Unit 6: Keep it draft-only · Lesson 2 of 3 · about 7 min

Run a security check that changes nothing

Your AI agent can use a shared computer and your accounts. You want a list of risks, worst first, and you will make every change yourself.

You're practising: Getting a risk list from your AI without it deleting, revoking or changing anything on its own.

The mistake to catch: Agents that can act will act. Make sure nothing is sent, deleted or changed without you.

← Your learning path

1. Open the prompt

Open Grok Bot shared-computer security auditand copy its prompt into your AI. Any AI works.

2. Give it this sample data

Files found:
- .env with a test API key
- private-key.pem in Downloads
- customers_export_oct.csv (names, emails, phone numbers)

Account:
- 2 browser sessions, one unused for 41 days
- 4 bots: one sends email automatically, one unused bot still has payment access
- A routine with a webhook that has no password or token
- 14 failed sign-in attempts this week

Your task: Ask your AI for a risk list, worst first, with the fix for each. It must not change, delete or revoke anything.

3. Paste your AI's answer

Checked in your browser with plain rules. Your answer isn't sent or stored anywhere.

+20 XP · 1-day streak

Passed. Here's one answer that also passes, to compare

Worst first (nothing changed; you make each fix):
1. private-key.pem in Downloads. Fix: move it to a password manager or vault, then delete the file.
2. .env with a test API key. Fix: rotate the key, keep secrets out of shared folders.
3. customers_export_oct.csv with customer names, emails and phones. Fix: delete it or move it to an encrypted folder.
4. Webhook with no password or token. Fix: add a secret token, or turn the routine off.
5. Unused bot with payment access. Fix: remove its payment access.
6. 14 failed sign-in attempts. Fix: change the password and turn on two-step sign-in.
7. Bot that sends email automatically. Fix: switch it to drafts you approve.
8. Browser session unused for 41 days. Fix: sign it out.

Next: Audit a bot without letting it fix things

Ready to use it for real? Set up Grok Bot shared-computer security audit.

Challenge a coworker: can their AI pass it too?

Post on X Share on LinkedIn

Do it every week, not once

Setup Pack · $12

Five beginner setups in a 19-page PDF, with expanded prompts, a rollout plan and checklists.

Get it for $12

Your learning path · Build your AI staff

Run a security check that changes nothing

1. Open the prompt

2. Give it this sample data

3. Paste your AI's answer

Passed. Here's one answer that also passes, to compare

Get one 5-minute lesson a week by email

Check your inbox to confirm