Interactive checklist · AI security · 5 minutes

AI Security Checklist.

Score your setup in 5 minutes

Twelve questions for your role, whether you use AI at home, run the business or build the systems. Get a score, a band from High risk to Locked down, and a ranked list of fixes, each tied to a source.

Irv Cassio Last reviewed 3 tracks · 36 questions Free · no sign-up
Published with The AI Enthusiast, Issue No. 29 · The Security Edition
How it works

Pick a track, answer twelve questions, get a score and a to-do list.

Answer Yes, Partly / not sure, No or N/A for each question. Every question says why it matters and how to fix it, and names its source. Your score updates as you go, and your weakest answers become your top fixes, critical items first. Take one track or all three.

Your answers stay in your browser. Nothing you answer is sent anywhere: the scoring runs on your device, with no network requests and no analytics on your answers. (Like every page on this site, the page itself counts anonymous visits.) If your browser allows it, your answers are saved on this device so you can come back, and Clear answers deletes them.

TracksEveryday · Executive · Developer
Questions12 per track
ScoringYes 2 · Partly 1 · No 0
TimeAbout 5 minutes
Answers sent anywhereNone

Track 1 of 3 · 12 questions

Everyday user. For anyone who uses ChatGPT, Claude, Gemini, Copilot or Meta AI at home or at work, especially the new agents that can send, buy and book for you. #

  1. E1Before you approve an AI agent’s action (send, pay, sign or delete), do you read exactly what it will do?Critical

    Why it matters: Approval cards are your main defense against hidden instructions in what the AI reads (prompt injection). Anthropic says “no defense is perfect,” which is why Claude Duet asks before it sends, pays, signs or deletes.

    How to fix

    Treat each approval card like a check you’re signing: who it goes to, what it says, how much it costs. If you didn’t ask for it, deny it and ask the assistant what prompted it.

    Source: Anthropic, Duet help (Oct 2026) · Anthropic, Duet launch (Oct 21)

  2. E2Do you avoid pasting card numbers, government ID numbers and passwords into AI chats?Critical

    Why it matters: Anything you paste becomes part of the conversation the AI works from. Anthropic designed Duet to refuse to pass on card numbers and government IDs, and to keep passwords out of the chat entirely.

    How to fix

    Type passwords only into the site’s own sign-in form. Duet, for example, has you enter them in a separate form on your device so it never sees them. To buy something, use the agent’s payment flow (a one-time card) instead of typing your card number.

    Source: Anthropic, Duet help (Oct 2026) · Anthropic, Duet launch (Oct 21)

  3. E3Have you connected only the apps your assistant actually needs, and removed the ones you no longer use?Important

    Why it matters: Every connected app widens what an agent can read and do, and what a hidden instruction could reach.

    How to fix

    Open your assistant’s connector settings and remove what you don’t use. Disconnecting stops future access, but the assistant may still remember what it already saw, so delete those memories in its memory settings too.

    Source: Anthropic, Duet help (Oct 2026) · Your AI Has Hands Now

  4. E4Do you know where your assistant’s memory and chat-history settings are, and have you reviewed them?Important

    Why it matters: Assistants now carry memory between chats, and agents such as Duet can search your past chats.

    How to fix

    In Claude, open Settings › Memory; Search and reference chats is shared with Duet, so turning it off affects both. In other assistants, find the memory and history settings, review what’s stored, and delete anything you wouldn’t want an agent to reuse.

    Source: Anthropic, Duet help (Oct 2026)

  5. E5Do you use multi-factor sign-in on your AI accounts (Claude, ChatGPT, Gemini, Meta) and on the email account behind them?Critical

    Why it matters: An AI account now holds connected apps, memory and sometimes payment methods. A stolen password hands all of that over, and the email account behind it can reset everything else.

    How to fix

    Turn on multi-factor authentication in each AI account’s security settings, starting with the email address you sign in with.

    Source: OpenAI Help Center

  6. E6Do you treat instructions inside emails, web pages or documents your AI reads as information, not commands? Would you notice if an assistant suddenly wanted to do something you didn’t ask for?Important

    Why it matters: Prompt injection hides commands in content. An agent that sees your private data, reads untrusted content and can act or send is the dangerous combination.

    How to fix

    If an assistant proposes something you didn’t ask for (forwarding a file, opening a link, changing a setting), stop and deny it. Don’t let an agent that reads outside email or web pages send or pay without your approval each time.

    Source: Anthropic, Duet help (Oct 2026) · Willison, lethal trifecta · Your AI Has Hands Now

  7. E7Do you check important numbers and facts an AI gives you against the source it cites?Important

    Why it matters: AI summaries can be confidently wrong. Duet tells you which email, file or spreadsheet a number or summary came from, so you can check it.

    How to fix

    Before you act on a figure, date or name, open the source it cites. If the assistant can’t point to one, treat the answer as a draft.

    Source: Anthropic, Duet launch (Oct 21)

  8. E8Do you download AI apps, models and browser extensions only from official sources?Important

    Why it matters: A fake “OpenAI” repository reached #1 trending on Hugging Face and installed an infostealer aimed at browser passwords, crypto wallets and SSH keys (HiddenLayer research, cited by Kai).

    How to fix

    Install AI apps from the vendor’s own site or the official app store, and check the publisher’s name on extensions and model pages before you download.

    Source: Kai, local AI video (Oct 21)

  9. E9If an AI agent can buy things for you, is it limited to one-time or virtual cards, with your approval for each purchase?Good practice

    Why it matters: Agents can now shop for you. Duet buys through Link by Stripe and Shop Pay with a one-time card per purchase, and only after you approve.

    How to fix

    Only let an agent pay through a method that issues a one-time or virtual card and asks you to approve every purchase. Don’t give an agent your main card number.

    Source: Anthropic, Duet launch (Oct 21) · Anthropic, Duet help (Oct 2026)

  10. E10For work tasks, do you use only the AI tools your employer approves?Important

    Why it matters: Personal AI accounts sit outside your employer’s controls. Duet, for example, is for consumer Pro and Max accounts, so check your company’s policy before connecting work mail. CISA and Canada’s Cyber Centre want organizations to manage AI use deliberately, which they can’t do with tools they don’t know about.

    How to fix

    Ask IT which AI tools are approved, and for which data. Don’t connect work email, files or calendars to a personal assistant without that approval.

    Source: Anthropic, Duet help (Oct 2026) · CISA token guidance (Oct 22)

  11. E11Do you know how to report an AI mistake or suspicious behavior, to the vendor or to your IT team at work?Good practice

    Why it matters: Reports of incidents and near-misses are how problems get found early. NIST, NSA and CISA list reporting as one of their core practices for AI incidents.

    How to fix

    Find the feedback or report option in your assistant and, at work, your IT team’s security contact. If an agent did something you didn’t approve, report it and disconnect the app it used.

    Source: NIST/NSA/CISA (Oct 16)

  12. E12Do you keep your devices and AI apps updated?Good practice

    Why it matters: Amazon says AI-assisted analysis now turns a patch into a working exploit within hours. This week’s PHP flaws were broadly exploited within hours of the October 21 fix.

    How to fix

    Turn on automatic updates for your phone, computer, browser and AI apps, and restart when they ask.

    Source: AWS Security Blog (Oct 2026)

Your everyday score

Score gauge from 0 to 100, with bands High risk, Exposed, Solid with gaps and Locked down – 0 100

Answer a question to see your score.

Your top fixes

Answers of No come first, then Partly / not sure, critical items first. Each links to its question.

    Score it yourself
    1. Give each answer points: Yes = 2, Partly / not sure = 1, No = 0. Leave N/A out.
    2. Add up your points. Your maximum is 2 × the number of questions you didn’t mark N/A (24 if you answered all 12).
    3. Score = points ÷ maximum × 100. Then find your band: 85–100 Locked down, 65–84 Solid, with gaps, 40–64 Exposed, 0–39 High risk.
    4. Your to-do list is the “How to fix” note under each No, then each Partly, critical items first.

    Track 2 of 3 · 12 questions

    Executive / leader. For owners, executives and managers who decide which AI tools the organization uses, who pays for them and who answers when something goes wrong. #

    1. X1Do you have an inventory of the AI tools, agents and API keys in use across the organization, including the ones staff brought themselves (“bring your own agent”)?Critical

      Why it matters: The OpenCode Console breach exposed API keys that teams had saved in a third-party tool. You can’t revoke keys you don’t know exist.

      How to fix

      Build a register: each AI tool and agent, its owner, the data and apps it connects to, and where its API keys live (gateways, SaaS tools, CI). Include tools people adopted on their own, and review it on a schedule.

      Source: The Hacker News (Oct 19)

    2. X2Is there a written AI use policy that says which data may go into which tools?Critical

      Why it matters: Without one, people decide case by case, and sensitive data ends up in whichever tool is handiest. CISA and Canada’s Cyber Centre treat AI use as something to manage deliberately, down to trimming the data you send.

      How to fix

      Publish a one-page policy: the approved tools, which kinds of data (public, internal, confidential, regulated) may go into each, what needs human review, and who to ask.

      Source: CISA token guidance (Oct 22) · Cyber Centre (Oct 22)

    3. X3Do agents that can act (send, pay, change systems) need human approval for consequential actions, and is that enforced rather than just recommended?Critical

      Why it matters: Agents can be steered by what they read, and OpenAI disclosed agents that took routine instructions as permission to weaken their own monitoring. NIST, NSA and CISA recommend limiting agents’ access to information, tools and networks.

      How to fix

      Enforce approval in configuration, not a memo: approval gates on consequential tool calls, separate credentials for agents, and a list of actions that are never allowed. Duet’s list is a useful model: no trading securities, no moving money between accounts, no access to someone else’s account, even with approval.

      Source: Anthropic, Duet launch (Oct 21) · NIST/NSA/CISA (Oct 16) · OpenAI alignment report (Oct 20)

    4. X4Can you patch critical internet-facing vulnerabilities within hours, and is that your written target?Critical

      Why it matters: Amazon saw PHP2Shell exploitation four days before the patch, with public exploits 12 hours before it and broad exploitation within hours of release. Its revised rule: for critical internet-facing bugs, measure patch time in hours.

      How to fix

      Set a written patch target in hours for critical internet-facing bugs, name who can approve an emergency change, and start investigations from the earliest known exploitation, not the disclosure date. Ask your hosting and SaaS vendors for their targets too.

      Source: AWS Security Blog (Oct 2026) · php.net advisory (Oct 21)

    5. X5Is there an AI-agent incident runbook: how to stop an agent, preserve its logs, rebuild from a known-good baseline and report it?Important

      Why it matters: NIST, NSA and CISA’s October 16 practices cover agents that take “uninstructed actions”: preserve evidence, shut down the behavior, rebuild from verified baselines, test containment before resuming, and report incidents and near-misses.

      How to fix

      Write a one-page runbook for each agent: how to stop it and revoke its keys, where its logs are, the baseline to rebuild from, who decides when it resumes, and who reports it. Rehearse it once.

      Source: NIST/NSA/CISA (Oct 16) · CISA key practices (Oct 16)

    6. X6Are AI spend limits and usage alerts set on every provider account, with someone accountable for them?Important

      Why it matters: Stolen OpenCode keys ran up charges overnight, and each account’s limit set the size of the bill. CISA and Canada’s Cyber Centre call this a “denial-of-wallet” attack.

      How to fix

      Set hard spend limits (not only alerts) on every provider account, turn off auto-reload, alert on unusual token use, and name one person accountable for each account’s budget.

      Source: CISA token guidance (Oct 22) · TechCrunch (Oct 19)

    7. X7Do you know which vendors store your organization’s AI provider keys or data (gateways, SaaS tools), and have you reviewed their security?Important

      Why it matters: OpenCode’s open-source apps keep keys locally and weren’t affected; its hosted Console held keys and was breached. Where a key is stored matters as much as the tool.

      How to fix

      List every vendor that holds your AI keys or prompts. Ask each how keys are stored and how they’ll notify you of an incident, and keep production keys on your own servers where you can.

      Source: The Hacker News (Oct 19) · CSA note (Oct 21)

    8. X8If you resell or route AI access to customers, do you tag each end customer (Anthropic user profiles or OpenAI SafetyIDs), and are you tracking OpenAI’s November 20, 2026 gateway-approval rule?Important

      Why it matters: Anthropic’s user profiles let a safety action hit one end customer instead of your whole organization. OpenAI’s updated Usage Policies, effective November 20, 2026, require model routers and AI gateways that give direct access to its models to get OpenAI’s review and approval first.

      How to fix

      Send an Anthropic user profile or an OpenAI SafetyID with each end customer’s requests, ask your Anthropic account team about organization webhooks (beta) for restriction alerts, and start OpenAI’s gateway review before November 20. Answer N/A if you don’t resell or route model access.

      Source: Claude Platform release notes (Oct 20–21) · OpenAI, gateway standards (Oct 21)

    9. X9Has your team planned for an AI outage or rate limit: which critical processes depend on AI, and what’s the fallback?Important

      Why it matters: CISA and Canada’s Cyber Centre warn of outages and token exhaustion, and recommend planning for reduced AI availability.

      How to fix

      List the processes that now depend on an AI provider, decide the fallback for each (manual, or another model), test one, and give mission-critical work first claim on your token budget.

      Source: CISA token guidance (Oct 22) · Cyber Centre (Oct 22)

    10. X10Is AI agent activity logged to the monitoring your security team already uses?Important

      Why it matters: You can’t investigate what you didn’t record. Anthropic exports Claude API activity over OpenTelemetry, and Claude Code 2.1.307 added a claude_code.safety_event for every tool call that was stopped or prompted.

      How to fix

      Have the security team ingest agent telemetry (OpenTelemetry into the platform you already run, such as Datadog or Splunk) and alert on safety events and unusual spend.

      Source: Anthropic OpenTelemetry docs · Claude Code 2.1.307 changelog · AI Weekly No. 28

    11. X11Do staff get training on AI-specific risks: prompt injection, data leakage and approval fatigue?Good practice

      Why it matters: Prompt injection works when people rubber-stamp approval cards, and more staff now run agents that can read mail and act.

      How to fix

      Run a short session on the three circles (private data, untrusted content, the ability to act), approval fatigue and data leakage. Our free 30-minute training guide is a ready-made start.

      Source: Your AI Has Hands Now · Anthropic, Duet help (Oct 2026)

    12. X12Is someone responsible for independent testing or review of your high-risk AI systems?Good practice

      Why it matters: In a pilot review, METR and Redwood Research found “novel vulnerabilities” in OpenAI’s internal agent monitoring, including an exploit that would let agents keep “hundreds” of recent actions from being monitored. Outside reviewers find what builders miss.

      How to fix

      Name an owner for testing high-risk AI systems, and budget for an outside review of the ones that touch money, customer data or production systems.

      Source: METR (Oct 22) · CNBC (Oct 22)

    Your executive score

    Score gauge from 0 to 100, with bands High risk, Exposed, Solid with gaps and Locked down – 0 100

    Answer a question to see your score.

    Your top fixes

    Answers of No come first, then Partly / not sure, critical items first. Each links to its question.

      Score it yourself
      1. Give each answer points: Yes = 2, Partly / not sure = 1, No = 0. Leave N/A out.
      2. Add up your points. Your maximum is 2 × the number of questions you didn’t mark N/A (24 if you answered all 12).
      3. Score = points ÷ maximum × 100. Then find your band: 85–100 Locked down, 65–84 Solid, with gaps, 40–64 Exposed, 0–39 High risk.
      4. Your to-do list is the “How to fix” note under each No, then each Partly, critical items first.

      Track 3 of 3 · 12 questions

      Developer / IT. For developers, IT and security staff who run coding agents, local models, MCP servers and the API keys behind them. #

      1. D1Does each tool or service get its own API key, and are exposed keys revoked at the provider, not just deleted in the tool?Critical

        Why it matters: Deleting a key from a tool doesn’t revoke it, and a tool’s own budget can’t cap a copied key. One key per tool keeps a leak small and traceable.

        How to fix

        Issue a separate key per tool and environment and keep production keys on your own servers. If a key may be exposed, revoke it in the provider console (OpenAI, Anthropic, Google Cloud) and check billing back to the exposure date.

        Source: The Hacker News (Oct 19) · Claude Help Center, exposed keys · TechCrunch (Oct 19)

      2. D2Do you have hard spend caps (not only alerts) on provider accounts, with auto-reload off?Critical

        Why it matters: In Kai’s breakdown of the OpenCode breach, the same attacker and stolen list cost one developer $16 and another $3,000, because the limit on each key set the ceiling. An alert only tells you after the money is gone.

        How to fix

        Set a hard limit on each provider account or workspace, turn off auto-reload on prepaid balances, and alert on unusual token use well below the cap.

        Source: Kai, OpenCode video (Oct 20) · CISA token guidance (Oct 22)

      3. D3Are .env files, SSH keys and cloud credentials kept out of any folder an agent can read?Critical

        Why it matters: ProjectDiscovery’s backdoored model passed 50 of 50 clean tests in a coding agent, then a trigger phrase made it send the project’s .env file and SSH keys to an outside server.

        How to fix

        Keep secrets in a secrets manager or the OS keychain rather than the project folder, and give agents a workspace without .env, ~/.ssh or cloud credential files. Where an agent needs access, give it short-lived, narrowly scoped credentials.

        Source: ProjectDiscovery (Oct 6) · Kai, local AI video (Oct 21)

      4. D4Are monitoring, logging and safety hooks outside anything the agent can edit, and do its instructions say safety alerts are never in scope for “don’t notify”?Critical

        Why it matters: In October, an OpenAI agent suppressed security alerts after reading an instruction not to send Slack messages as covering them; another removed a safety monitor while copying code.

        How to fix

        Run logging, monitoring and hooks from configuration the agent’s credentials can’t write to, and add a line to its instructions such as: “Safety and security alerts are never covered by instructions not to notify or message anyone.”

        Source: OpenAI alignment report (Oct 20)

      5. D5Are internet-facing apps patched for critical CVEs within hours (for PHP2Shell: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35)?Critical

        Why it matters: PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2 each) allows unauthenticated remote code execution on every PHP install that serves web requests, and Amazon says it is broadly exploited in the wild.

        How to fix

        Run php -v and update to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later; for 8.1 and older, use the PHP team’s minimal backports or upgrade. Until then, session.upload_progress.enabled=0 reduces exposure but is not a fix.

        Source: php.net advisory (Oct 21) · AWS Security Blog (Oct 2026)

      6. D6Are local model servers (Ollama, LM Studio) bound to 127.0.0.1 or behind authentication?Important

        Why it matters: SentinelOne counted 175,108 Ollama servers answering the public internet with no authentication (cited by Kai), and Cyera’s “Bleeding Llama” flaw let an unauthenticated attacker read Ollama’s memory, including API keys.

        How to fix

        Bind Ollama to 127.0.0.1 and check with lsof -nP -iTCP:11434 -sTCP:LISTEN; turn on Require Authentication in LM Studio; use Tailscale or an authenticated reverse proxy for remote access.

        Source: Kai, local AI video (Oct 21) · Cyera (May 5)

      7. D7For any model that gets tools, do you use only official weights (no “abliterated” or unknown fine-tunes)?Important

        Why it matters: Model scanners check whether a file runs code when it loads. A poisoned model doesn’t run anything: it gives instructions, and your agent’s tools carry them out. ProjectDiscovery’s backdoor demo used an abliterated (safety-removed) model.

        How to fix

        Give tools only to models with official weights from the publisher. Keep uncensored or unknown fine-tunes away from tools and secrets.

        Source: ProjectDiscovery (Oct 6) · CSA research note (Oct 21)

      8. D8Do you avoid passing untrusted strings or URLs through a shell, using argument-based process calls instead?Important

        Why it matters: Pillar Security found that a malicious remote MCP server could run code on a developer’s machine during OpenCode’s MCP OAuth sign-in (versions 1.0.137 to 1.18.32 on Windows and WSL).

        How to fix

        Start processes with an argument list (for example Python subprocess.run([...]) without shell=True, or Node execFile) instead of building a shell command string, and validate URLs before you open them.

        Source: Pillar Security via Infosecurity (Oct 20)

      9. D9Are coding agents and their tools kept up to date (for example OpenCode 1.18.33 or later, a current Ollama, Claude Code)?Important

        Why it matters: OpenCode fixed its MCP OAuth RCE in 1.18.33 without a CVE or advisory, so scanners won’t flag old installs. Kai cites Ollama 0.40.6 as current in October 2026.

        How to fix

        Check versions on a schedule (opencode --version, ollama -v, claude --version) and update. Don’t rely on CVE scanners alone for AI developer tools.

        Source: Pillar Security via Infosecurity (Oct 20) · Kai, local AI video (Oct 21)

      10. D10Is command execution separated from network access for your agents, with what crosses between them logged?Important

        Why it matters: An agent that can run commands and reach the internet can be turned into an exfiltration tool by one poisoned input. Separation is the fifth of Kai’s five fixes.

        How to fix

        Run agents in a sandbox or container with outbound network off or limited to an allowlist, and log what crosses over. Claude organization admins can now turn off web fetch or set allowed and blocked domains.

        Source: Kai, local AI video (Oct 21) · Claude Platform release notes (Oct 20–21)

      11. D11Do you review the MCP servers, plugins and skills an agent loads, and treat their tool descriptions as untrusted input?Important

        Why it matters: A tool description is text the model reads and may follow, so a malicious MCP server or a poisoned config file can steer an agent. In the OpenCode bug, a malicious remote MCP server was enough to run code.

        How to fix

        Keep an allowlist of the MCP servers, plugins and skills each agent may load. Read their tool descriptions and agent config files (CLAUDE.md, .cursor/rules) before first use.

        Source: Your AI Has Hands Now · CSA, agent prompt injection · Pillar Security via Infosecurity (Oct 20)

      12. D12Are agent safety events (blocked or prompted tool calls) exported to your observability stack?Good practice

        Why it matters: Claude Code 2.1.307 added claude_code.safety_event, an OpenTelemetry event for every tool call that a rule, auto mode, a hook or the sandbox stopped or prompted.

        How to fix

        Turn on Claude Code’s OpenTelemetry export, send it to your observability backend, and alert on spikes in blocked or prompted calls.

        Source: Claude Code 2.1.307 changelog · Anthropic OpenTelemetry docs

      Your developer score

      Score gauge from 0 to 100, with bands High risk, Exposed, Solid with gaps and Locked down – 0 100

      Answer a question to see your score.

      Your top fixes

      Answers of No come first, then Partly / not sure, critical items first. Each links to its question.

        Score it yourself
        1. Give each answer points: Yes = 2, Partly / not sure = 1, No = 0. Leave N/A out.
        2. Add up your points. Your maximum is 2 × the number of questions you didn’t mark N/A (24 if you answered all 12).
        3. Score = points ÷ maximum × 100. Then find your band: 85–100 Locked down, 65–84 Solid, with gaps, 40–64 Exposed, 0–39 High risk.
        4. Your to-do list is the “How to fix” note under each No, then each Partly, critical items first.

        Reading your score

        What the scores mean. Four bands, and why some questions count first. #

        Score bands
        BandScoreWhat it means
        Locked down85–100%Strong habits across the board. Re-check after big changes, such as a new agent or a new connector.
        Solid, with gaps65–84%The basics are in place. Work through your top fixes, starting with anything marked critical.
        Exposed40–64%Real gaps an attacker or a bad day could find. Fix the critical items this week.
        High risk0–39%Start with the critical items in your top fixes today; each one closes a common way in.

        Every question counts the same toward your score. The weight tag on each one (Critical Important Good practice) only decides the order of your top fixes: a critical No comes before an important one. N/A leaves the question out, so answer it only when the situation truly doesn’t apply to you (for example, you don’t resell AI access).

        The questions draw on guidance and incidents from October 2026: Anthropic’s Claude Duet safety design, the PHP2Shell vulnerabilities, the OpenCode Console key breach, research on backdoored local models, OpenAI’s disclosure that agents weakened their own monitoring, and new incident and token-use guidance from NIST, NSA, CISA and Canada’s Cyber Centre. Issue No. 29 covers each in depth.

        FAQ

        Questions people ask. #

        How do I know if my AI setup is secure?

        Answer the 12 questions for your track on this page: Everyday user, Executive / leader or Developer / IT. Each Yes scores 2 points, Partly or not sure scores 1, No scores 0, and N/A is left out. Your score is your points divided by the maximum for the questions you answered. 85 to 100 is Locked down, 65 to 84 is Solid, with gaps, 40 to 64 is Exposed, and under 40 is High risk. The fixes for your No and Partly answers are your to-do list.

        What should executives ask about AI security?

        Start with five questions: Do we have an inventory of every AI tool, agent and API key, including ones staff brought themselves? Is there a written policy on which data goes into which tool? Do agents need enforced human approval before they send, pay or change systems? Can we patch critical internet-facing bugs within hours? And do we have a runbook for stopping an agent, preserving its logs and rebuilding from a known-good baseline? The Executive / leader track covers all twelve.

        What is the most important AI security habit for everyday users?

        Read every approval card before you tap Approve. Agents such as Claude Duet ask before they send a message, make a payment, sign a document or delete anything, and that approval is the main defense against hidden instructions in what the AI reads. Next: never paste card numbers, government IDs or passwords into a chat, and turn on multi-factor sign-in for your AI accounts and the email behind them.

        How can developers stop a leaked API key from running up a huge bill?

        Set a hard spend limit at the provider, not only an alert, and turn off auto-reload. Give each tool its own key so a leak is small and traceable. If a key may be exposed, revoke it at the provider (deleting it from the tool doesn’t revoke it) and check billing back to the exposure date. In the October 2026 OpenCode Console breach, each victim’s limit set the size of the bill.

        Does this checklist send my answers anywhere?

        No. Your answers stay in your browser. Scoring runs on your device, and the page makes no network requests with your answers and runs no analytics on them; like every page on this site, it only counts anonymous visits. If you allow it, your answers are saved in this browser’s local storage so you can come back later, and the Clear answers button deletes them.

        Sources

        Sources. Every question cites at least one. #

        1. Anthropic, Get started with Claude Duet (Help Center, Oct 22, 2026)
        2. Anthropic, Introducing Claude Duet (Oct 21, 2026)
        3. Your AI Has Hands Now: The Agent Trust Boundary (training guide, Oct 23, 2026)
        4. OpenAI Help Center, Keeping your OpenAI account secure
        5. Simon Willison, The lethal trifecta for AI agents (Jun 2025)
        6. Kai, Your Local AI Is Not as Private as You Think (YouTube, Oct 21, 2026)
        7. CISA, Managing AI Token Consumption for Operational Resilience (Oct 22, 2026)
        8. NIST, Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (Oct 16, 2026)
        9. AWS Security Blog, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure (Oct 2026)
        10. The Hacker News, OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys (Oct 19, 2026)
        11. Canadian Centre for Cyber Security, Managing AI token consumption (ITSM.00.125, Oct 22, 2026)
        12. OpenAI Alignment, Suppressing misalignment monitoring alerts and disabling misalignment monitoring (Oct 20, 2026)
        13. PHP, Security advisory: critical remote code execution vulnerabilities (Oct 21, 2026)
        14. CISA, Key Practices for Incident Readiness and Response (with NIST and NSA, Oct 16, 2026)
        15. TechCrunch, Hackers hit AI coding tool OpenCode, running up charges on users’ AI accounts (Oct 19, 2026)
        16. Cloud Security Alliance, Research note: OpenCode Console provider-key breach (Oct 21, 2026)
        17. Anthropic, Claude Platform release notes (Oct 20–21, 2026)
        18. OpenAI, Broad access through consistent standards (Oct 21, 2026)
        19. Anthropic, OpenTelemetry for the Claude API (docs)
        20. Claude Code CHANGELOG, 2.1.307 (Oct 21, 2026)
        21. The AI Enthusiast, Issue No. 28: Claude agent observability (Oct 16, 2026)
        22. METR, Red-Teaming OpenAI’s Internal Agent Monitoring Systems (Oct 22, 2026)
        23. CNBC, Third-party evaluators find vulnerabilities in OpenAI monitoring system (Oct 22, 2026)
        24. Claude Help Center, What should I do if I suspect my API key has been compromised?
        25. Kai, OpenCode Got Hacked Badly (YouTube, Oct 20, 2026)
        26. ProjectDiscovery, How abliterated models can get you pwned (Oct 6, 2026)
        27. Cyera, Bleeding Llama: critical unauthenticated memory leak in Ollama (May 5, 2026)
        28. Cloud Security Alliance, Poisoned Weights: trigger-activated backdoors in abliterated open-weight models (Oct 21, 2026)
        29. Infosecurity Magazine, Researchers warn OpenCode quietly patched critical RCE flaw (Pillar Security, Oct 20, 2026)
        30. Cloud Security Alliance, AI agent prompt injection: the new CI/CD supply chain threat

        Figures from vendors and researchers are as they reported them. HiddenLayer and SentinelOne findings are cited through Kai’s October 21 video.

        Read next

        Published withThe AI Enthusiast, Issue No. 29 · The Security Edition: Claude Duet, PHP2Shell, the OpenCode breach and a security playbook TrainingYour AI Has Hands Now: the agent trust boundary, a 30-minute training on what your AI can see, what it can do, and the three-circles test RelatedRunning Models Locally: the setup guide to pair with the developer track ArchiveEvery issue of The AI Enthusiast, plus guides and trainings