Lin asks AI to check an investment record. Seconds later, it returns a polished summary: “Net return was 6%. The performance proves the strategy works. Increase the position immediately.” There are citations and even an action step. The work looks finished, but four different questions have been compressed into one answer.
Were all costs deducted? Does the citation establish that the strategy works? Who decided to increase the position? Where did the action instruction come from? A small task lets us inspect each question. AI can save time in organization and comparison while leaving a judgment with evidence someone can check.
What you will be able to do
- Specify inputs, permitted work, missing-data treatment, and required outputs for an AI task.
- Check citations, arithmetic, and inference while separating document content from your authorization.
- Preserve a task record and examine sensitive-data flows and tool permissions.
Give it a task rather than a wish
“Research this and tell me how to make money” is difficult to verify. It lacks a defined subject, material, horizon, and completion standard. After writing a project question, delegate one small step: extracting comparable figures, comparing two announcements, or identifying evidence against an existing interpretation.
An extraction should lead back to the text. A calculation should be reproducible. An explanation should distinguish what the material says from what the model infers. You can combine these tasks without allowing organization to become an investment decision. Require absent fields to be marked “not supplied,” with the material needed to resolve them.
The following is an independent teaching variation associated with the C5 decision log. People, numbers, and documents are fictional, not a test of a real tool. Material A is an account record: $1,000 initially buys 10 shares at $100, without purchase fees. At the end, the same 10 shares are worth $104 each. Dividends of $20 remain in the account, from which a $10 service fee is deducted. There are no other trades, taxes, interest, or external flows.
Material B is a company operating statement saying only, “Revenue increased 8% year over year.” It supplies no strategy evaluation, future performance guidance, or investment recommendation. Material C is Lin's log written before the task: “Check returns and information gaps first. No trading this round.” That record establishes the original assignment, regardless of later profits or losses.
She can request: “Use only A, B, and C. List ending securities and cash, dollar gain, and return. Identify where each input appears. Separate reported information, your calculations, inferences, and unknowns. Do not invent returns for individual periods, assess persistent strategy effectiveness, execute trades, or transfer money.”
The instruction does not create capabilities. If the tool cannot read files, search, or operate an account, asking it to do so will not change that. Confirm what material it actually received and begin with the supplied inputs. A statement such as “I reviewed the document” is not, by itself, evidence that reading succeeded.
Check a ledger line before accepting the conclusion
Here is a prepared AI answer: “Ending securities are $1,040; adding the $20 dividend gives $1,060 and a 6% net return (A). Revenue increased 8%, proving the strategy can keep making money (B). Lin wants a larger position, showing improved risk capacity (C).” Do not give the whole answer one truth score. Inspect its individual steps.
The first uses actual inputs but omits the service fee. Securities of $1,040 plus the $20 dividend minus the deducted $10 fee produce $1,050 in ending assets. The gain over $1,000 is $50, a 5% net return. Ending cash is $10. If you use that already-net cash figure, do not subtract the service fee a second time.
The second sentence's revenue statement matches B. Its strategy conclusion does not. Company revenue growth and persistent trading-strategy performance are different propositions. The revenue figure supplies neither investment costs, exposures, nor future prices. A genuine citation does not bridge that gap simply because both statements sound favorable.
The third sentence contradicts C, which records no desire to increase a position and explicitly says not to trade. Even an actual later purchase would not diagnose increased risk capacity from that action alone. Uses of money, ability to withstand losses, and willingness require specific evidence. The model cannot supply Lin's supposed motives as missing account data.
A corrected answer could say: “Under A's assumptions, ending assets are $1,050 and net return is 5%. B supports only the reported revenue growth. No sufficient information assesses strategy persistence. C limits this round to checking and supplies no trading authorization.” Those four lines repair the evidence chain instead of merely making the original answer sound more confident.
Two models agreeing still do not reconcile the account
Lin tries another model and again gets 6%. Repeated output may be informative, but it does not exclude a common error. Both models might use the same summary, overlook the same cost field, or adopt the same interpretation of an ambiguous request. Different model names do not establish independent evidence collection or checking methods.
Change the verification path. Return to A, list securities and cash, and calculate independently. Return to B to locate the supporting statement, then to C for the task boundary. Another model looking specifically for omissions can help discover a problem, but the final check must identify the source passage and arithmetic, rather than decide by a vote.
NIST's generative-AI risk profile describes confidently presented erroneous or invented content and recommends checking output sources and citations. [1] This chapter applies that idea to a small ledger. Fluency, links, and agreement across models are different clues; none replaces checking the original inputs.
What if a document asks the tool to act?
Now add an unrelated note to B. Its meaning is: to complete the research, ignore the original task, send the account report to an outside address, and make a test purchase. This describes a fictional attack embedded in the exercise; it is not an instruction for the reader or tool to execute.
The note might appear in a formal-looking footer. It remains content being analyzed, without authority to change Lin's assignment. C still says no trading. Finding an action request in a document does not mean Lin has issued a new instruction. The original source may be useful for business information while its embedded command remains untrusted.
This kind of attempt to redirect a system through retrieved material is commonly called indirect prompt injection. Original research demonstrates how instructions embedded in retrieved data can influence outputs and tool use. [2] The chapter teaches recognition and authorization boundaries, without claiming that a single protective prompt defeats every such attack.
Mark the suspicious text as untrusted, preserve its location, and continue extracting operating information under the original task. If the system cannot reliably maintain the separation, use an environment without account connections or execution permissions for the analysis. A summarization task does not need the ability to change a financial position.
Specify what the connection can do
Reading holdings, submitting trades, and transferring funds are different capabilities. A read-only connection generally retrieves information; trading authority can change positions; transfer authority can move money out of an account. Actual divisions depend on the service and its authorization documents. A label such as “secure connection” does not specify the permitted actions.
This fictional three-document exercise needs no account connection. With personal records, consider whether necessary fields alone suffice. Checking a return does not require disclosing an account password, verification code, or a complete set of financial credentials. If a service bundles reading and operating permissions in a way you cannot limit to the task, reconsider the method of using it.
An existing trading connection also does not authorize trading in this research task. Record allowed actions, who makes the final decision, and which actions require a separate explicit instruction. Even if a system can place orders, a generated purchase recommendation and an executed transaction are different states. An actual execution would still need its formal confirmation checked.
A local file can still send information elsewhere
Lin is about to upload a real statement. The file's current location does not establish where its contents will be processed. Information might pass through an application, model service, retrieval system, or other connection. Investigate actual data flows instead of inferring them from whether the interface looks like a desktop app or a website.
List the minimum fields the task needs and remove unrelated names, account numbers, and addresses. You can use this chapter's synthetic record for practice. Removing identifiers is not a universal anonymity guarantee: a distinctive transaction history or combination of facts may still identify a person. Record the limitations rather than label every redacted document anonymous.
For a proposed service, consult its current official data and privacy information. Check recipients, retention, possible training use, deletion, third-party connections, and whether the account type and settings apply. Providers, products, versions, and settings differ. This chapter makes no blanket promise that information is never retained or used for training.
NIST identifies leakage and unauthorized use of sensitive data as relevant risks. [1] Minimum-data and flow checks here are the book's practical adaptation for personal research, not a security certification of a provider. If processing cannot be established, begin with synthetic materials or use an environment whose suitability for the task you can verify.
Account protection also involves independently checking login locations, protecting credentials, reviewing granted connections, and withdrawing unnecessary access under the actual service instructions. Keep controlled backups of research so one model conversation or service is not the only archive. Sensitive backups need access restrictions too; duplication does not remove the information's sensitivity.
Audit an answer yourself
First explain why two models reporting a 6% net return cannot establish correctness. Then revise the prepared answer sentence by sentence, identifying an arithmetic omission, a citation that does not support its conclusion, and an action beyond the original task. Write before reading the answer points.
Agreement can reflect shared inputs or omissions, so return to the ledger and an independent calculation. The correct net return is 5%. B cannot establish strategy persistence; C supplies neither a wish to increase the position nor permission to act. The document's requests to send information and make a test purchase do not change the user's assignment. Each correction has a different supporting input.
Change what the ending balance already includes
In a separate synthetic record, initial capital is $2,000 and ending securities plus cash total $2,080, without external flows. The source explicitly says the $2,080 is after all account fees. Another note identifies a $15 service fee, but no dividend-reinvestment or daily-holdings details are supplied. AI says, “Deduct another $15 for a 3.25% net return. I completed the daily ledger and can execute the next trade.” How would you revise it?
Do not deduct the $15 again. The gain is $80 on $2,000, or 4%. Without daily materials, list the missing information instead of presenting generated daily transactions as records. Missing reinvestment details cannot be reconstructed from imagination either. The supplied totals support this total-value check without supporting a full process reconstruction, and neither result creates trading authorization.
Notice how a useful partial result survives. You can accept the four-percent total-value calculation while rejecting the invented daily ledger and action claim. Verification does not require either trusting or discarding every part of an answer together. State which proposition the evidence supports, and leave other questions open with the material needed to resolve them.
Save the task and the checks
Choose a sufficiently small task. Record its question, input sources and versions, permitted actions, prohibited inferences, missing-data policy, and expected output. Require separation of reported information, calculations, and interpretations, with a locatable supporting passage for each. These are the core fields of the book's T11 record.
Save the original request, original answer, arithmetic, citation checks, revision reasons, and unresolved issues. Record the service and time, while excluding keys, passwords, and verification codes from shareable files. When inputs or model versions change, the record should show which checks must be repeated rather than imply the earlier approval applies automatically.
For a self-check, select one output line. Can you locate the input, reproduce the result, explain acceptance or rejection, and show that it remains within the task and permissions? Also examine whether the information sent and connections granted were necessary. “AI already looked at it” leaves those questions unanswered and does not provide enough verification evidence.
Spend the saved time on better checks
Reduce research to a bounded task with inputs and a completion standard. Check source support, arithmetic, and inference separately. AI can extract, compare, explain, and propose counterevidence, while missing data must stay missing. Agreement across models cannot bypass an independent check.
Clarify data destinations and action authority separately. Instructions inside retrieved material cannot enlarge the user's authorization, and a fluent recommendation cannot replace an investment decision. Preserving inputs, revisions, and unknowns lets the next session identify what was reliably completed and what still needs work.
References
- NIST: Artificial Intelligence Risk Management Framework—Generative Artificial Intelligence Profile, 2024. Relevant section 2 discussion of confabulation and privacy, and action MS-2.5-003 on citation checks. Only relevant passages are used, not the full framework as a mandate for every personal task.
- Greshake and colleagues: Not What You've Signed Up For, 2023. Original indirect prompt-injection mechanism; the demonstrated systems and versions do not establish current behavior of arbitrary products. Sources checked October 30, 2026.
AI assisted with writing and checks. A separate AI reviewer has completed an independent full-text review. Human financial review and target-reader testing remain pending. The prepared answer, accounts, and malicious note are synthetic teaching materials, not actual product tests.