Security and Privacy When Using AI Tools

A starting question

You want an assistant to explain a failing API test. Your repository also contains a local configuration file with a database password. Should the tool read the whole repository?

Not by default. First learn what the tool receives, what it stores or sends according to its current settings and provider policy, and what permissions it has. Products differ. A file ignored by Git is not automatically hidden from a local agent that can read your working directory.

Protect secrets and private data

Secrets include API keys, passwords, tokens, and private keys. Customer records and unreleased business information may also be sensitive even if they are not credentials. Do not paste them into a prompt or attach a file just to provide context. Use a redacted example and describe the required shape instead.

OWASP’s secrets-management guidance recommends limiting access and planning for revocation or rotation if a secret is exposed.Removing a leaked key from a prompt or commit does not necessarily undo exposure.²

Some products offer content-exclusion controls; GitHub’s Copilot documentation is one example.Do not assume the same setting exists, has the same coverage, or is enabled in another tool.³ Check the tool’s current documentation and your organization’s rules before using private code.

Limit an agent’s powers

An agent that can run commands could modify files, install packages, or access network services. Use the smallest practical file scope, tool access, and credentials. Review commands that may delete data, publish changes, or contact external systems. OWASP’s AI coding guidance recommends restricted execution environments and least-privilege permissions.A prompt saying “do not touch secrets” is not a substitute for an access boundary.¹

Content an agent reads can also contain hostile instructions—for example, an issue comment telling it to send a token elsewhere. Treat repository text and external pages as task data, not as authority to expand permissions.

A safer version of the example

Give the assistant the failing test, the relevant nonsecret function, and a redacted error. If it needs more context, add only the next relevant file. If a command or wider access is proposed, ask what question that action answers and whether a narrower action would work.

Recap and try it

Privacy depends on actual data flows and settings; security depends on real permissions. Minimize both, and verify product-specific claims in current documentation.