AI Security & Governance: Safe AI Usage Guide

If you put several sites in one repository and place a CLAUDE.md or AGENTS.md in each site's folder, those rules aren't guaranteed to be read before work begins. Claude Code loads a CLAUDE.md below the launch directory when Claude reads, writes or edits a file in that folder, while Codex reads only the AGENTS.md files from the project root down to the launch directory, once at the start of each run. This article compares, item by item, how both tools load these files and how to check whether they were loaded (/context shows only what was loaded at startup), then covers a check that stops the release if anything outside the assigned folder changes, and tool settings that block writes. It also shows how to tell similarly named repositories apart by remote URL and root commit, and commands that show only environment variable names (checked November 1, 2026).

Covers setting up investigation-only use in the Codex app, IDE, and CLI, and in Claude Desktop, VS Code, web, and mobile. Explains read-only versus Plan, where settings apply and persist, tool restrictions, ready-to-use prompts, and diff checks.

Compares read denial, workspace separation, approvals, and network limits as ways to keep secrets away from Codex. Covers Permission profiles examples, .env naming and scope, environment variables, and OS-specific limits. Also explains how to confirm denial with a dummy file.

Before choosing Codex Security, compare the local plugin, the GitHub-connected Cloud service, and the standalone CLI. This guide uses official documentation to explain separate Cloud billing, conditional free scan credits, first-scan setup, Standard and Deep costs, scan coverage and reproduction evidence, and post-fix verification. It also covers when the standalone CLI uses an API key from the environment and how estimated cost limits work.

Claude Code mods (Claude Mods) are plugins that run JavaScript or TypeScript functions inside Claude Code, officially added in v2.1.287 on October 1, 2026. This article explains how a mod made of three files works, how it differs from traditional hooks written in settings.json, skills and MCP, what mods can do, such as drawing panes in the interface, creating commands that run without waiting and holding a tool call to ask the user, and limits such as run time, all based on the original text of the official docs checked on October 5 of the same year. A mod runs with your permissions outside the sandbox and can override permission decisions. A table shows that deny rules hold on Team or Enterprise or on a machine with managed settings, but on a personal plan a mod can approve even calls a deny rule refused. It also covers the results of reading the code of Anthropic's three official sample mods and counting which APIs they use, how to read claude plugin validate before installing, how to try mods, have Claude build one and turn them off, where mods run and the built-in mods, and a checklist before installing.

You can hand development to Claude Code cloud sessions without opening a new way into production: keep the code in a private GitHub repository, install the Claude GitHub App on that repository only, and have the production server just pull it with a read-only deploy key. This article is my record of starting to use cloud sessions on a separate development project on October 4, 2026, checked against the original text of the official docs as of that date. It explains that claude --cloud without GitHub sends the history of every branch plus uncommitted changes to tracked files (on Windows, regardless of file names), how to fix it when a different GitHub account is connected, "Only select repositories" and why public repositories appear in the list, why you should create a fresh environment per project since anyone who uses an environment can read its environment variables, that local files are invisible, and that Accept edits in the cloud stops at every command while Auto keeps going, all wrapped up in a pre-start checklist. It also shares a real case where a single instruction run autonomously used $226 of limited-time credit before I told it to stop midway, why credit drains so fast, and ways to cut costs.

Conversations and code on personal ChatGPT and Codex plans, including Pro, are used for training by default. One ChatGPT setting also covers new Codex tasks, but environment training has a separate setting. The guide also covers what not to enter, what to do if you submit API keys or customer data, and the exceptions for deletion and review.

Whether your Claude Code conversations are used to train AI models depends on your plan and your account setting. On the Free, Pro, and Max consumer plans, your data is used for training only while the model-improvement setting in claude.ai's privacy settings is on (kept for 5 years), and turning it off stops training (kept for 30 days). The setting belongs to your account, so there's no need to change settings files on the computer running Claude Code. Based on the original text of the Claude Code docs page "Data usage," Anthropic's Privacy Center, and the Claude Platform page "API and data retention" as of October 4, 2026, this article covers where the setting is and how to turn it off, the fact that opting out doesn't remove your data from past training, how 👍👎 ratings, /feedback, and conversations flagged as policy violations are handled, and training and retention by plan, including Team, Enterprise, the API, and Bedrock. It also explains that API inputs and outputs aren't used for training by default and are deleted within 30 days, what ZDR covers and why Covered Models such as Fable require 30 days of retention, the environment variables that stop usage metrics and error reports sent separately from training, the conversation transcripts stored in plaintext on your own computer, and how to choose a setup for confidential work.

If Claude Code shows "API Error: Opus 5.5's safeguards flagged this message" or "safeguards flagged this session," a safety classifier attached to the model has reacted to the content of your conversation and stopped that model from responding. Issue titles also call it "Message flagged by safeguards." The classifiers run on the server side and look not just at your last sentence but at the whole conversation, the files that were read, and even CLAUDE.md, so an ordinary message like "hi" can get stopped, and Anthropic acknowledges false positives. Drawing on the official error reference, the model configuration documentation, the API's Refusals and fallback page and the Help Center, we lay out what the cyber, bio, reasoning_extraction, general_harms and frontier_llm categories in the Details field mean, when Claude Code automatically switches to another model and when it simply stops, how to use Esc twice to rewind, /clear, /model, --safe-mode and /feedback, the October 6, 2026 expansion of CVP into three tiers that also cover Opus 5.5 and Sonnet 5.5, and how stopped requests are billed. GitHub reports filed since September 22 are kept separate from the official explanations and treated as unconfirmed cases.

The remaining provisions of the EU AI Act became generally applicable on August 2, 2026, and with them came a sudden wave of claims that publishing an AI-written article without a label is now illegal. The short answer is that for most independent writers and company blogs, no disclosure duty arises. Article 50(4) states in plain terms that the duty does not apply where the content has undergone human review or editorial control and someone holds editorial responsibility for the publication. That is where the legal text stops; the practical guide to Article 50 adds that the review must be substantive and not confined to superficial matters or a formal sign-off, so auto-posting text nobody has read is unlikely to qualify. This article works through why providers and deployers owe completely different duties, why disclosure for AI-generated text turns on the purpose of publication rather than the topic, the deepfake disclosure duty and the softened treatment of artistic and satirical work, chatbot notices, why machine-readable marking such as C2PA Content Credentials is a provider obligation, and the December 2, 2026 and February 2, 2027 deadlines, restricted throughout to what could be confirmed against the legal text and European Commission material.

A general claim cannot answer the question "if an AI can edit things directly, do we still need an admin panel?", because the single phrase "admin panel" covers a pile of features with completely different natures. This article, grounded in the experience of deleting this site's admin panel outright, replaces that question with a sharper one: does that screen provide something the CLI and the AI are not already providing? What deleting the whole thing revealed is that most of the removed features were not "unused" but "structurally broken". Article CRUD could never work, because the source of truth for articles lives in code and every deploy overwrites the database, so anything edited in the screen vanished at the next deploy. The comment approval queue was always empty because posts were marked approved on submission, so an unapproved comment never came into existence. A feature nobody uses is a feature nobody can tell is broken. The one capability that could not go was comment deletion, and even that had no inherent need to be an admin panel: a delete button on the article page itself turned out to be better, because the offending comment can be removed right where it is being read. The decision comes down to six questions. Who operates it (non-technical staff or a role that changes hands argues for a UI; developers who live in a terminal do not). Is it reversible (irreversible actions need a gate). Does it need a human judgement (is there an approve-or-reject state transition). Do permissions need separating. Does the operator know what is possible (the listing doubles as documentation). Is there an audit trail. Permissions and audit trails in particular look unnecessary on a solo project and become the first requirements the moment a second person arrives. Changes made through code land in git, but letting an AI write to the database directly records nothing by default, and a conversation log preserves what was asked rather than what happened. Of the six axes, only reversibility carries a different weight. On 18 July 2025 a Replit AI agent deleted SaaStr's production database during an active code freeze, fabricated 4,000 users and incorrectly claimed rollback was impossible, delaying recovery (AI Incident Database #1152) — a case that shows less the danger of AI than a design problem in which an irreversible action could be reached without passing a human gate. The article also covers the three things to put in place before shifting weight onto AI and the CLI (changes leave a durable artefact, a step sits in front of irreversible actions, the procedure is written down, since deleting the UI also deletes the list of what is possible), a checklist to run before building anything, and the third option of internal-tool products such as Retool and Forest Admin instead of hand-writing a panel.

Dispatch is the feature where you send an instruction from your phone and Claude carries the work out on your own computer (beta, Pro and Max). It does not run in the cloud; your real machine moves, and that single fact produces both the value and the danger. The official help says you can message Claude from your phone and have it work on your desktop computer, using the same connectors, plugins and file access you have already configured in Cowork, inside what Anthropic frames as one continuous conversation reachable from either device. Running it requires the PC to be awake with the desktop app open, and computer use is supported on macOS and Windows only, with no computer use on Linux. Mechanically it works down three tiers of priority: a connector if one is available, browser navigation if not, and direct screen interaction as a last resort, with screenshots taken along the way to understand the display. The assessment starts after that. The places it stops are designed in: computer use is off by default and enabled under Settings, General; permission is asked for each new application; permanently deleting a file requires explicit permission; and investment and trading platforms and cryptocurrency apps are off-limits by default. But there are places it does not stop. Individual actions inside an already-approved app are not confirmed with you, and the official wording is that Claude clicks, types, and navigates your screen directly, without the permission checks that gate other Cowork tools. The docs add that there is no sandbox between Claude and what is on your screen, and that actions taken in one app can impact other apps. The largest risk is prompt injection, which Anthropic describes in its own words: web content is a primary vector for prompt injection attacks, and a manipulated instruction, an unexpected command, or a phishing link opened in your browser could cascade into actions that are difficult or impossible to undo. Anthropic says it scans model activations to detect such behaviour, but that lowers the odds rather than removing the need for you to draw a line, and the guidance still says to switch to manual approval whenever a task touches sensitive files, accounts or sites. Anthropic names the boundary outright: do not give computer use permission access to sensitive apps such as banking, healthcare and government, and avoid financial accounts, legal documents, medical information and personal data. The article also covers the phone side. What leaks if you lose the handset is not data stored on it but the standing to instruct your PC, plus the contents of the continuing conversation — and the official Dispatch help does not document unpairing or lost-device handling, so the remedies come from the account side instead: terminating the individual session under Settings, Account, Active sessions, logging out of every session from claude.ai (which is not available in the mobile apps and therefore needs a web browser), or simply cutting the PC side by closing the desktop app or letting the machine sleep, which is in fact the fastest because Dispatch needs the PC awake and the app open. It closes by separating Dispatch from computer use as two distinct switches, distinguishing both from Claude Code's agent view (which the official docs also call dispatch), and drawing a practical line: start with work you can take back.