Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →If an AI agent is taking an action you did not authorize, stop the run immediately, block further tool calls if you operate the system, and check what has already happened. Stopping is not a rollback: an email, purchase, file change, or other operation may have completed before the stop took effect. To reduce the chance of a repeat, narrow the agent’s access and enforce authorization at the execution boundary—not just in its instructions.
What to do while the agent is acting
Respond in order: interrupt the run, prevent new actions, then establish what the agent actually did. A warning or suspicious-looking response is a reason to investigate, not proof that a particular action was unauthorized or that no side effect occurred.
As an Amazon Associate I earn from qualifying purchases.
- Stop the run. Use the product’s stop control as soon as something seems suspicious. OpenAI’s ChatGPT agent guidance advises stopping tasks immediately in that situation. If you operate a developer-built agent, also stop orchestration or tool dispatch so the system cannot issue another operation while you investigate.
- Do not automatically retry. A retry can repeat an action or cause another side effect. OpenAI’s API guidance on misalignment monitoring specifically says not to automatically retry a workflow blocked by its monitor.
- Check completed actions. Review the actual tool calls and outputs, the resources they touched, and the application’s own records. Determine whether an operation succeeded, partially succeeded, or failed; do not infer that nothing happened just because the run stopped or a monitor raised an alert.
- Preserve relevant records. Retain request and response IDs, tool calls, outputs, and application records, following your organization’s data-handling rules. Keep enough chronology to establish what information the agent could access and which operations it attempted.
- Contain the implicated access. If you administer the system, temporarily disable or narrow the relevant tool, connector, or credential while you review its authorization and effects. The exact revocation procedure depends on the agent platform and connected service; there is no single vendor-neutral procedure established here. If you do not have administrative access, report the incident to the workspace or service owner.
- Repair effects deliberately. Identify which completed changes can be safely reversed in the affected application and who is authorized to do that. Stopping a conversation does not undo its effects, and there is no universal rollback for different operations such as sending email, making a payment, or modifying files.
Why an agent may act outside your intent
An unwanted action does not necessarily mean the user’s request was malicious, nor does one suspicious phrase necessarily explain the outcome. Agents can combine trusted instructions with untrusted material from webpages, emails, documents, or tool responses. Malicious instructions hidden in data the agent consumes can redirect it toward an unintended action—a form of agent hijacking described by NIST’s January 2025 evaluation article.
Recommended Free Tools
Broad instructions also leave room for interpretation: “handle everything” may authorize more in the agent’s reasoning than you intended. Separately, even a well-intentioned agent can cause harm if its tools let it perform a consequential operation without an independent check that the exact operation is authorized.
#1 Best Overall
OpenAI’s March 11, 2026 article offers a useful way to think about the risk: examine both the source that can influence an agent and the sink that can cause harm. Untrusted text becomes more consequential when the agent can, for example, transmit information, follow a link, or invoke a powerful tool. Reducing exposure and limiting what the agent can do address different parts of the problem; detection alone is not a complete defense. See OpenAI’s discussion of designing agents to resist prompt injection.
How to make a repeat less likely
Use layered controls. Instructions help define the task, but technical permissions and execution checks determine what the agent can actually do.
Make the task and access narrow
- Specify the task, targets, and allowed actions. Replace open-ended requests with a defined scope. State what the agent may inspect or change, and which actions are out of bounds.
- Limit data and connectors. Enable only the apps and data needed for the task. Prefer logged-out or read-only access when it is sufficient, and separate data or memory across users or sessions where relevant.
- Grant only necessary capabilities. Remove tools and operations the task does not require, and scope access to the relevant resources. As OWASP’s AI Agent Security Cheat Sheet puts it: “Grant agents the minimum tools required for their specific task.” A natural-language rule such as “do not delete files” does not technically remove a delete capability.
Put authorization outside the model
Have the runtime, tool-execution service, or another independent policy layer check each consequential request before it executes. The check should evaluate the acting identity, tool, target, parameters, and any required approval. Unknown tools and missing approvals should fail closed rather than proceed.
Approval must cover the exact proposed action. If its target or parameters change, require a new approval; a generic approval flag should not authorize a different operation or a later one. For actions that send, purchase, delete, modify a system, or expose sensitive information, show a person the exact action and require approval before execution. This adds review time, but makes consent specific rather than inferred from the original task prompt.
Rank #3
Bound execution and preserve visibility
- Set relevant limits on retries, chain depth, tokens, cost, or other execution budgets so a loop cannot keep compounding effects.
- Log and monitor enough to reconstruct behavior and detect anomalies, while protecting sensitive content in logs under applicable data-handling rules.
- Keep a clear stop path that can prevent further dispatch; do not rely on an alert alone to interrupt execution.
Where the safeguards fit
These measures complement one another. A prompt constrains intended behavior, but an independent execution check is less dependent on how the model interprets that prompt. Monitoring and stopping can contain an active run, but they may act after an operation has completed.
| Control | When and where it acts | What it helps control | Important limitation |
|---|---|---|---|
| Task instructions | Before action, in the prompt or task definition | Ambiguity about scope and intended behavior | Do not technically remove tools or permissions the agent still has. |
| Least-privilege access | Before action, in connected apps, credentials, and tool permissions | Which resources and operations are available | Available actions may still be misused if no independent authorization check applies. |
| Execution authorization and exact approval | At the tool or execution boundary, before a consequential operation | Whether this identity may perform this specific action on this target with these parameters | Requires a reliable policy check and, where needed, a human able to review the proposed action. |
| Monitoring and stop controls | During or after a run, in the runtime or product | Detection and containment of suspicious activity | An operation may already have completed; alerts may miss issues or flag legitimate activity. |
| Task-specific adversarial testing | During validation and after system changes | Whether defenses hold against realistic inputs, tools, and actions | Test results are specific to the tested system and conditions; they do not establish universal prevention. |
Test the failure path before restoring autonomy
After changing a permission, policy, or execution gate, test both sides of the boundary: the intended task should still work, and the previously unwanted action should be blocked before it reaches the tool. Use adversarial cases drawn from the agent’s actual websites, documents, APIs, connectors, and task-specific actions, including indirect prompt injection embedded in material the agent consumes.
Repeat attempts and examine important tasks individually. An aggregate score can conceal a weakness in one consequential workflow. Expand the test set when the model, tools, data sources, or surrounding system changes. OWASP’s security guidance emphasizes testing agent-specific risks; NIST’s CAISI evaluation describes adaptive, task-specific testing across repeated attempts. Re-enable the same level of autonomy only after reviewing the revised boundary and its test results.
Free tools Windows power users keep installed
One-click scans. No signup required.
The findings in NIST’s January 2025 article concern specific historical model versions and test setups, not a measurement of current agents. Similarly, the article reports that one 2025 prompt-injection example from external security researchers worked 50% of the time under a specified user prompt. That is a result for that particular reported test—not a general prompt-injection success rate or a forecast for another agent, model, or task.
Best Value
What these controls cannot guarantee
No cited guidance promises that prompt injection or unwanted action can be prevented completely. OpenAI says its prompt-injection guidance may not prevent every prompt injection. Its API documentation explains that misalignment monitoring is asynchronous, can miss issues or flag legitimate activity, and may identify a concern after an action has completed. Treat monitoring as one layer, not as permission enforcement or proof that a run caused no changes.
Some products offer safer defaults, but behavior varies by product and task. For example, Anthropic describes Claude Code as read-only by default and requiring human approval before modifications. That is a vendor-specific example, not a default that can be assumed for other agents. If you are an end user without administrative controls, your practical role is to stop the run, review and report what happened, and ask the owner to change permissions or add execution gates.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
