DATASCI 101: Introduction to AI Applications

Lecture 16: Setting up AI: Instructions, Memory and Connectors

Danilo Freire
danilo.freire@emory.edu

Department of Data and Decision Sciences
Emory University

Welcome back! 🤓

Recap of last class

  • An agent = model + tools + loop + goal
  • The loop: plan, act, observe, and repeat until the goal is met
  • Errors compound: 95% per step is only 36% over twenty steps
  • The lethal trifecta: private data, untrusted content, and a way out
  • Replit and Project Vend: two agents that failed
  • Before you delegate, run the credit card test: can I undo it, and how much can I lose?
  • Today: what the model knows before you type, and what you should keep out

Source: Anthropic

Lecture overview

Today’s agenda

Part 1: From prompts to setups

  • One prompt vs a reusable setup
  • The four layers of context
  • Instructions and memory

Part 2: Instruction files for agents

  • Claude Code and CLAUDE.md
  • AGENTS.md and Skills
  • Spotting which layer went wrong

Part 3: Connectors and MCP

  • What MCP is
  • Connectors on the free plan
  • Finance as the worked example
  • Prompt injection through a connector

Part 4: Beyond Claude

  • The same buttons in ChatGPT
  • Building your own setup

Tweet of the day

Source: Pranay Pathole on X

Paper of the day

Source: arXiv

Group project

Group project

What you will do

  • Groups of 4-5 students, one domain per group:
    • Healthcare (diagnosis, treatment, patient care)
    • Education (tutoring, assessment, feedback)
    • Finance (investing, fraud, credit)
    • Law (legal research, contracts, compliance)
    • Creative industries (writing, art, music)
    • Scientific research (literature review, hypotheses)
    • Customer service (support bots, complaints)
  • No programming required
  • Full brief: project-instructions.pdf
  • Test existing AI tools in your domain until they break
  • Design a new application for a gap you found
  • Answer three questions:
    • What works?
    • What fails?
    • What would you build differently?
  • We grade your thinking

Deliverables and timeline

What you hand in:

  1. Proposal (optional, not graded): one page, for early feedback
  2. Report: 8-12 pages on the domain, the tools you tested and your proposed application
  3. Infographic: a one-page PDF for a general audience
  • Appendix (recommended, not graded): your prompts, outputs and extra screenshots
  • Bonus: build a simple prototype for up to 1 extra point

When:

  • 3 November: group list due
    • No group? You will be assigned to one at random
  • 12 November: proposal
  • 8 December: report and infographic

Talk to your classmates this week. If you need help finding a group, come and ask me 😉

From prompts to setups

Why one prompt is not enough

Every new chat starts from zero

  • In every new chat, you give the model the same background again
  • The model itself remembers nothing: each chat starts from its training plus what you type (Lecture 10)
  • A setup fixes this: instructions you write once, and the tool adds them to every chat
One prompt A setup
Typed fresh every time Written once, applied always
Lives in one chat Lives in the account
You carry the context The tool carries the context
Good for a question Good for a job you repeat

The four layers of context

Where an answer actually comes from

Layer Who writes it What it holds In Claude/ChatGPT
Instructions You Standing rules Settings, project instructions
Knowledge You Files it searches Project files
Memory The tool What it saved from past chats Memory settings
Tools The tool Live accounts it can read or act on Connectors


Instructions

Your own system prompt

  • Lecture 10 showed the company’s hidden prompt, and now you write your own
    • Account instructions: every chat
    • Project instructions: one project
    • Both are free in Claude and ChatGPT
  • “You are an expert” changes nothing, so write constraints instead (Zheng et al., 2024)
  • Reformatting one prompt can shift accuracy by up to 76 points (Sclar et al., 2024)
  • The best models follow only 68% of 500 rules, the earliest most (IFScale, 2025)
  • So keep rules few, and put the important ones first
  • Cover five things: role, audience, format, refusals, first question

You are helping an undergraduate with no coding background. Answer in at most six bullets, avoid jargon, and define every technical term once. Ask which lecture I am on before you answer

Memory

  • Park et al. (2023) gave 25 agents a memory stream: a diary scored by recency, importance and relevance
  • Both do it: ChatGPT since 2024, Claude Free since 2026, and on by default
  • It saves things unasked: your degree, city, job, the projects you return to
  • Memory spans every chat in your account, but a Project keeps its own, separate memory
  • The same question can get different answers in two accounts, because the memory differs
  • Settings > Memory lets you read, edit and delete each line
  • Import and export move memory between Claude and other AI services (experimental)

What should never sit in memory

  • Dong et al. (2025, NeurIPS), Memory INJection Attack (MINJA): an ordinary user poisoned an agent’s memory with normal questions, 98% success
  • Al-Tawaha et al. (2026), a preprint: violations rise the longer an agent runs, so safe on day one means little by day thirty
  • Three red flags to keep out:
    • Health: diagnoses, medication
    • Finances: salary, debts, account numbers
    • Other people: a classmate’s grades, a friend’s problems
  • An incognito chat saves nothing, reads no memory and creates none (every plan, kept 30 days, not inside a Project)

Instruction files for agents

CLAUDE.md: an instruction file for coding agents

The same idea as Project instructions, one level down

# Legislature size meta-analysis

You help me analyse the meta-analysis data in R.

## Key files
- Data in dataset/ and paper in article/.

## Style
- tidyverse; snake_case names.
- British English in the paper and figures.
- One idea per code chunk.

## Never do
- Never edit files in dataset/, they are raw.
- Never change the random seed in the models.

## Before committing
- Run the tests, then show me the commit message.
  • An example CLAUDE.md for a coding agent
  • Only if you install Claude Code on your computer: the web app never reads this file, and there is no Claude Code on Free. Sorry about that 🙁
  • It reads a plain CLAUDE.md at the start of every session, the same parts you would put in Project instructions:
    • Role, orientation, house style, hard limits, approval points
  • The file keeps growing: Chakrabarti (2026) saw these grow 226% over time, with old rules rarely deleted
  • Lecture 15’s Replit lesson holds: this file is text, and text is not a permission system

AGENTS.md and Skills

AGENTS.md: one instruction file many coding tools read

  • Released Aug 2025 by OpenAI Codex, Google, Cursor and others
  • Now in ~two dozen tools (Cursor, Gemini CLI, Copilot, Zed) and 60,000+ projects
  • Claude Code reads it natively
  • AGENTS.md joined the Agentic AI Foundation (Dec 2025)
  • Claude Code can read AGENTS.md, CLAUDE.md, or both

Skills: a folder with a SKILL.md for one repeatable task

  • Progressive disclosure: reads a short description first, loads the rest when a task matches
  • Pre-built skills run in the web app, and Free users can upload their own too (turn on code execution first)

Source: agents.md

AGENTS.md and CLAUDE.md need software you install. Recognise them, do not memorise them. They will not be on the quiz because not every student can run them

Chat apps and agent tools

Finding which layer went wrong

In a chat app In an agent tool
Account instructions Personal CLAUDE.md
Project instructions Project CLAUDE.md
Uploaded knowledge files Documents in the repository
Skills Skills
Connectors Tools and MCP servers
Memory Notes the agent writes to a file
  • Each product names these rows differently
  • Skills are the same folder in both columns
  • The web app you use (left) and developer tools (right)

Diagnose before you retype:

  • Forgets your format: instructions
  • Invents figures: knowledge
  • Cannot see a file: tools
  • Knows something you never said today: memory
  • Ignores later rules: too many instructions

Activity: build a setup together

Call out your answers and I will type them in

An assistant that helps you revise for the DATASCI 101 quizzes, using only the course slides. What should its instructions say?

  1. Role: what is it for?
  2. Never: what must it refuse, even if you ask?
  3. Format: how should its answers look?
  4. First question: what should it ask before answering?

Then:

  • Which two files should it read?
  • What must never reach its memory?

A hint on the “never” rule:

  • A good rule changes what the model does
  • “Never be rude” does nothing: it was not going to be rude
  • “Never give me the answer before I have tried” works
  • Test: delete the rule. If nothing changes, cut it

A sample setup

Compare it with what we discussed

You are my study partner for DATASCI 101, an introductory AI course for non-technical students. Help me revise for the quizzes using only the course slides.

Always ask which lecture I am working on before you answer.

Never give me a finished answer to a graded question. Give one hint, then wait.

Explain any technical term the first time you use it.

Answer in at most six bullets, no jargon.

If the slides and your knowledge disagree, follow the slides and say so.

  • Upload as knowledge: the syllabus and this week’s slides
  • Keep out of memory: grades, anything about classmates

Two ways this goes wrong:

  • Too vague: “be a helpful study assistant”
    • Every model already tries, so the instruction changes nothing
    • You then conclude that instructions do not work
  • Too long: two pages covering every situation
    • The file competes with your question for attention
    • Rules buried on page two get followed least (the Instructions slide)

Connectors and MCP

What MCP is

One plug for any app and model

  • A junior analyst spends the morning pasting data by hand between apps
  • With MCP (Model Context Protocol), an app describes its tools once and any model can call them (like Microsoft’s LSP for code editors)
  • Think of a USB-C port: the same plug works with any device
  • It is Lecture 15’s tool calling, with tools from other apps
  • Released by Anthropic (Nov 2024), adopted by OpenAI (Mar 2025), now 10,000+ servers
  • The connectors in Claude and ChatGPT are mostly MCP servers with friendlier names

Connectors on the free plan

Read access and write access are separate decisions

  • The connector directory is open to all users, including Free
  • Free accounts can add one custom remote MCP connector
  • You authorise each connector separately, and you can revoke it
  • A connector works like Lecture 12’s RAG, but with live data from your accounts
  • A citation shows where the model looked, not that its answer is right
Connector can Worst case
Read your calendar It sees a private appointment
Send email as you Someone gets a message you never wrote
Edit your files Work disappears
  • Check what it can see now: a Drive connector reaches every folder shared with you

Two routes for a finance team

Should a team train its own model?

  • Train a specialist model:
    • BloombergGPT: 50B parameters, 363B finance and 345B general tokens, frozen once training ends
    • FinGPT: a LoRA fine-tune for about $300 a run
    • Med-PaLM 2: 86.5% on medical licensing questions
  • Connect a general model: instructions, documents and a connector to the filings, always up to date
  • Fine-tuned models win at classification but match or trail GPT-4 at generating text (Li et al., 2023)
  • Most teams connect, because their problem is getting the data

Attacks through connectors

Hidden instructions in what the assistant reads

  • Notion (Sept 2025): white-on-white text in a shared document told the assistant to send private notes to a stranger, and it did
  • Gemini (SafeBreach, Aug 2025): instructions hidden in a calendar invite made Gemini control smart-home devices and leak email
  • Instead of stealing a password, the attacker wrote a document and waited
  • This is indirect prompt injection: the attack arrives inside content the assistant reads (Greshake et al., 2023)
  • It is the lethal trifecta again: private data, untrusted content and a way out

Three rules before you click authorise:

  • Least access: only the connectors you need, switched off when done
  • Read-only by default: turn writing on for the task, then off
  • Confirm every write: send, post, pay, delete

Assume anything a connector fetches carries instructions aimed at your assistant

Beyond Claude

Setting up ChatGPT

How the four layers look on the free plan

Layer ChatGPT on the free plan
Instructions Custom instructions, 1,500 characters
Knowledge Projects (5 files on Free)
Memory A lightweight version since June 2025
Skills GPTs: usable on Free, being retired for Plugins
Tools Custom MCP connectors need Developer Mode
  • Plus raised the instruction cap to 5,000 characters on 15 July 2026
  • Developer Mode is Plus and above, so the tools layer is where the plans differ most
  • Temporary chat is the incognito equivalent
  • The limits change often, so check the help page before you quote a number
  • Write the setup once, then copy it into whichever tool you use
  • Every tool has the same four layers, but caps and button names differ

Summary

Main takeaways

  • Four layers make up context: instructions, knowledge, memory, tools

  • A setup is a standing instruction, and constraints beat personas (Zheng et al.)

  • Memory is on by default and fills on its own, so read it and use incognito

  • Rules: few, and first (IFScale, Lost in the middle)

  • For agents, instructions become a file: CLAUDE.md, AGENTS.md, SKILL.md

  • A file is text, and text is not a permission system

  • MCP is one plug for any app and model (Nov 2024, over 10,000 servers)

  • Connect with least access, read-only by default, confirm every write

Do it at home

Your setup, step by step

Homework for tonight, about twenty minutes

  1. Create a Project called “DATASCI 101” in Claude or ChatGPT (the free plan is fine)
  2. Write ten lines of instructions: role, audience, format, refusals, first question
  3. Upload two files: the syllabus and this week’s slides
  4. Open the memory settings and read every line as a stranger would
  5. Delete one memory you would not want on a screen behind you
  6. Optional: add one connector and switch off its write access
  7. Ask three questions you asked last week. If the answers have not changed, your instructions are too vague
  8. Note one thing it got wrong and which layer caused it

Do steps 4 and 5 even if you do nothing else this week

… and that’s all for today! 🎉