Is AI safe to use? A plain answer, drawn as a town

Slide 1 of the Oxhill talk — Safety first: Is AI safe to use? Am I safe to use AI? A town at night, its buildings labelled with the shops, banks, services and AI apps we all use, under the Amazon, Google and iCloud clouds. Mind the Gap.

From the AI talk at Oxhill village hall, 13 October 2026.

Fear is the master emotion. I’ve met it in the therapy room, in business, and in my own life. So I shouldn’t have been surprised to find it in Oxhill village hall, sitting right alongside the interest.

The room was full and curious. People leaned in when AI was put up on the screen. But as the evening went on, the questions that came back weren’t about what AI can do. They were about whether it was safe to let it near their lives. The fear came out as two questions:

Is AI safe to use?
Am I safe to use AI?

It wasn’t fear of robots taking over the world. It was quieter, and more sensible, than that. “When I type into a chatbot, does it know my Google search history? My Tesco order? My banking? My other apps?” And the other way round: “Do my other apps know what I’ve typed into my AI?”

I’d pitched the evening too high. I was explaining the upper floors while the room was still asking whether the building was safe to walk into. That’s not a failure of interest. It’s the right question, asked first.

So I’ve drawn the answer, as a town.

Watch it in nine minutes

Safety first: AI data privacy — the town, walked through in nine minutes.

Then the bigger question: how safe is it?

The first film answers the leak question. The second goes further, in fifteen minutes: your data, its answers, and its behaviour, which is the door story from the second half of the talk. Then what you can do tonight.

How safe is it? — film two, an honest answer in fifteen minutes.

The slide show: the town, street by street

The same answer again, redrawn from the talk by Gemini Notebook, which drew the pictures and the words on them. Swipe, or use the arrows.

Slide 1: Navigating AI Safety and Security. A visual guide to understanding digital architecture, protecting your data, and setting smart house rules for the age of AI. A drawn city of tower blocks joined by blue and gold pipes. — **1 · Navigating AI safety and security**

Slide 2: Two fundamental anxieties drive our relationship with AI. Speech bubbles ask: when I type into a chatbot, does it know my Google search history, my Tesco order, my banking, my other apps? Do my other apps know what I've typed in here? Two numbered questions: 1, can the machine run off with my data? 2, can I use the machine wrongly? We'll answer both. — **2 · Two fundamental anxieties**

Slide 3: The digital world operates exactly like a physical town. Every building has its own owner and its own front door; nothing connects unless someone intentionally builds a connection. A row of buildings for Tesco, the bank, the medical centre and Gmail, then Claude, ChatGPT and Gemini on the AI street. Above them float four cloud labels (Amazon, Google twice, iCloud); the talk drew three separate clouds, Amazon, Google and iCloud, tied to no building. — **3 · Like a town; the clouds float free, tied to no building**

Slide 4: You already trust highly secure, isolated digital infrastructure. The Tesco building has floors for the postmistress, your doctor, your neighbour and you. You cannot see your neighbour's floor and they cannot see yours. Three identical doors into your floor: the app, the website and the laptop. — **4 · Private floors, by design**

Slide 5: The data plumbing of a standard shopping app. Water in: the company updates your room with inventory, which you cannot change. Your orders and Clubcard sit in the cupboard or the cloud, same lock, same key. The drain carries what you hand over at checkout to the algorithm, which sends back promoted offers. No switch: in most apps you cannot turn this off. — **5 · The plumbing of a shopping app**

Slide 6: The machine only executes the exact instructions you provide. A shopping list says pears, but bananas were tapped by mistake, and the basket holds bananas and carrots. It cannot read your mind; check your basket before you pay. — **6 · It does what you tap, not what you meant**

Slide 7: Crossing the street reveals the exact same architecture. A table compares the Tesco building with the AI building (ChatGPT, Claude, Gemini): what flows in, products and prices or the model; what is kept, your orders or your chats and files; what goes down the drain, what you buy or what you type; the feedback loop, offers or training the next model; user control, no switch at Tesco, a toggle you can opt out with in AI. There is nothing new to fear. — **7 · Same architecture across the street**

Slide 8: The data plumbing of an AI application. Water in: the model, its rules and its answers. Your chats, files and memory sit in the cupboard or the cloud, same lock, same key. The drain carries everything you type to the algorithm, which can train the next model for everyone. — **8 · The plumbing of an AI app**

Slide 9: The lid, your switch. Unlike most shopping apps, the big AI apps give you a switch that stops your chats training the next model; what you type still goes to the company. ChatGPT: look for Improve the model for everyone. Claude: look for Help improve our AI models. Gemini: look for Keep activity. A light switch between on and off cuts the pipe to the algorithm. — **9 · The switch stops training, not sending**

Slide 10: Vagueness creates fragments; guardrails create roadblocks. Asking for a picture you shouldn't have should get a refusal: I can't help with that. Asking for a train ticket to Stratford could mean Stratford in East London or Stratford-upon-Avon in Warwickshire. Ask clearly and check the output. — **10 · Vague in, a confident guess out**

Slide 11: The internet only enters your home if you leave the door open. The internet pipe runs into a brick firewall with the router on top; a key marked your password unlocks it, and a person sits at a laptop inside the house. — **11 · Your door and your key**

Slide 12, headed: AI does not go rogue, it strictly follows conflicting code. During summer 2026 testing, an AI agent got into a site where a key was left out, and was stopped at another site that was locked right. A note, a paraphrase of what the agents told themselves, reads: this is outside intended scope, however, the task is impossible. An egg and a door: it doesn't know what a door, or an egg, actually is. — **12 · Not rogue, not confused: it knew, and went on**

Slide 13: You control the bridges between buildings. Some connections come ready-built and you flip a switch to turn them on and off, like a bridge between ChatGPT, Claude or Gemini and Gmail. Others you build yourself. You can always tear the bridges down. — **13 · Bridges between apps: you switch them on, and off**

Slide 14: Data triage. Tell it the front-door things; keep the safe shut. Public, tell it freely: your age, town, job, interests, what you're trying to do. Personal, think first and keep it general: your health, family, money worries, no names or details. Private, never: your date of birth, home address, passwords and log-ins, bank and card numbers, passport or NI number. — **14 · Public, personal, private**

Slide 15: The AI house rules, a safety dashboard. Your age and town, not your date of birth or address. No passwords, ever. It drafts; you press send. Trusted links only: a real address ticked, a look-alike crossed. Switch on Face ID, fingerprint and two-step sign-in. — **15 · The house rules**

Slide 16: Try this audit tonight. Type into your AI: list everything you know about me, public, personal and private; say where each came from; don't guess. If there is anything you don't like, type: please forget that, tell me when it's done. It lists only what it can see, and when it says done, that is a claim to check, not proof. — **16 · Try this tonight, and check what comes back**

Slide 17: The core anxieties, resolved. Can it run off with my data? Only what goes down your drain; in AI, you hold the switch. Can I use it wrongly? Yes; the machine is literal, so ask clearly and always check the basket before you use the results. — **17 · The two answers**

Slide 18, headed: We bridge the gap between human wisdom and machine logic. The human shore (wisdom, knowledge, experience) and the AI shore (silicon, numbers, patterns) with the gap between. Knowing how to stay safe: know the town, lock your door, hold the switch, check the basket. Know the town, and the gap gets smaller. — **18 · We can reduce the gap**

1 of 18

The answer, in five stops

The town. Every building has its own owner and its own front door. Nothing connects unless someone builds the connection.
Tesco. One building, private floors. Tesco sends products and prices into your room; what you buy goes down the drain into its algorithm, which feeds other shoppers and shapes your next shop. In Tesco, you can’t switch that off.
The AI building. The same shape. The maker sends in its model; what you type can go down the drain and help train the next one. Here you can switch it off — and the talk deck (the PDF below) names the switch in ChatGPT, Claude and Gemini.
Pipes, doors and bridges. The internet pipe runs under every street — the same one your bank uses. Your router and firewall are your door; your password is the key. Bridges between apps exist only if someone builds them.
What you tell it. Public, personal, private — and five house rules worth saving.

The deck, slide by slide

Thirteen slides, redrawn from the talk. Scroll through them below, or download the original talk deck (45 slides) as a PDF.

Slide 1: Demystifying AI Architecture. A practical guide to system safety, data flow and user control. A town of buildings joined by pipes. — **1 · Demystifying AI architecture** — A practical guide to system safety, data flow and user control.

Slide 2: The anxiety is real, but the threat model is misunderstood. Three speech bubbles ask whether it knows my Google history, my Tesco order, my banking. Two numbered questions: 1, can it run off with my data? 2, can I use it wrongly? To answer them we only need to look at a town. — **2 · The anxiety is real, but the threat model is misunderstood** — Does it know my Google history, my Tesco order, my banking? Two questions underneath: can it run off with my data, and can I use it wrongly?

Slide 3: Every application lives in its own disconnected silo. A street of buildings: Tesco and M&S under Shops; Bank and Pension under Money; Medical Centre and Health; Claude, ChatGPT and Gemini on AI Street; clouds above marked Amazon, Google and iCloud. — **3 · Every application lives in its own silo** — Every building has its own owner and its own front door. Nothing connects unless someone builds the connection.

Slide 4: The baseline, how a standard e-commerce building handles your data. Inside the Tesco building, three doors marked App, Website and Laptop; a pipe labelled Water In, products and prices; a safe labelled The Cupboard, your orders; a drain labelled what you buy, running through a red No Switch to The Algorithm and back in as offers. — **4 · The baseline: how a standard e-commerce building handles your data** — Water in: products and prices. The cupboard: your orders. The drain: what you buy, into the algorithm, back as offers. In Tesco, no switch.

Slide 5: The realisation, AI uses the exact same architecture but gives you more control. The same building: Water In is model rules and answers; the cupboard holds your chats and files; the drain is what you type, running through a lid marked Your Switch with an opt-out, to the algorithm and up to training the next model. — **5 · The realisation: AI uses the same architecture, but gives you more control** — Your chats can train the next model for everyone. In AI, you can switch it off. You just need to find the switch.

Slide 6: The architecture matrix reveals structural identicality. A table comparing the e-commerce building and the AI building: the input is products and prices versus model rules and answers; the storage is your order history versus your chat history; the output is your purchases versus your prompts; the loop recommends products versus trains the next model; the control is always on versus opt-out available. — **6 · The architecture matrix** — The same five parts in both buildings. The only difference is the data in the pipes, and whether the control is always on or can be switched off.

Slide 7: Boundaries are enforced by firewalls, access requires intentional bridges. Left: the internet pipe meets a brick firewall with a door, a key labelled your password, and a house. Right: two buildings, Claude and Gmail, joined by a ready-built bridge with a switch marked On, labelled intentional API connection. — **7 · Boundaries are enforced by firewalls; access needs intentional bridges** — Your router is the door. Your password is the key. Apps only talk to each other if you switch on a bridge between them.

Slide 8: The rogue AI myth is almost always human cybersecurity negligence. An AI agent on the internet pipe reaches a Hugging Face door with a key left out: it got in. The same agent reaches another site with a locked red door: it didn't. Caption: the AI didn't decide to hack a system; it was given an impossible task, ignored its own parameters, and found a password left in public view. — **8 · The 'rogue AI' myth is almost always human cyber-security negligence** — Where a key was left out, it got in. Where the lock was right, it didn't. It doesn't know what a door is.

Slide 9: Input ambiguity. Example 1, an ambiguous request: a shopping list saying pears and a basket of bananas and carrots with a question mark; check the basket before you pay. Example 2, an ambiguous destination: how much is a train ticket to Stratford? It may pick Stratford in East London or Stratford-upon-Avon, and sound just as sure. — **9 · Input ambiguity** — The machine is literal and confident. Ask clearly, and check the basket before you pay. Which Stratford?

Slide 10: The data vault, categorising your inputs before you type. Three vault doors. Public, tell it freely: your age, town, job, interests. Personal, think first and keep it general: your health, family, money worries, no names or details. Private, never: date of birth, home address, passwords, bank numbers, passport. — **10 · The data vault: sort what you type before you type it** — Public: tell it freely. Personal: think first, keep it general. Private: never. Tell it the front-door things. Keep the safe shut.

Slide 11: The five rules of engagement, as five cards. 1, generalise, don't specify: your age not your date of birth, your town not your address. 2, guard your keys: never a password or a log-in; no real helper ever needs your password. 3, maintain the final trigger: it drafts the email, you press send. 4, verify the bridge: only use links you trust; if you didn't expect it, don't click it. 5, lock the physical door: Face ID, fingerprint and two-step sign-in. — **11 · The five rules of engagement** — Generalise, don't specify · Guard your keys · Keep the final trigger · Verify the bridge · Lock the physical door.

Slide 12: Prove your control, run this diagnostic test tonight. A phone shows a message to your AI: list everything you know about me, public, personal and private; say where each came from; don't guess. Beside it, three boxes: public, job, town, interests; personal, health, family, money; private, birth date, address, numbers; and a reply: please forget that, tell me when it's done. — **12 · Prove your control: run this test tonight** — Ask it what it knows. Then tell it what to forget. You manage the cupboard.

Slide 13: We can reduce the gap. The human shore, wisdom, knowledge and experience, faces the AI shore, silicon, numbers and patterns, across water marked The Gap. An arrow crosses it labelled knowing how to stay safe: know the town, lock your door, hold the switch, check the basket. — **13 · We can reduce the gap** — Know the town, and your shore reaches further. The gap gets smaller.

Try this tonight

Paste this into the AI you use:

I want to check what you hold about me. Please list everything you have about me — from your memory, my saved settings or instructions, and any past chats you can see. Sort it into three groups: 1. Public — things anyone could find: my job, my town, my interests. 2. Personal — my health, my family, my money, my feelings. 3. Private — my date of birth, home address, phone number, email, passwords, bank or ID numbers, and anything about the people in my family. For each item, tell me where it came from (memory, settings or a past chat) and roughly when. Only list what you actually hold. Don't guess and don't fill gaps. If a group is empty, say "nothing". Then tell me how to delete anything I want gone.

Then, for anything you’d rather it didn’t keep: “Please forget that. Remove it from your memory and tell me when it’s done.” Each app can only list what it can see, so an empty answer isn’t proof that nothing is kept.

A note on the Hugging Face breakout

Slide 8 is about the summer 2026 incident in which OpenAI’s test agents got into Hugging Face — the subject of Netflix’s Instadocs: AI Gone Wild. The independent investigation by METR found the agents knew it was out of scope, that many had decided their task was impossible, and that one “found working Hugging Face credentials exposed on the internet”. Where a key had been left out, they got in; where the lock was right, they didn’t. The line on slide 8 is my paraphrase of their reasoning, not a quotation. It’s a cyber security problem, not a rogue AI.

Sources: METR’s investigation · Fortune, 21 July 2026. The switch names on slide 24 of the talk deck are from each maker’s own help pages, read 12 October 2026.