OWN IT. SECURE IT. PROTECT IT. MONITOR IT.

Beyond the Inbox: Getting More from AI Without Giving It Everything

GoBauer LLC

Article date:

October 15, 2026

Last reviewed:

October 15, 2026

Go Deeper: the intermediate add-on to Start Here, for everyday artificial intelligence (AI) users

This guide picks up where Start Here leaves off. Start Here has the full warning label and how to be the person in the middle, so we do not repeat them in detail.

The short version, if you're starting here. Before you share, install or click Connect, ask: What private data can it reach? What untrusted content will it read? How could it send, share or change something? Before AI acts for you, know how to pull the plug: find the Stop button first. And use AI on email you chose to show it, not on email that chose you.

Start Here used email as the example. This guide covers all of it: connections, built-in AI in email, calendar and chat, memory, web search, installs, agents, deleting, asking well, checking responses, long chats, and using AI at work. It's organized by the four pillars, so you can work through it one pillar at a time.

Why we use these checks

AI tools and connections promise to track subscriptions, summarize a week, review personal habits, and handle everyday tasks. Those uses can be helpful. We evaluate new tools in a separate test setup, with test accounts and made-up data. Testing in a sandbox does not remove the need to clean up inputs and check permissions.

Each detail seems small. Together, they can build a profile of you, kept on a company's servers until it's deleted. A hacked account or a data breach could expose it, and a change in the company's terms could change how it's used. At least one major company has started using AI chat conversations to personalize ads.

None of that is a reason to stop. AI is a force multiplier. But it multiplies everything it touches:

Your work. Used well, it helps one person do the work of several.
Accidental leaks. One paste reaches a company's servers, its memory, and sometimes its web searches. One connection can copy a whole inbox.
AI spawning AI. Agents can start other agents and helper tasks, each one with your access, some running on a schedule after you've walked away.
Attackers. Criminals use AI to write convincing phishing, clone voices and sift stolen mailboxes. Microsoft says the EvilTokens phishing kit used AI across the whole attack, from writing lures to analyzing what it stole.

The goal is to get the multiplier on your side without multiplying your risk.

Start with no keys

In September 2026, Nvidia's CEO, Jensen Huang, described how companies should treat AI agents: no matter how smart the agent is, the first step is to take away all of its rights. Then you give it access to files, data, tools or the internet only if it needs them, the same way no employee, not even an executive, gets access to everything. Security teams call this least privilege. Nvidia has even built an open-source tool, OpenShell, that keeps agents in a locked-down space and checks each action against rules before it runs.

The same rule belongs at home, with one twist: at work, an IT team does this for you. At home, you're your own IT department, and consumer AI often starts the other way around. Features arrive switched on, and permission screens ask for everything. So you have to take the rights away yourself, then hand back only what a task needs:

A browser extension that wants to "read and change all your data on all websites" to summarize one page.
A sign-in screen that asks for your email, contacts and files when the app only needs your name.
An agent that wants your whole drive when the task needs one folder.
A phone app that asks for your microphone, camera, contacts and location when it uses none of them for what you want.

Start with no keys. Give AI only the keys a task needs, and take them back when it's done.

First, the offer and the permission are two different decisions

"Find the newsletters I can unsubscribe from" is a task. Letting another service read your mailbox is an access decision. The convenience of the first shouldn't hide the consequences of the second.

A connector (or connection) lets an AI service reach another account, like your email, calendar or cloud storage. "Connect" and "Allow" buttons usually create one. A "Sign in with Google" or "Sign in with Microsoft" screen can too, if it asks for your email, files or contacts and not just your name.
Permissions define what that connection may do: read message contents, read attachments, send, delete or change settings. The permission screen describes requested access. Check it alongside the actual settings and terms; the friendly offer alone does not define the boundary.
Read-only limits direct changes through that connection. Information it reads can still be exposed, processed, or retained under the service's terms. It is not a confidentiality guarantee.

Three things surprise most people:

Narrowing the request doesn't narrow the access. Asking about "only my newsletters," or pointing at one folder, is an instruction. Unless the permission itself is limited, the assistant may still reach everything else.
Asking the AI isn't checking. "Can you only see my newsletters?" gets an answer the model generated, not a report from the permission system. Check the settings yourself.
Built-in AI has no Connect button. AI built into your email, phone or office software already has access. Not seeing a permission screen doesn't mean nothing is reading.

OWN IT: Know what you have and what you're agreeing to

Find where AI already lives

You can't protect what you don't know you have. AI hides in more places than people expect:

Chat apps like ChatGPT, Gemini, Claude and Copilot, on every device you use
Features built into email, documents, phones, keyboards and search
AI built into your computer, like Copilot on Windows and Apple Intelligence on a Mac (see Start Here, Step 1). Note which features you've turned on.
Browser extensions and add-ins
"Sign in with Google" or "Sign in with Microsoft" accounts that quietly granted access
Meeting note-takers that join calls and record them

Make a simple list: the tool, the account (personal or work), and what it's connected to. The Private AI List template on the Checkup Prompt page has columns for this.

Decide your risk appetite before a pop-up decides for you

Your risk appetite is how much risk you're willing to accept for a given benefit. It can differ by task:

Cautious

Approach: No connections. Be the person in the middle for everything, in a basic chat with web search and memory off.

Balanced

Approach: A short-lived connection for one task. Turn training and memory off first, keep web search off, do the task, save the answer, then remove access and clean up.

Accepting

Approach: An ongoing connection to a tool you've reviewed. Keep other connections off, review it monthly, and accept the risks you've read about here.

Shadow AI: personal tools, work information

Shadow AI is AI used at work without the company's approval, like pasting a customer email into a personal chatbot, or a note-taker someone added to a meeting on their own. It's almost always done with good intentions: getting work done faster. But it moves company, customer or patient information into accounts the company can't see, protect or delete.

The fix isn't avoiding AI. Not using it has risks too. If a company invests six figures a year in a person, a few dollars a day of AI that saves hours is a reasonable expectation, the same way no one expects you to do your job with paper and pencil instead of a computer. AI is a force multiplier, and companies increasingly expect people to use it.

What responsible looks like:

Follow your company's AI policy, standards and guidelines. Use the approved tools with your work account.
Keep work and personal separate. Your personal plan doesn't come with your company's contracts, retention rules or controls.
Don't move work to your own devices to get around the rules. Typing work information into a personal AI app on your phone, photographing your screen, or forwarding work email to a personal account is still shadow AI, even when the company's controls can't see it. Working remotely on a personal computer is the same: it isn't covered by your company's protections, contracts or retention rules. Some companies do allow approved apps on personal devices, so follow what your policy allows on that device. Once work information lands in a personal account, your company can't protect it or delete it.
Raise opportunities. If AI could save you hours on a task, tell your supervisor. Show the time it would save.
Raise red tape, too. If the rules or approved tools get in the way of good work, say so to your supervisor or leadership. That's how better tools get approved, and it beats working around the rules.

Connecting can copy your data to another company

Start Here's Outlook example isn't limited to Gmail: Microsoft's help pages say the same synchronization applies to Yahoo and AOL accounts, and it covers calendar and contacts as well as email. The same pattern shows up anywhere one service connects to another. Before any connection, ask: who keeps a copy now, under whose terms, and how do I delete it?

When the AI is already in your inbox

A Google email ad says: "With Gemini in Gmail, you can draft professional responses, summarize long threads, and catch up on conversations in seconds." That's real value. It also means the AI reading your inbox comes built in, and it reads messages from strangers too.

In September 2026, the security training company KnowBe4 reported testing this in its own lab. It sent a French-language email about a contract renewal, with instructions hidden in the message's code. The text was set to be almost completely transparent, so a person couldn't see it, and Gmail's filter let it through as ordinary formatting. When the researchers asked Gemini in Gmail's side panel to translate the email, the translation was accurate. But below it, Gemini added a "Translation Verification Log" holding two one-time login codes copied from other emails. Gmail's side panel stripped the links that would have carried those codes out and blocked sending on its own, so the codes showed up in the answer but didn't leave. In a second test, a Google Apps Script workflow (a small automation built on top of Gmail) that drafts replies with an older Gemini model sent a one-time code from an unrelated email to an outside server when the draft was opened, through a hidden image in the draft. Newer Gemini models KnowBe4 tested resisted that trick. Both results matter: one layer failed, other layers held, and a homemade setup without those layers leaked.

KnowBe4 sells email security, so weigh its warnings with that in mind. The tests used different setups and don't prove every assistant has the same flaw today. But independent researchers have reported similar results since 2024, and KnowBe4 says real phishing emails now include some aimed at AI assistants instead of people. Google has published a layered defense: training Gemini to resist these attacks, filters for hidden instructions, removing suspicious links and images from answers, and confirmation before risky actions. Google also says the work is ongoing.

What that means for you:

Asking a built-in assistant about one message doesn't limit what it can read. In KnowBe4's test, translating one email pulled codes from others. Copy the message you chose into a separate chat instead.
Keep codes out of reach. A passkey or authenticator app keeps login codes out of your inbox in the first place.
Know your switches. The next section walks through them.

On by default, without a warning label. Much of this AI arrived switched on. In January 2026, Google announced Gemini features turned on in Gmail, starting in the U.S. (Europe's privacy rules mean opting in there). In January 2025, Microsoft added Copilot to Microsoft 365 Personal and Family, with a $3 a month price increase; people who didn't want it had to switch to a Classic or Basic plan. The same month, Apple's iOS 18.3 and macOS Sequoia 15.3 began turning on Apple Intelligence by default on compatible devices. Each was announced, in a blog post, release notes or a pricing email. None came with the side effects listed next to the benefits. So check your settings even if you never said yes, and look again after updates.

The same goes for your calendar and chat. A calendar invite is email that lands on your schedule, and in 2025 researchers at SafeBreach showed hidden words in an invite could get Gemini to delete events, open a video call and even control smart home devices. Google added defenses. Start Here lays out what can happen if you leave built-in AI on, and three levels to choose from: Cautious (off), Balanced (only the feature you use) and Accepting (on, with safety settings). It's your call, based on your own risk and your family's.

A work account managed by an employer can come with contracts and admin controls a personal account doesn't have. Those help decide who can see your data. They don't stop a stranger's email from talking to the assistant. An agreement covers the vendor's walls, not its doors.

Lock down your email AI

Use Setup Steps for the dated email settings. Google separates smart features within Gmail, Chat, and Meet; across Workspace; and in other Google products. Those controls are independent, and some features have additional switches. Changing one is not proof that every AI feature is disabled.

Also review external images, dynamic email, and calendar invitations. Limiting automatically added invitations reduces unwanted calendar entries; familiar senders can still be compromised, and the invitation email can still exist. For work or school accounts, ask your administrator which controls apply.

Five switches worth checking

Using ChatGPT as an example, because its wording is unusually clear, here are settings worth knowing, building on the three in Start Here. As of October 2026, training is under Settings, then Data Controls, and the rest are under Settings, then Personalization. Other assistants have similar settings with different names.

Training. Check whether your chats are used to train future models, and turn that off if you'd rather they weren't.
Memory. Read the memory summary before deciding whether memory stays on. It's built from your chats, files and connected apps.
Automatic web search. Turn it off for private work. You can still search on purpose for a single question.
Automatic connector search. Turn it off unless you need it.
Automatic search of saved files and recordings. Turn off anything that pulls stored material into chats you didn't intend.

Web search is a door

Many assistants search the web on their own. To search, they write a query from what's in your conversation and send it to a search company. ChatGPT's own settings say it plainly: "ChatGPT may use Memory to personalize queries to search providers, such as Bing."

The safe working assumption: anything in a conversation, including what a connector pulls in, could be sent out in a web search. Keep private work and web research in separate chats.

And never make a chat with sensitive details public. In 2025, thousands of shared ChatGPT conversations turned up in Google search results. OpenAI removed that option, but a public share link is still the path from a private chat to the public web.

Installs count too

AI tools increasingly offer to install something: a plugin, skill, extension, add-in or desktop helper. Start Here called an install a Connect button that stays. Before you say yes, know what it is and who made it, why you need it, where it goes, what it can read (which may extend beyond today's document, depending on its permissions) and how to remove it. Reviews and store listings don't prove safety. If you can't answer, don't install. Be the person in the middle instead.

Approve only what you started

If a sign-in or permission prompt appears that you didn't start, close it, even if the page looks genuine. In September 2026, Microsoft reported on a phishing kit that tricked people into approving an attacker's sign-in on a real Microsoft page. Microsoft says it got into more than 12,000 inboxes this year, got around multifactor authentication, and kept access by creating hidden inbox rules and adding new devices.

How you sign in matters too, but less than how well it's protected. Signing in alone doesn't let the AI read your email; a screen that also asks for your email, files or contacts does. A separate email and password keeps the AI account apart from your other accounts; Sign in with Google, Apple or Microsoft saves a password but ties the accounts together; a social sign-in like Facebook is only as strong as that account's own protection. Setup Steps compares them. Either way, protect sign-in with a passkey, or a unique password with multifactor authentication (MFA, also called 2FA) using an authenticator app. Codes sent by email or text are weaker: anyone who gets into your email or takes over your phone number gets them too. A connected AI account now protects more than itself: anyone who gets into it may reach your chats, files and everything connected.

PROTECT IT: Prepare, check and stay in charge

The person in the middle, the full version

Start Here covered the basic steps: copy from the source, paste into a plain-text editor, remove and review, then paste the cleaned-up text into the chat. Never copy straight from the original into the chat: some apps process text as you paste or type, and a dragged-in file starts uploading with its hidden author, edit history and file name. For bigger jobs, add these:

Summarize it yourself. Often the best input is your own two-sentence summary, not the original.
Redact what isn't needed: remove it entirely.
Use consistent pseudonym labels like [PERSON_A] and [COMPANY_B], so the AI can still follow who's who.
Keep a label key, your private list of who each label really is, outside AI.
Restore real names in your own notes after you get the answer.

Swapping in labels is called pseudonymization. It reduces what you share, but it doesn't make data anonymous, so it won't meet a requirement to anonymize: a job title, a date or a town left in the text can still point to a person, and privacy laws like Europe's GDPR still treat pseudonymized data as personal data. Labels also don't stop hidden instructions.

Why ignored emails are ticking time bombs

Security researchers call it indirect prompt injection: instructions that reach an AI through the content it was asked to read, rather than from you. In 2025, a flaw called EchoLeak showed a single crafted email could lead Microsoft 365 Copilot to send out data from the user's other files, with no click at all. Microsoft fixed it. In early 2026, researchers showed a calendar invitation could lead Gemini to copy private meeting details into a new event. Google mitigated it. In 2026, researchers at Zenity Labs showed similar attacks against several AI browsers that act for you.

Vendors fix each one. The pattern keeps coming back, because the design keeps mixing private data, untrusted content and a way to send things out. That's what the three questions are for.

How data leaves without hitting Send

When a picture in an AI reply loads, your device asks another website for it. That's the envelope from Start Here. Security teams call this step rendering: turning content into the page you see. Previews and formatted drafts can make those requests the moment they're displayed, so "I'll review it before sending" isn't a complete safeguard. Calendar events and shared files the AI creates can leak too, because other people can see them. When you can, ask for answers as plain text.

Good requests get better answers, and they let you describe instead of paste. Build on Start Here's four parts:

Give an example of what good looks like: "Write it like this one, but about our trip."
Ask it to ask you questions first: "Before you answer, ask me up to five questions you need answered." You decide what to share in reply.
Set the role and limits: "Act as a careful editor. Don't add facts I didn't give you."
Reuse what works. The Everyday AI Prompts and Use Cases include a Guided Planner that walks any task step by step, with the safety settings built in.

Check responses with a second opinion

Asking two or three different AIs the same question is one of the best habits you can build. It catches mistakes, gaps and made-up facts. To get the most from it:

Ask a second AI to critique the first one's answer, not just to answer the question again.
Ask both to cite sources and say what they're unsure of.
Remember that agreement isn't proof. Several AIs can repeat the same bad source. Researchers at Vigilance Security, as reported by KnowBe4, found fake support numbers for 374 major brands planted where AI tools read them.
Share only the cleaned-up version with each one. Every extra AI is another company with a copy.
Check what matters against the original: numbers, dates, contacts, medical and legal facts.

Before AI acts for you, know how to pull the plug

If you let AI act for you, by sending, booking, buying or browsing, know how to stop it before you start. Treat an AI agent like cooking on a stove: stay nearby, and turn it off before you walk away.

Find the Stop button first, and try it on a harmless task. Closing the window or app usually doesn't stop work the AI service already started, because it runs on the company's computers.
Know the layers. Stopping the current task is different from turning off scheduled tasks, and both are different from removing the AI's access.
Use the app's real controls, then check that the task, its queue and any schedules actually stopped.
Stopping doesn't undo. Sent emails stay sent and shared files stay shared until you reverse them yourself.
Approve anything before it's sent, shared, bought, deleted or changed.

The Advanced guide goes further on agents, scheduled tasks and installs.

Start fresh before the chat gets tired

Long chats drift. The AI can only keep so much in view, so it quietly drops older parts, and your early instructions often go first. Mistakes pile up as it builds on its own earlier answers, and if a trick slipped in early through something you pasted, it keeps steering what follows. A long chat also holds more of what you shared, so there's more to lose if the account is broken into.

General rule: one task, one chat. Start a new chat when the topic changes, after a long working session, particularly when the task has accumulated many messages or large pasted inputs, or when the app says it's summarizing the conversation. Start sooner if you've pasted a lot of text, even text you cleaned up first: every paste uses up room the AI needs to remember your earlier instructions. Start right away if you see warning signs: forgotten rules, repeats, contradictions, mixed-up names or versions, made-up details, or ignored formatting.

To carry on, paste this into the old chat:

We're going to continue this in a new chat. Write a handoff summary
I can paste there. Include:
1. The goal, in one or two sentences.
2. Decisions we made, and why.
3. Where we are now, and what's done.
4. What's left to do, in order.
5. My rules and preferences, word for word where I gave them.
6. Anything you're unsure about, marked "Check this."
Leave out passwords, codes, account numbers and personal details.
Don't add anything we didn't discuss. Keep it under one page.

Then be the person in the middle: copy the summary into a plain-text app, fix anything wrong, remove anything private, and check every "Check this" item. Paste it into a new chat with "Here's where we left off. Confirm you understand, and list any questions before we continue." Keep the real decisions in your own notes, because a handoff can carry a mistake forward. Delete the old chat once the new one is working.

Your inbox is already part of your health record

Your email and calendar may hold appointment reminders, lab-result notices, pharmacy messages, insurance statements, and your family's information too. Connect your inbox and you may be connecting part of your health record without meaning to. With memory on, AI may save what it infers as a "fact" about you.

Some AI services now let you connect medical records directly. HIPAA applies to covered entities and business associates acting in those roles. HHS explains that, in most cases, a personal app's copy is outside HIPAA unless the app is provided by a covered entity or its business associate. Consumer protection and other privacy laws may still apply. The healthcare provider keeps its duties for the original record.

Back up sensitive files safely

Email and cloud drives often double as backups, and losing your files is a real risk too. Keep the backup benefit without making one account your single point of failure:

Keep sensitive files in a cloud folder, not in your inbox. Your inbox is where mail from strangers lands, and where email AI reads.
Encrypt the most sensitive files before you upload them. On Windows, the free 7-Zip program can make an AES-256 encrypted archive. On a Mac, Disk Utility can make an encrypted disk image. Store the passphrase in your password manager; lose it and the file can't be opened. If the account is broken into, or an AI reads your drive, encrypted files are just scrambled data.
Follow the 3-2-1 rule: three copies, on two kinds of storage, with one somewhere else. For example, the original, a cloud copy and an encrypted external drive at home. Google Takeout (takeout.google.com) can download a full copy of your Gmail and Drive.
Test a restore once or twice a year. Open a file from each backup. A backup you've never restored is a guess.
Lock the account that holds your backups: a passkey, current recovery options, backup codes stored offline, and Google's free Advanced Protection Program if you want the strongest option. Inactive Account Manager lets a trusted person reach your files if something happens to you.
Check access: remove outside apps you don't use from your account's security settings, and make sure sensitive files aren't shared with "Anyone with the link."
Or choose end-to-end encrypted storage, where the company itself can't read your files. Some services offer it, and Apple's iCloud has an optional Advanced Data Protection setting. Regular personal Google Drive isn't end-to-end encrypted.

Close out each task

When a task is done, save what you need on your own device, and delete the chats, uploads, shared links and prepared copies you no longer need. Everything left in an account is part of your footprint, or attack surface, and it widens the blast radius if that account is ever hacked or the company is breached. Less stored means less to lose.

MONITOR IT: Check monthly, and after updates

Off isn't erased

Retention means how long a company keeps what you gave it. Each of these is a separate control:

Training off means your new chats aren't used to improve future models. It doesn't delete anything.
Memory off stops the assistant from building a profile for future chats. Existing memories may stay until you delete them.
Deleting a chat removes it from your history, but the company may keep backend copies for weeks, and longer if required by law or flagged for safety review.
Disconnecting a connector may not remove the permission at the source account, and services behind a connection may keep their own copies.

For each AI service you use, find out what's kept, for how long, and how to delete it.

Your monthly check

Read your security alerts for new sign-ins, devices and apps given access. Check each one by signing in yourself.
Look for quiet changes: new permissions and connections, unfamiliar memories, inbox rules that forward or hide mail, calendar events you didn't create, and public share links.
Recheck after updates. Updates can turn features and settings back on, and email services add new AI features quietly. Make sure your email, calendar and chat AI still match the level you chose, including features you never turned on.
Shrink your footprint: delete chats, uploads and shared links you no longer need, and review memory.
Each quarter, retire what you're done with: remove connections and installs at the source. Less left behind means a smaller attack surface and blast radius.

If something goes wrong

Stop the task and any scheduled tasks. Remove the AI's access in the AI app and at the source account. Check those accounts for messages, files, events and charges, and undo what you can. Change your password and remove the app's access; they're separate steps, so do both. At work, tell your IT team right away.

What you notice while monitoring sends you back to Own IT. That's what makes this a lifecycle instead of a one-time checklist.

Keep the right expectations

Turning off connections, web search and agent actions reduces exposure. It doesn't guarantee containment. A checked box records a decision, not a guarantee of safety.

We are stewards of more than our own information. Our families, coworkers and clients trust us with theirs. We want every AI service to protect sensitive information by design. Until it does, it's on each of us to be good stewards and our own advocates. And keep asking AI companies to do better.

Your next step

Check your setup with the Personal AI Security Checklist, or paste the Checkup Prompt into a basic chat and let AI walk you through it.
Try one recipe from the Safer AI Recipes.
Weigh the risks with the AI Risk Matrix.
Go further with the Advanced guide: agents, skills, short-lived access and running AI on your own computer.
Share Start Here with friends and AI at Home with families.

What warning would you add to the label? Join the conversation on LinkedIn.

Own IT. Secure IT. Protect IT. was the 2019 Cybersecurity Awareness Month theme from CISA and the National Cyber Security Alliance. Monitor IT is the author's addition, because the first three are a theme and setup, but adding the fourth turns it into a repeatable lifecycle and sends you back to Own IT. This is an independent guide, not a CISA publication or endorsement. The author develops commercial security tools in this area; this guide is tool-neutral and recommends no product. Assistants named here are examples, not endorsements. Settings were checked in October 2026 and may change. This guide is general information, not legal advice. CC BY 4.0.

Sources

Explore the guides

All AI safety guides | Reference library

Back to all resources