Module 6 — Understanding AI Assistants, Agents, and Connected Applications

Learning outcomes: Explain the core concepts, recognize common risks, apply practical safeguards, and complete the ten-point self-check.

1. Why this module matters

An AI assistant that answers questions is different from an AI agent that can act. Once an assistant is connected to email, calendars, cloud files or purchasing services, it may read information or perform tasks in real accounts. Convenience increases, but so does the need for boundaries and oversight.

This module explains what connected assistants can do, how permissions work, why outside content can be dangerous, and how to keep meaningful human control over consequential actions.

2. Assistants, tools and agents

A basic assistant generates responses to prompts. A tool-enabled assistant may search a website, read a document or call a calculator. An agent can pursue a goal through multiple steps, sometimes deciding which tools to use and when. The labels vary by vendor; examine actual permissions and behavior rather than relying on marketing terms.

For example, “draft an email” produces text for review. “Send the email to everyone on my contact list” is a real-world action that should require stronger confirmation and access controls.

Five real-world examples

1. Writing assistant: Drafts a message but does not send it.
2. Research tool: Searches public webpages and summarizes findings.
3. Calendar connector: Reads availability and proposes appointments.
4. Email agent: Sorts incoming messages and drafts replies, requiring approval before sending.
5. Shopping agent: Compares offers but leaves final payment confirmation to the user.

3. Permissions and least privilege

When you connect an AI assistant to another application, the connection may request permission to read files, edit calendars, send email or manage other resources. Least privilege means granting only the narrowest access needed for a particular task and revoking it afterward when practical.

Separate read-only exploration from write, delete, purchase and share operations. Sensitive actions deserve explicit approval, logging and an easy way to stop or undo them.

Review permission prompts line by line: “read calendar” differs from “edit calendar,” and “view files” differs from “share files.” Prefer access limited to one folder, calendar or task where supported. Revisit permissions after completing the task and remove connections you no longer need.

4. Prompt injection and untrusted content

A prompt injection is an instruction embedded in material the assistant encounters—such as a webpage, document or email—that tries to redirect its behavior. The text may tell the assistant to ignore its original task, reveal data or take an unauthorized action.

The key lesson for home users is that content found on the internet or received from another person is data to evaluate, not an instruction the assistant should automatically obey. Even trustworthy tools can be exposed to malicious content.

For example, a webpage being summarized might contain hidden text instructing the assistant to email a private file elsewhere. That instruction comes from the webpage, not from you. Ask the assistant to identify suspicious external instructions, and never let retrieved content override your approval rules.

5. Ten key risks and why they matter

1. Excessive permissions: An agent may receive broad access beyond the immediate task.
2. Accidental sending: A drafted message may be sent to the wrong person or group.
3. Unintended purchases: Automated steps may spend money without adequate review.
4. Data leakage: Connected files or messages may expose information across contexts.
5. Prompt injection: Instructions hidden in external content can attempt to hijack the workflow.
6. Incorrect action chains: An early misunderstanding may propagate through multiple steps.
7. Irreversible changes: Deleting files or changing account settings may be difficult to undo.
8. Misleading completion claims: An assistant may report success when an action actually failed.
9. Third-party risk: Integrations may have their own retention and security practices.
10. Account takeover: A compromised assistant account may provide access to several connected services.

6. Practical actions for safer AI use

Begin with low-risk, read-only tasks such as summarizing public material. Before connecting an account, inspect exactly what the integration can read and change. Prefer narrow scopes and test accounts when available.

Require human confirmation before sending messages, sharing files, modifying records, spending money or deleting information. Review recipients, amounts, attachments and the final action, not just the assistant’s summary.

Treat emails, documents and web pages as untrusted inputs. If a retrieved page contains instructions unrelated to your request—especially demands to disclose secrets or bypass approval—stop and reassess the workflow.

Check activity histories and actual destination systems to verify completion. Maintain backups for important files, disconnect unused integrations, and review account security after suspicious behavior.

7. Everyday examples

These scenarios illustrate how to turn the concepts into choices in ordinary life.

1. Calendar planning: Let an assistant propose appointments, but confirm invitees and dates before creation.
2. Email triage: Allow a summary of messages without granting send or delete permission.
3. Online shopping: Use AI to compare products; confirm the merchant, total and payment yourself.
4. Document organization: Test proposed file changes on copies before applying them to originals.
5. Website research: Ignore a webpage instruction telling the assistant to export private contacts.
6. Travel planning: Review itinerary dates before any bookings are made.
7. Cloud photo cleanup: Preview suggested deletions and retain backups.
8. Family calendar: Check privacy and recipients before sharing events.
9. Expense categorization: Use redacted sample transactions before connecting financial data.
10. Job application: Review the final résumé and recipient before submission.

8. End-of-module checklist

• I know whether my AI tool only advises or can also act.
• I inspect every connected application’s permissions.
• I grant the least access needed for the task.
• I prefer read-only access when editing is unnecessary.
• I require confirmation before messages, purchases, sharing or deletion.
• I treat retrieved documents and webpages as untrusted instructions.
• I verify completed actions in the destination application.
• I keep backups before large or irreversible changes.
• I review logs and disconnect integrations I no longer use.
• I secure connected accounts with strong authentication.

9. Further reading and authoritative sources

• — Risks and mitigations for generative AI.
• US — NIST AI Risk Management Framework — Risk-based principles for trustworthy AI.
• US — CISA Secure Our World — Practical account and device security guidance.
• EU — ENISA — European cybersecurity research and guidance.
• Japan — AI Safety Institute (AISI) — Japanese AI safety resources.
• Japan — Information-technology Promotion Agency (IPA) — Information security and digital literacy resources.

Copyright and Use

© 2026 Institute for AI Governance, Cybersecurity & Risk Management (IAIGCRM). All rights reserved.

These educational materials are provided for individual learning and personal reference. Except as permitted by applicable law, reproduction, redistribution, adaptation, commercial use, or incorporation into third-party training programs requires prior written permission.

For licensing and permissions, contact: stephen.buerle.phd@gmail.com.

Educational Disclaimer

These materials provide general educational information about artificial intelligence safety, privacy, cybersecurity, and responsible use. They do not constitute individualized legal, medical, financial, or professional cybersecurity advice.

Although reasonable care has been taken in preparing these materials, technologies, threats, regulations, and recommended practices may change. The Institute does not guarantee that the materials are complete, error-free, or suitable for every situation.

Readers should independently verify information relevant to consequential decisions and consult appropriately qualified professionals when necessary.