Topic
AI Safety & Data Privacy
Privacy, data hygiene, security failure modes, governance, and safe AI connections.
24 stories (13 articles · 11 videos)
Start here
A few good first pieces before you browse the full feed.
6 min readArticle
Privacy 101: what ChatGPT remembers, sees, and shares
An honest look at what AI assistants actually do with your data — what is stored, what is used for training, what the privacy settings really mean, and the three changes worth making today.
Decide what work data is safe to share with AI tools and what requires stricter controls.
New to AI
8 min readArticle
Privacy and data hygiene when using AI at work
A practical guide to using AI at work without accidentally exposing customer data, breaching your company's policy, or violating GDPR. The lines, the tools, and the habits to build.
Apply practical workplace rules for sensitive data, tool choice, retention, and review before using AI.
Beginner
14 min readArticle
Prompt injection and LLM security: threat models and defense-in-depth
Prompt injection is a permanent LLM security class, not a prompt-writing mistake. A production guide to threat models, data boundaries, tool permissions, regression tests, monitoring, and incident response.
Threat-model an LLM workflow and add concrete controls for untrusted content, retrieval, tool calls, authorization, monitoring, and incident response.
Advanced
More in this topic
7 minutesVideo
Unlock Better RAG & AI Agents with Docling
IBM Technology. Explains the ingestion side of RAG and agents: preparing PDFs and other files so document structure, tables and layout survive into downstream retrieval. That supports the article's warning that RAG quality and safety begin before embedding, especially when parsing complex business documents.
Advanced
20 minutesVideo
Permissions & Access Control for RAG - a Deep Dive Tutorial
Paragon. Walks through the production RAG permission problem and compares tool-calling, namespaces, ACL tables and relationship-based permissions. That directly supports the article's core rule: retrieval must only return sources the current user is allowed to see, and source-system permissions cannot be treated as an afterthought.
Advanced
48 minutesVideo
How to Build Reliable AI Agents (Context + Evals Explained) | Tobias Leong, Axium
Arize AI. Explains why production agents fail when the system lacks the right context, evaluation data, tracing and domain expertise. It maps well to the article's failure-mode register because it makes reliability an engineering loop: separate retrieval from reasoning, define expected outcomes, evaluate tool calls, and trace failures before changing models.
Advanced
33 minutesVideo
The AI Engineer's Guide to Surviving the EU AI Act
GOTO Conferences. Connects the EU AI Act to data quality, MLOps, documentation and post-deployment monitoring. That makes it a good companion for the article's SME governance baseline: the work starts with knowing the system, data, owner, purpose and controls, not with buying a compliance platform.
Advanced
11 min readArticle
Secure document ingestion for RAG: PDFs, OCR, metadata, and retention
RAG quality starts before retrieval. A secure ingestion guide for PDFs, OCR, metadata, permissions, source freshness, deletion, malware risk, and operational ownership.
Design a secure document-ingestion pipeline for RAG with permission metadata, OCR quality checks, source freshness, retention rules, deletion behavior, and ingestion tests.
Advanced
9 min readArticle
AI ROI and maturity: how to measure adoption that actually works
AI adoption should not be measured by how many people tried ChatGPT. A practical framework for measuring workflow ROI, quality, risk, maturity, and scale-readiness.
Measure AI adoption using workflow ROI, quality, risk controls, and maturity levels instead of tool usage vanity metrics.
Advanced
10 min readArticle
Company knowledge RAG: permissions, leakage, and source boundaries
A company knowledge assistant is only safe if retrieval respects permissions. How to design RAG source boundaries, ACL filtering, document ownership, logging, stale-source handling, and refusal behavior.
Design a company knowledge RAG with permission-aware retrieval, source ownership, leakage controls, and refusal behavior.
Advanced
10 min readArticle
Production AI failure modes: what breaks after the demo
AI systems usually fail in predictable ways: hallucination, stale context, sycophancy, prompt injection, unsafe tool use, schema drift, and weak fallbacks. A production failure-mode register for teams shipping real workflows.
Build a production AI failure-mode register with controls for hallucination, stale context, prompt injection, unsafe tool use, and weak fallbacks.
Advanced
9 min readArticle
Human-in-the-loop design patterns for AI workflows
Human review is not a vague safety blanket. A practical guide to deciding what humans approve, sample, audit, escalate, or never delegate in AI workflows.
Choose the right human review pattern for an AI workflow and define approval, sampling, audit, escalation, and stop rules before launch.
Intermediate
10 min readArticle
Private AI deployment patterns: local, VPC, self-hosted, and hybrid
Private AI is not one architecture. A practical comparison of local models, enterprise SaaS, VPC deployments, self-hosted inference, and hybrid patterns for SMEs that care about privacy and control.
Choose a private AI deployment pattern based on data sensitivity, capability needs, cost, latency, and operational capacity.
Advanced
9 min readArticle
EU AI Act for SMEs: a practical governance plan
The EU AI Act is not just a legal problem for large vendors. A practical SME plan for inventory, risk classification, human oversight, transparency, vendor records, and rollout discipline.
Create a practical AI governance baseline for an SME using AI tools, automations, or customer-facing systems in the EU.
Advanced
10 min readArticle
Local AI on your Mac: Ollama, LM Studio, and what 7B models can really do
Running AI locally has matured. With Ollama or LM Studio and a modern Mac, you can run capable models offline, free, and private. What works, what doesn't, and the use cases that actually benefit.
Evaluate the implementation pattern, failure modes, and guardrails before building.
Intermediate
10 min readArticle
Connecting AI to your email, calendar, and CRM safely
Connecting AI to your real tools — email, calendar, CRM — is the productivity unlock and the risk. A practical guide to the integrations that work in 2026, the patterns that are safe, and the lines you should not cross.
Connect AI to email, calendars, and CRMs with least privilege, approval gates, and audit trails.
Intermediate
6 min readArticle
Sharing images with AI: what you can (and shouldn't) upload
Modern AI can read photos, charts, screenshots, and handwriting almost as easily as text. A practical guide to what works, what doesn't, and the thirty-second privacy checklist before you upload anything.
Understand the idea well enough to try it safely in a low-risk setting.
New to AI
17 minutesVideo
Defending LLM - Prompt Injection
LiveOverflow. Walks through the actual defence-in-depth playbook — taint analysis on LLM output, restricting expected output shapes, user isolation, few-shot scaffolds, fine-tuning, temperature 0 for determinism, redundancy for critical paths. It matches the article's defence-stack section almost item for item.
Advanced
13 minutesVideo
Attacking LLM - Prompt Injection
LiveOverflow. Frames prompt injection as a classic injection attack against systems that mix instructions and untrusted data — with a concrete content-moderation example where an attacker frames an innocent user. The mental shift from "the model is the target" to "the application is the target" is exactly the move the article opens with.
Advanced
25 minutesVideo
OWASP's Top 10 Ways to Attack LLMs: AI Vulnerabilities Exposed
IBM Technology. Zooms out from prompt injection to the wider OWASP Top 10 for LLMs — insecure output handling, sensitive information disclosure, excessive agency — which is exactly the failure-mode catalogue you want in mind before you grant Gmail or HubSpot scopes to anything.
Intermediate
11 minutesVideo
What Is a Prompt Injection Attack?
IBM Technology. Jeff Crume's "buy an SUV for $1" example is the cleanest 10-minute explanation of why direct and indirect prompt injection are different problems, and why filtering can't fully solve either. It pairs directly with the article's argument that you need least-privilege scopes, a dedicated agent account, and a human in the loop on anything irreversible — not a cleverer system prompt.
Intermediate
11 minutesVideo
What is Shadow AI? The Dark Horse of Cybersecurity Threats
IBM Technology. Sits below our usual 100K bar but earns the slot because it's the single best short explanation of why an employee using a personal ChatGPT account on work problems is the actual risk most companies face. Crume's "don't say no, say how" framing is the same posture the article takes — you're not trying to ban AI, you're trying to make safe use the easy default.
Beginner
13 minutesVideo
How to Secure AI Business Models
IBM Technology. Jeff Crume's lightboard explainer of the three places generative AI introduces risk — the data, the model, and the usage — and what good controls look like for each. Useful for the article's argument that "be careful" isn't enough; you need to think about which category of risk you're actually exposed to as an employee.
Beginner
93 minutesVideo
Sam Altman | This Past Weekend w/ Theo Von #599
Theo Von. The section roughly twelve minutes in, where Altman admits there is no legal privilege for ChatGPT conversations and that OpenAI can be ordered to hand them over in a lawsuit, is the single most-quoted piece of footage on this topic — and worth hearing in his own voice rather than via a news clip. The rest of the conversation is wide-ranging, but that one exchange is the honest answer to the question the article asks: "what does the company actually do with what I type?"
New to AI