4 November 2026 · 6 min read
Letting an AI Agent Handle Your Files? What to Remove First
AI agents can now act on your files and accounts. What to remove first, how to limit access, and the checks to run before an agent does something irreversible.
Before an AI agent touches your files, give it a folder of copies rather than your originals, and take out what the job does not need: metadata, personal details, passwords, and anything belonging to other people. Then grant the least access that works, and review anything hard to undo, such as deleting, sending or paying, before it happens. An agent can be very useful, but it acts rather than just answers, so a mistake can change real things instead of producing a wrong sentence.
What makes an AI agent different from a chatbot?
A chatbot gives you text and you decide what to do with it. An agent is given a goal and tools, and takes steps on its own: opening files, renaming them, filling in forms, sending messages, or using an account you connected. That is what makes agents helpful for tedious work, and also why the preparation matters. The mistake is no longer a bad paragraph you can ignore. It may be a moved folder or a sent email.
What does Apple's annual report say about AI agents?
Companies now list this as a business risk. Apple's Form 10-K for the fiscal year ended 26 September 2026, filed with the US Securities and Exchange Commission, says artificial intelligence agents can act autonomously, including by interacting with systems they may not be authorised to access, altering code, sending communications and completing transactions. It adds: 'Some consequences, such as deleting data or completing transactions, may be difficult or impossible to reverse.' It also says the company's ability to oversee and control third-party agents may be limited.
Keep that in proportion. A risk factor in an annual report describes what could happen, and companies list many risks. It is still a clear, plain description of why irreversible actions deserve a second look.
What should you remove before giving an agent your files?
| Remove | Why | How |
|---|---|---|
| GPS, device and date metadata in photos and videos | Shows where and when, and it is rarely needed for the task | Metadata Cleaner, on a copy |
| Author names and timestamps in PDF, Word and PowerPoint files | Can reveal who wrote what, and when | Metadata Cleaner, on a copy |
| Faces, names, card and ID numbers in images | Visible content is not metadata, so cleaning will not remove it | Black box in the redaction tool |
| Passwords, recovery codes, API keys | An agent that can read them may be able to use or expose them | Keep them in a password manager, out of the shared folder |
| Tax, medical, legal and identity documents | Costly to expose, and rarely necessary for routine jobs | Leave them out unless the task truly needs them |
| Other people's private data | It is not only your risk to take | Delete, anonymise or leave out |
Metadata and visible content are two different layers, and you often need to deal with both. Skrubly's Metadata Cleaner removes the hidden layer, and the redaction tool handles what is visible in an image. Both run in your browser, so the files you are preparing are not uploaded to us.
Remove GPS, author names and other hidden data from copies of your files before an agent sees them.
Open the Metadata CleanerWhat rules should you set for an AI agent?
- Least access: one project folder, not your whole drive. One calendar or mailbox only if the task requires it, and read-only where that is offered.
- Copies, not originals: duplicate the files into a working folder, and keep a backup somewhere the agent cannot reach.
- Separate accounts where you can: a spare mailbox or a test account limits how far a mistake can travel.
- No payment details by default: if a task involves money, make the final confirmation yourself.
- Approval on: if the agent offers a mode that asks before acting, use it, at least until you have seen how it behaves on this kind of job.
- A small trial first: try five files before five thousand, and check the result.
- Time-limited access: disconnect the app or revoke the permission when the job is done.
Can a file trick an AI agent?
It can. This is called indirect prompt injection, and OWASP puts prompt injection first in its 2025 Top 10 for LLM applications. It describes the indirect kind as happening when a model takes input from outside sources, such as websites or files, and instructions hidden in that content change how it behaves. A downloaded PDF or a web page might contain text aimed at the agent rather than at you, perhaps invisible on the page.
You cannot inspect every file for this, which is another reason the rules above matter. If the agent only has access to one folder of copies and has to ask before it sends anything, a successful trick has much less to work with. Be especially careful about combining three things in a single task: private files, content from unknown sources, and the ability to send data out.
What should you review before an agent acts?
| Action | Reversible? | What to do |
|---|---|---|
| Summarising or sorting a copy | Yes, the original is untouched | Spot-check the result |
| Renaming or moving files | Usually, if you have a backup | Ask for a list of planned changes first |
| Editing documents or code | With version history | Review the changes before accepting them |
| Deleting files | Perhaps not | Ask for the list, then confirm it yourself |
| Sending email or messages | No | Read the draft and send it yourself, or approve each one |
| Payments, bookings, purchases | Often difficult | Confirm the item, the amount and the recipient yourself |
| Changing account or security settings | Sometimes difficult | Do it yourself |
A useful habit is to ask for a plan before any action: 'List what you intend to do, and wait for my go-ahead.' It costs little, and it is where you tend to catch a misunderstanding. Afterwards, check the outcome yourself. An agent's report that a job went well is not the same as the job having gone well.
Cover names, numbers and faces in images before they go into an agent's folder. Black box destroys the pixels; nothing is uploaded.
Open the redaction toolA five-minute checklist
- Write down the task, and which files and accounts it truly needs.
- Copy those files into a new folder, and confirm that a backup exists.
- Remove metadata from the copies.
- Black out visible private details in images, and take out anything sensitive the job does not need.
- Check the agent's own documentation: what it can access, whether files go to its servers, and what its data settings are.
- Grant the narrowest access available, and turn on approvals.
- Run a small test, then read the results.
- Revoke access when you are done.
Quick answers
- Should I never use an agent on personal files? That is your call. Risk depends on the task and the access you grant. Sorting holiday photo copies is very different from giving access to your bank email.
- Does a local agent make this unnecessary? It can reduce what leaves your machine, depending on how it is set up, but it can still delete or change local files. The same rules apply.
- Should I remove AI or C2PA tags as well? The Metadata Cleaner can, but do not strip provenance to hide that content is AI-generated where you are supposed to disclose it.