Before You Upload
Protect your information when using AI tools
AI tools can receive information in several ways. You might upload a document, image, or recording, or connect the tool to an account such as Google Drive. Either choice may give the tool more information than your task requires.
Before uploading a file or connecting an account, take a moment to check what you are sharing and where it is going.
Guidelines for Safe AI Use
- Use the right version of the tool. A personal account may handle information differently from a UMBC-provided version of the same service. Check UMBC’s Generative AI Tools page to find tools that have been reviewed for university use and learn what types of information they can accept.
-
Minimize What You Upload. Share only what is strictly required for your immediate task:
- Redact personal information: A résumé submitted for feedback probably does not need your home address or phone number. A screenshot may reveal names, messages, notifications, or account details unrelated to your question. Removing those details limits how much personal information could be copied, retained, or exposed if the conversation or account is shared.
- Crop screenshots: Hide browser tabs, notifications, private messages, and unrelated names.
- Protect others' privacy: Files may also contain information about classmates, coworkers, or other people. Clean files to ensure they do not contain sensitive data. This protects information that those individuals did not intend to share with an AI service.
- Review Account Access and Permissions: Some tools use “Sign in with Google” only to identify you. Others separately request access to files in Google Drive, email, calendars, or other account information. Read the permissions screen and approve only the access the tool needs. For Google accounts, visit linked apps and services to see which services are connected and remove access you no longer want. Removing access stops the service from accessing new information, but it may not delete information the service already received.
- Keep Account Credentials Out of Prompts. Never enter your password, Duo code, or account-recovery code into a prompt. If you work with code, check it for API keys and access tokens before pasting or uploading it.
What to Do If Credentials are Exposed
If you accidentally share a password, token, or sensitive credential:
- Change the password or revoke the compromised credential immediately.
- Contact security@umbc.edu if a UMBC account or university information may be affected.
Celebrate Cybersecurity Awareness Month with Us
Share This Information
Forward this email to a friend and encourage them to follow us at IT Security - DoIT Cybersecurity Assurance and Digital Trust on myumbc. Learn about recent cybersecurity attacks and articles about threats, scams, and attacks.
Join Us
Want to see whether your email address has appeared in a known data breach? Visit us in the Commons Breezeway during the following event. We can help you check, answer questions, and decide what to do next.
Follow along throughout Cybersecurity Awareness Month for more ways to protect your accounts and information.
The first draft of the above announcement was generated using AI and edited by the Division of Information Technology Communications and IT teams.