Assistant Ready
Staying safe with AI
These are the steps I set up for myself and my clients before connecting an AI assistant to anything. Free to use, and free to share.
1. Lock down your accounts first
Your email account is the master key to everything else. Start there.
-
Turn on two-step verification
Use an authenticator app or passkeys rather than text-message codes.
-
Use passkeys where offered
They're easier than passwords and much harder to phish.
-
Use a password manager
The one built into your browser or phone counts.
-
Run a security checkup
See what's signed in to your account, and check whether your email address has shown up in a data breach.
-
Extra protection if you're a bigger target
Business owners, anyone who handles money, and people in the public eye: consider physical security keys, which you plug in or tap to sign in. Google's Advanced Protection is its strongest setting.
2. Connecting an AI assistant safely
The part most security guides skip.
-
Connect only what you'll use
Start with read-only access, and add more only when you need it.
-
Know how to see and remove access
Every app you've connected to your account is listed in one place. Check it a few times a year and remove anything you don't recognize.
-
Don't paste these into a chat
Passwords, verification codes, full card or bank numbers, and other people's private information.
-
Emails and web pages can carry hidden instructions
A message can try to trick an assistant into doing something you didn't ask for. Keep approvals on for actions like sending email or buying things.
-
Check your privacy settings
See what's stored and how to control it.
3. AI-era scams to watch for
-
Fake tech support
Anthropic, Google, Apple and Microsoft won't call you about a problem with your computer. A real security warning never asks you to call a number.
-
A "family member" in trouble
AI can copy a voice from a short clip. Hang up and call them back on a number you already know, and agree on a family code word.
-
Phishing with perfect spelling
AI has removed the typos that used to give scams away. Go to the company's website or app yourself instead of clicking the link.
-
"Move your money to keep it safe"
Always a scam, whether the caller says they're your bank, the government or the police.
-
Fake invoices and changed bank details
For businesses: before paying a new invoice or new payment details, call the supplier on a number you already have.
4. If something goes wrong
-
Secure the account
Change the password, sign out of all other devices, and remove any connected apps you don't recognize (links in section 2).
-
Report it
Report scams to the FTC and internet crime to the FBI. Forward phishing emails to reportphishing@apwg.org and phishing texts to 7726 (SPAM).
Want help setting this up?
It's part of every Business and Starter setup. We go through it together, and you do the typing.