Local AI Glossary

An attack in which a malicious system inserts itself between two parties that believe they are communicating directly. Sender and recipient think they are talking to each other, but a third party sees (and sometimes modifies) what passes. The main remedy is TLS/HTTPS with validated certificates: it makes the communication encrypted and authenticated, so a man in the middle cannot read or alter the content.

The data a program automatically sends to report what it did: version, error type, usage metrics. Telemetry is not the same thing as content: a program can send telemetry without ever touching your prompts or your documents. When you read a privacy policy, the question to ask is what data goes out and under what conditions.

Mechanism where the model, before executing a tool call (sending an email, modifying a file, querying an API), stops and presents the request to the user, who can allow or deny it. It is the most direct way to keep control over what your AI can do with your data: every potentially irreversible action passes through an explicit yes.