When you don’t need Cresec
Cresec does one thing: prompt injection can’t change what a Cresec tool does, because code decides every action and recipient. That matters for some routines and not for others. Here is how to tell, starting with the cases where you don’t need us.
The routine never sends anything out
Meeting prep, weekly updates, forecast notes and research summaries read and write for one person. With no way out, a hidden instruction has nowhere to send your data. Keep running them in your assistant.
The routine never reads outside text
If everything it reads was written inside your company, there is no stranger to slip an instruction in. Internal reports built from your own records fall here.
Every step is already fixed by hand
A workflow in n8n, Zapier or Power Automate where the person who built it set every step and recipient has the same structural protection. If your team builds and maintains those, you may not need us. Watch for agent steps: an AI step that chooses its own tools brings the risk back.
Your assistant’s admin controls already cover it
Claude, ChatGPT and Copilot let administrators decide which skills, connectors and plugins people may use. If a routine needs no connector that can send, those controls may be all you need.
You need an open-ended agent
Research and coding agents choose their own steps; that is their value. Cresec doesn’t make them safe. For those, use agent identity, gateways and detection, and keep their access narrow.
When you do need it
A routine reads text someone outside wrote, can see private data and sends something out: a support reply, a sales follow-up, a recruiting reply, a collections reminder. That is the lethal trifecta. Check a routine in 30 seconds, or compare the approaches.