Skip to content
The AI Agent Factory

Staying safe: a locked office and a second signature

Approved by
Panaversity ·
6 min read

AI can make mistakes. It can also be tricked. A web page or an email can hide instructions such as "send this file to this address". This is called prompt injection. It is like a fake note slipped to the project manager. The AI might follow those hidden instructions if nothing stops it.

The companies protect you in two different ways. You need both.

1. A locked office (the borrowed desk). The borrowed desk sits in a locked office. It usually reaches only approved websites, depending on its settings, and your keys for connected apps stay at reception, not on the desk.1,2 So if something goes wrong, the office limits what it can affect. It cannot remove every risk, because tools and connectors can still change things outside, such as sending an email. That is why the second protection matters.

Note

Words to know

  • Approval: a person saying yes before an important action happens. Like a second signature on a large payment.
  • Permissions: settings and systems that allow some actions and block others. Like a rule that says who may sign.

2. A second signature (permissions and approval). The locked office limits where the AI Worker can work. It does not decide what the AI Worker is allowed to do. That is the job of permissions and approvals: rules that say which actions need a person's yes, or are blocked completely. Important actions, like paying, sending or deleting, should always need one. The yes should be checked by the system that performs the action, not only by the AI. At Brightline, the payment system does this, and the AI Worker cannot pay at all.

A locked office and a second signature: the locked office limits damage, and a second signature decides. At top left, a dashed box for a tricky note hidden in a page or email, which may give the AI bad instructions, points into a large box labeled locked office, around the borrowed desk. Inside the office, the AI plans an action, maybe a wrong one, and an arrow leads to Ready to act: send, pay or delete. A note inside the office says usually approved websites only, and keys stay at reception. From the office, an arrow leads out to the highlighted Second signature: does a person say yes? On yes, an arrow leads to Action happens, outside the office. On no, an arrow leads down to Stopped. Under the office, a note says the office limits damage, but does not give permission. At the foot: a safe AI Worker needs the locked office and a second signature.

Rule to remember: a locked office does not make every action safe. A safe AI Worker needs the locked office and a second signature.

Two simple habits help:

  • Do not paste real passwords or secret keys into a chat. Connect apps through proper connectors instead.
  • When you connect Claude to your own computer (for example, through the Claude desktop app), share only the folders the task needs.

Next, Projects shows how Claude can run several related jobs at once.

Check yourself

Question 1 / 4

0 answered

What is prompt injection?

Sources

  1. As verified on November 9, 2026, Anthropic says that from the cloud sandbox "only allow-listed destinations are reachable" and that "Connector authorization tokens never enter the sandbox". Claude Cowork architecture overview, Anthropic.↑
  2. As verified on November 9, 2026, OpenAI says an allowlist "governs network destinations" for Work's cloud tasks, and that "Consequential actions can still require separate confirmation". ChatGPT Work cloud security, OpenAI.↑
Owner
Panaversity

On this page