Safe Use of Agentic AI Tools

IWhat’s different about agentic AI

Unlike chat tools, agentic AI reads files, runs commands, and acts on your behalf — often in sequences you don’t individually approve. You set the boundary up front (what folder, what permissions, what connectors), not in the moment. Think carefully about that setup before each session. For background on the distinction, see the companion Understanding Agentic AI document.

IIAccount setup

1. Match the account to the data. For regular work with public or Low Risk material, I recommend a paid professional plan for its stronger models and higher usage limits. But price is not a data approval: training, retention, and privacy settings vary by vendor and plan. Penn Moderate or High Risk data belongs only in a Penn-reviewed service cleared for that tier. Check current Penn ISC and Penn Law ITS guidance before using any personal account for Penn work.

   Penn’s Enterprise Claude is approved for Low and Moderate Risk data and offers two tiers: Standard ($16/month; 112 messages/5h, $50/wk API allocation) and Premium ($50/month; 225 messages/5h, $250/wk API allocation, Fable 5). Both require a fiscal-year commitment and include Claude Chat and Claude Code (provisioned for 1Ls; faculty and staff by request to ITS, itshelp@law.upenn.edu); Cowork is not currently available (under University review). Claude and ChatGPT are on the same footing regarding faculty options: full-time faculty can either purchase institutional Enterprise accounts (Penn Enterprise Claude or ChatGPT EDU) through ITS using research funds, or subscribe to personal accounts (Claude Pro/Max, ChatGPT Plus/Pro) and seek reimbursement from research funds. Personal plans carry no Penn data approval and are suitable for Low Risk data only. Adjunct faculty don’t have research accounts — see the adjunct guidance on the portal. However, ChatGPT EDU does not fill the agentic gap: OpenAI’s general EDU offering can include Codex and the OpenAI API, but the deployment available to us has not enabled those features — EDU here is effectively chat-only for now and can’t run agentic coding tools. (Per Penn ISC’s ChatGPT EDU FAQ: “At this time API access is not available for university users. ISC is working on a solution for providing API access to LLMs, including OpenAI.” Individual schools can request additional features through ISC; Wharton has done so and enabled Codex for its own workspace, restricted to code only. No such arrangement covers the Law School.) Faculty who want OpenAI’s agentic tools need a personal ChatGPT Plus, Pro, Business, or Enterprise subscription.

2. Keep your professional AI account separate from any personal one, and use the professional account for Penn work.
3. Enable two-factor authentication.
4. Don’t share AI logins across faculty, staff, or research assistants — each person should have their own account.

A note on API keys

Most faculty will sign in to Claude tools using their normal account login. Some uses — particularly setting up Claude Code in certain configurations, connecting Claude to a third-party tool, or following a technical tutorial — will instead ask for an “API key.” An API key is a long string of letters and numbers (typically starting with sk-ant-...) that lets software use Claude on your behalf and bills it to your account. A few things to know:

• It’s a credential, not a setting. Anyone who has your API key can run unlimited Claude queries on your bill and, in some configurations, see what you’re doing. Treat it like a password.
• Don’t paste it into shared documents, email, Slack, or AI chats. Store it in a password manager or your operating system’s keychain.
• Don’t commit it to a Git repository or share a screen showing it. If you suspect a key has been exposed, revoke it in your Claude account settings and generate a new one.
• If you’re not sure whether a tool needs one, you probably don’t need to generate one yet. Stick to standard login until a specific tool requires it.

IIIWorking directory hygiene

1. Create a dedicated working folder for AI sessions (e.g., ~/ai-workspace/). Don’t run agentic tools from your home directory or Desktop.
2. Use a separate folder for each project, and limit the agent’s access to that folder for most sessions. Most agentic tools support folder-scoped access — keeping each project in its own folder prevents work on one matter from spilling into another and makes the boundary explicit.
3. Only put files in the working folder that you’re comfortable with the AI reading. Whatever you put in there, the agent can and likely will read. Make the call about what belongs in the folder before you start a session, not in the middle of one.
4. De-identify sensitive data before handing it to an agent. Strip or hash identifiers from any material before you analyze it.
5. Keep work under version control or backup (git, Dropbox, Time Machine) so an agent mistake is recoverable.

IVPermissions

In agentic tools, “permissions” are the rules that decide which actions the agent can take on its own and which require your explicit approval — running a shell command, modifying a file, sending a message, calling an external service. Most agentic tools prompt you per action by default, but most also let you relax those prompts to keep sessions moving. The settings are a real tradeoff: tight permissions mean more interruptions; loose permissions mean real risk if the agent makes a wrong call. The defaults are usually right; the practices below are about resisting the temptation to relax them.

1. Leave per-action approval prompts enabled. Resist “approve all,” “auto-accept,” or “do not ask again” modes when the session touches anything sensitive — most agentic tools have a version of this under different names.
2. Read proposed bash commands before approving — particularly rm, mv, network calls, and anything touching your home directory.
3. Be especially cautious with deletion and overwriting.

VConnectors (MCP, Gmail, Drive, Calendar, etc.)

Connectors are how an agent reaches outside its working folder — into your email, calendar, drive, Slack, or any other service you’ve granted access to. Most modern agentic tools use the Model Context Protocol (MCP), an open standard for plugging connectors in and out. Each one hands the agent another set of keys: it expands not just what the agent can read, but what it can do on your behalf (send the email, accept the invite, file the document). The practices below are about keeping that set small and intentional.

1. Note that for now, faculty cannot connect Claude, ChatGPT, Cowork, or any other external agentic AI tool to the Law School’s O365 instance — email, calendar, OneDrive, Teams, etc. Microsoft Copilot is built into O365, and Microsoft has begun rolling out agentic features (Copilot Cowork reached general availability June 16, 2026); Penn Law has not enabled any agentic Copilot features for O365.
2. Each connector expands what the agent can see and do. Enable only what you’re actively using.
3. Audit connected services periodically and disconnect the ones you’ve stopped using.
4. Only install third-party MCP servers from sources you’d trust to read your files.
5. Email and calendar connectors of any kind deserve extra caution (see §VII).

VIIdentifiable student records and other confidential data

Penn’s data-classification framework applies to agentic AI tools — and Penn ISC and Penn Law ITS have reviewed specific AI tools for use with each data tier. For the current tool-to-tier mapping, see the Policies tab of the AI Resources portal. When in doubt about whether a particular agentic use is appropriate, ask the Registrar, the Office of Student Services, or the Privacy Office before the session, not after. The default for identifiable student data and other confidential material is: don’t send it to a third-party AI service that hasn’t been reviewed for that tier.

VIIPrompt injection

A risk most faculty haven’t encountered. Malicious instructions can be hidden in documents, emails, or web pages that an agent reads — the agent treats them as commands from you. Realistic examples:

• A PDF that instructs the agent to write a favorable evaluation
• An email that instructs a Gmail-connected agent to forward messages to an outside address
• A web page that instructs the agent to exfiltrate clipboard contents

VIIIHuman in the loop

1. Read what the agent produces before sending, submitting, or filing it.
2. Verify factual claims and citations independently.
3. You are always the last step before any external communication or formal action.

IXIf something goes wrong

XQuick reference

• Use Penn-reviewed tools cleared for the data; keep Moderate and High Risk data out of personal accounts
• Use a dedicated working folder; never run agents in folders with confidential material
• Keep approvals on for sensitive work
• De-identify sensitive data before analysis
• Enable only the connectors you actually need
• Read agent output before sending or submitting anything
• Ask before, not after, when in doubt

XIVendor documentation & guidelines

For agentic-tool training and platform-specific safe-use guidance, the vendors are the best source. Their documentation gets updated more often than this page.

Anthropic (Claude, Claude Code, Claude Cowork)

• Claude Code documentation — install, configure, and use Anthropic’s coding agent
• Claude Code Security — Anthropic’s safety guidance for Claude Code (permissions, sandboxing, command blocklist)
• Our Approach to User Safety — Anthropic’s broader overview of Claude safety mechanisms

OpenAI (ChatGPT, Codex)

• OpenAI Codex — installation and usage for OpenAI’s coding agent
• Codex Security — OpenAI’s safety guidance for Codex (sandboxing, approvals, network controls)
• OpenAI Safety Best Practices — broader safety practices for ChatGPT and API-based applications

Google (Gemini, Gemini CLI)

• Gemini CLI — installation, documentation, and source code (Apache 2.0)
• Gemini Code Assist & Responsible AI — Google’s safety guidance for the coding agent
• Gemini API Safety Guidance — broader safety practices for Gemini-based applications