared source repository.
- Assuming preview features are universal: tenant rollout, plan, edition, and client can change what a menu exposes.
- Testing only successful prompts: without a blocked case, an administrator cannot tell whether a restriction is active.
- Assuming uploaded files are covered by web DLP: Microsoft specifically says its Copilot DLP evaluation does not scan files uploaded directly into prompts.
- Leaving unused OAuth grants in place: changing an app role or action setting does not silently revoke the provider authorization.
What is the practical baseline for a small team?
Disconnect integrations no one needs, keep remaining connectors read-only where possible, and require approval for sending, editing, deleting, sharing, or publishing. Restrict shared drives, sites, groups, and labels at the source and in the AI administrator console. Add DLP rules for the sensitive data and grounding paths your plan supports, then record one permitted and one blocked test for each important workflow. Finally, review training, retention, memory, and third-party terms independently; none is a substitute for least privilege.
Frequently Asked Questions
Can prompt injection happen in a file I did not write?
Yes. An assistant can encounter instruction-like text in an email, web page, spreadsheet, PDF, or other retrieved source. Treat retrieved material as untrusted data and keep the assistant’s permissions and actions limited even when the user’s request is legitimate.
Does turning off AI training stop data leakage?
No. A training opt-out controls model-improvement use of conversations, not what a connected app can read during a task. Remove unnecessary connectors and restrict their permissions to address access and transfer risk.
Why did my DLP rule not block an uploaded attachment?
Some DLP locations inspect prompts or web grounding but do not scan files uploaded directly into a prompt. Check the product’s documented coverage and create a separate control for attachments if your tenant supports one.
How often should AI security policies be retested?
Retest after adding a connector, enabling a new action, changing a plan or edition, or when a preview feature rolls out. Keep a repeatable allowed-request and denied-request pair so policy drift is visible.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
