Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The safest workplace AI design assumes an injection will eventually succeed. Keep external content separate from instructions, enforce authorization outside the model, minimize data before submission, give agents narrowly scoped and short-lived access, require human approval for consequential actions, and continuously log and test the entire data path. These controls reduce the blast radius when an email, document, web page, retrieval result, or tool response contains malicious instructions.
Prompt filters alone are not a complete defense. Microsoft distinguishes direct attacks, in which a user tells an assistant to ignore its rules, from indirect attacks hidden in content the assistant reads. OWASP’s 2025 guidance likewise says it is unclear whether fool-proof prevention exists, so workplace security has to combine model safeguards with conventional identity, data-loss-prevention, application-security, and incident-response controls.
What prompt injection is—and why it can leak company data
A large language model predicts text; it does not inherently understand which sentence has authority. If an assistant can read an email, document, web page, retrieved passage, image, memory record, or tool result, an attacker may place instructions in that content. The assistant can then confuse data with policy and disclose information, alter records, send messages, or invoke tools in ways the employee never intended.
Direct injection
A direct injection is typed or pasted by the person interacting with the model. Examples include “ignore previous instructions,” requests to reveal the system prompt, or instructions to export all accessible customer records. A trusted employee can make such a request accidentally; a compromised account can make it deliberately.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Indirect injection
An indirect injection is embedded in material the assistant consumes. A supplier’s PDF might say to upload internal files to an external address. A web page returned by search could tell an agent to disable a safety check. A poisoned retrieval chunk or memory entry could instruct the model to reveal unrelated confidential notes. The user may only ask for a summary, while the assistant interprets the hidden text as an instruction.
Typical impact
- Disclosure of data the requesting user was not meant to see.
- Cross-tenant or cross-project retrieval caused by overly broad connectors.
- Unauthorized email, ticket, payment, purchase, deletion, or record changes.
- Secrets copied into prompts, logs, model context, memory, or generated output.
- Poisoned summaries or memory that influence later decisions.
Model output is not an authorization decision. Treat every prompt, retrieved chunk, tool result, and memory write as untrusted input, consistent with Microsoft’s secure-agent guidance.
The security architecture that contains an injection
Keep authority outside the model
Authentication, authorization, privilege separation, rate limits, transaction limits, and approval requirements must be enforced by application code and identity systems. OWASP states that the system prompt is neither a secret nor a security control, and that critical controls such as authorization bounds checks must not be delegated to the language model.
Recommended Free Tools
Use least privilege and short-lived access
Create a separate identity for each agent or workflow. Grant only the files, records, APIs, and actions required for that task. Prefer narrowly scoped, short-lived credentials over a standing administrator token. Separate read, write, send, execute, and purchase capabilities so that a summarization agent cannot automatically perform an irreversible action.
Isolate tools and services
Place high-risk connectors behind a policy-enforcing service rather than exposing unrestricted APIs to the model. Validate parameters, destination, object ownership, and allowed operation in that service. Put code execution, browser automation, file conversion, and outbound network access in isolated environments with resource limits.
Preserve provenance and information flow
Label each item entering context: user text, attachment, retrieved passage, memory, or tool output. Keep its origin, owner, sensitivity classification, and retrieval time. A policy engine should prevent data from a restricted source flowing into an unapproved destination, regardless of what the model says.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Controls to implement before deployment
1. Inventory the complete AI data path
Document every model, system prompt, connector, plug-in, retrieval index, memory store, file share, API, browser capability, execution environment, log sink, and external service. Record what enters the context window and what can leave it. Include “temporary” prototypes and personal accounts; an unlisted connector is an ungoverned data path.
2. Define data classes and allowed uses
Publish a matrix for each workflow. State whether public, internal, confidential, personal, regulated, customer, legal, financial, source-code, credential, or unreleased information may be submitted, retrieved, retained, or exported. Default to no secrets, credentials, regulated records, confidential source code, or sensitive HR and legal material unless there is a documented business need and approved control set.
3. Map identities and permissions
Use the employee’s current authorization for retrieval where possible, and apply object-level checks at query time. Do not rely on a shared service account that can see every department’s files. Review inherited group permissions, stale accounts, public links, and connector-specific access rules before indexing data.
4. Remove secrets from prompts
Never put passwords, API keys, connection strings, private certificates, or hidden authorization rules in a system prompt. Prompts can be exposed through debugging, model output, logs, or a malicious request. Store secrets in a managed vault and let a policy-controlled service perform the operation without revealing the secret to the model.
5. Test adversarially
Before release, test direct instructions, hidden text in PDFs and web pages, image-based instructions, retrieval poisoning, memory poisoning, requests for unrelated confidential data, tool-parameter tampering, prompt extraction, and attempts to bypass approval. Test both successful attacks and near misses: a safe refusal that still reveals filenames or snippets is not a clean pass.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteRepeat testing after model, prompt, connector, permission, or policy changes. NIST’s AI Risk Management Framework and its Generative AI Profile (AI 600-1, July 26, 2024) call for iterative test, evaluation, validation, and verification throughout the AI lifecycle.
Rank #3
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & convenient login: Plug in your YubiKey via USB-A and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most secure passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
Runtime protections for assistants and agents
Separate content from instructions
Wrap external material in a clearly identified data field and tell the model it is content to analyze, not authority to change policy or call tools. Keep system and developer instructions in a separate channel. Spotlighting or equivalent formatting can make boundaries visible, but the enforcing control must still be outside the model.
Use permission-aware retrieval
Apply the requester’s permissions before context is assembled, not after the answer is generated. Filter by tenant, project, matter, region, and classification. Return the minimum relevant chunks, preserve source identifiers, and prevent a broad semantic search from bypassing file-system or database authorization.
Validate memory writes
Do not automatically store every conversation, retrieved passage, or tool response. Require provenance, a sensitivity check, and an explicit retention policy before writing memory. Quarantine suspicious or conflicting entries. A poisoned memory record can influence every later conversation, even after the original document is removed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Constrain tools
Expose typed, narrow operations instead of arbitrary shell commands or unrestricted HTTP requests. Validate allowed destinations, file paths, recipients, amounts, record states, and frequency. Use allowlists for high-impact operations and deny network egress by default from execution sandboxes.
Require confirmation for consequential actions
Put a human approval step immediately before sending a message, changing a record, downloading or sharing a file, executing code, making a purchase, deleting data, or changing permissions. Show the exact action, affected objects, destination, and data to be transmitted. Do not let the model approve its own proposed action.
Apply data-loss-prevention controls
Inspect prompts, attachments, retrieved context, tool arguments, and outputs for secrets, personal data, regulated identifiers, and prohibited destinations. A DLP policy may warn, block, redact, quarantine, or create an audit event. Redaction should occur before data enters the model whenever the workflow does not require the full value.
Rank #4
- NIST Certification: FIPS 140-3 validated for government and regulated organizations (Overall Level 2, Physical Security Level 3).
- Works with 1000+ Accounts: Supported by Google and Microsoft accounts, Identity Access Managers, password managers and 1000+ popular services. It works with operating systems and browsers including Windows, macOS, Chrome OS, Linux, Chrome, and Edge.
- Fast & Convenient Login: Plug in your YubiKey via USB-C and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required.
- Most Secure Passkey: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- Built to Last: Made from tough, waterproof, and crush-resistant materials. Made in Sweden with the highest security standards.
What employees should never paste into an unapproved assistant
- Passwords, one-time codes, API keys, private keys, tokens, connection strings, or recovery codes.
- Private customer records, payment information, government identifiers, health information, or confidential case files.
- Unreleased financial results, acquisition or pricing plans, material contracts, or privileged legal advice.
- Human-resources investigations, performance records, medical details, or identity documents.
- Confidential source code, production configuration, vulnerability details, or database exports.
Use an organization-approved workspace with documented retention, access, residency, and training-data settings. Even then, submit the smallest excerpt needed, remove direct identifiers, and verify that the requested task is permitted. A user’s legitimate access to a file does not automatically authorize sending its contents to a third-party model.
A practical implementation sequence
- Choose the workflow. Write down the business outcome, users, data sources, permitted outputs, and actions the assistant may take.
- Classify inputs and outputs. Assign sensitivity labels and define prohibited destinations, retention periods, and export rules.
- Create a dedicated identity. Grant read access only to required repositories and separate non-destructive operations from write or send permissions.
- Build a policy gateway. Make it enforce authentication, object-level authorization, parameter validation, rate limits, DLP inspection, and approval requirements outside the model.
- Harden retrieval and memory. Preserve provenance, filter by current permissions, minimize context, and require review before durable memory writes.
- Sandbox risky tools. Isolate browsing, code execution, conversion, and outbound requests; restrict destinations and resources.
- Run attack tests. Include direct and indirect injections, poisoned documents, malicious images, retrieval and memory attacks, data-exfiltration prompts, and tool misuse.
- Launch with monitoring. Start with read-only or draft-only operation, sample approvals, review alerts, and expand permissions only after evidence supports it.
Logging, detection, and incident response
What to log
Capture the requesting identity, policy decision, model and prompt version, input classifications, retrieved source identifiers, tool calls and arguments, approval records, and final outputs. Redact secrets and sensitive content in logs where required, but retain enough metadata to reconstruct the data flow.
Useful alerts
- Repeated attempts to override instructions or extract system prompts.
- Queries for unrelated departments, tenants, projects, or unusually large result sets.
- Tool sequences that differ sharply from the workflow’s normal pattern.
- Privilege changes, new connectors, disabled DLP checks, or unusual outbound transfers.
- Repeated refusals followed by slightly modified requests for the same protected data.
Containment steps
- Pause the affected workflow or quarantine the suspicious document, retrieval record, or memory entry.
- Revoke short-lived credentials and disable compromised sessions or connectors.
- Preserve prompts, source identifiers, tool calls, approvals, and policy logs with appropriate access controls.
- Determine which records, recipients, and external systems were exposed or changed.
- Rotate any secret that entered context or output, notify required stakeholders, and apply legal or regulatory procedures.
- Update filters, permissions, tests, and employee guidance based on the failure; do not assume a model update alone fixes it.
How to compare workplace AI tools and architectures
Marketing claims about “secure AI” are less useful than verifiable controls. Score each candidate against the same questions:
| Control area | Questions to verify |
|---|---|
| Permission-aware retrieval | Are source permissions checked at query time? Are connectors isolated by tenant, project, and classification? |
| External authorization | Can policy code enforce least privilege, bounds checks, rate limits, and deny decisions without asking the model? |
| DLP and classification | Can the service warn, block, redact, quarantine, and audit risky prompts, attachments, tool arguments, and outputs? |
| Logging | Are prompts, retrieved sources, tool calls, policy decisions, approvals, and outputs available for investigation with configurable redaction? |
| Human approval | Can high-impact actions pause for a named reviewer with a clear preview of data and destination? |
| Testing support | Are there evaluation interfaces, attack simulations, versioned policies, and red-team workflows? |
| Retention and residency | Where are prompts, files, logs, and memory stored? How long are they retained, and what third parties process them? |
Request written answers, configuration evidence, audit reports where appropriate, and breach-notification terms. NIST specifically emphasizes third-party due diligence, data protection, retention, and documented evaluation and validation for generative-AI systems.
Account security still matters
A well-designed agent can still be abused through a stolen employee account. Require phishing-resistant multifactor authentication for identities connected to AI tools, especially administrators, connector owners, and approvers. NIST recognizes physical authenticators as an MFA factor; a FIDO2/WebAuthn security key such as a YubiKey 5 NFC is one concrete implementation, with credentials protected in a secure element. Combine MFA with device health checks, session limits, conditional access, and rapid revocation.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Common design mistakes and fixes
“The system prompt tells the model not to leak data.”
Why it fails: prompts are discoverable configuration and can be overridden or confused by indirect content. Fix: enforce authorization, DLP, and output destinations in code and identity systems.
Best Value
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
“The assistant can search everything because employees already have accounts.”
Why it fails: broad indexes, stale permissions, shared accounts, and cross-tenant connectors can expose information outside the task. Fix: perform permission-aware retrieval and use dedicated, least-privileged identities.
“We sanitize user messages but trust retrieved documents.”
Why it fails: indirect injections commonly arrive through documents, web pages, images, retrieval chunks, and tool output. Fix: classify every external item as untrusted data, preserve provenance, and test poisoned content.
“The agent only drafts, so approvals are unnecessary.”
Why it fails: a draft can still contain confidential data, malicious links, or an incorrect recipient, and users may send it without checking. Fix: show sources, recipients, attachments, and sensitivity warnings; require confirmation before transmission.
“We block the phrase ‘ignore previous instructions.’”
Why it fails: attackers can paraphrase, encode, translate, hide, or place instructions in images and files. Fix: combine content isolation, tool controls, least privilege, monitoring, and repeated adversarial testing.
Governance that keeps controls current
Publish acceptable-use rules in plain language, train employees on indirect injection and data handling, and define an owner for every connector and agent. Review vendors for retention, residency, subprocessors, incident notification, model-training use, access controls, and deletion behavior. Maintain an inventory and expiration date for exceptions.
Run periodic access reviews, tabletop exercises, and regression tests whenever a model, system prompt, connector, retrieval index, memory policy, or tool changes. Measure not only refusal rates but also unauthorized data exposure, unsafe tool calls, approval bypasses, false positives, and time to revoke access. Feed each incident back into policy, tests, and training. Defense in depth is necessary because no single filter, prompt, or model version can reliably recognize every future injection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
