{"slug": "connecting-an-ai-assistant-to-your-notes-mine-could-have-read-my-passwords", "title": "Connecting an AI assistant to your notes? Mine could have read my passwords", "summary": "A connector linking Anthropic's Claude Duet research preview to a personal notes vault could read a credentials folder and settings files holding keys for other services, because the server's only access check was whether a requested file sat inside the vault, according to a first-person connector check by operational resilience practitioner Jamie Watters. The connector's sole lock was a secret web address that had been written into its own log file 47,818 times by the morning of the 1 November check, plus a project note in a private code repository and two test files. Watters locked the connector down the same morning so it refused the credentials and settings files while still returning an ordinary note, and advises rotating any key that was ever written down, since the old address still works and remains in old log lines.", "body_md": "# Connecting an AI assistant to your notes? Mine could have read my passwords\n\nJamie Watters\n\nOperational resilience and AI delivery practitioner.\n\nI was about to give an AI agent that keeps working when I step away a key to my second brain: the notes vault where I keep my plans, my tasks and everything I've filed. The key was a connection I already use. Before I handed it over, a check ran that had been waiting six days. It found the key opened more than my notes. It also opened the files where my other tools keep their passwords and keys.\n\nThe agent is Claude Duet, which Anthropic opened as a research preview on 21 October. I'm piloting it. Anthropic says it \"keeps working even when you step away\" and checks your connected accounts \"every few hours\". The part that matters here is how you set it up: it \"carries over your memory, skills, and connected apps from your Claude account\" (Anthropic, 2026). Whatever you've already connected, it gets.\n\nOne of my connected apps is a link that lets Claude read and write my notes from my phone and the Claude app. On 26 October another AI agent flagged that the link could read my whole vault, credentials included. It hadn't been confirmed. That went down as an issue, due to be checked by Saturday 31 October. Saturday came and went. It wasn't checked.\n\nOn Sunday 1 November, with Duet waiting, an agent ran the check first.\n\n*Raised on a Monday, due on the Saturday, checked on the Sunday.*\n\n## What the check found\n\nMost of the warning was true (Connector check, 2026).\n\nThe link could read any file in my notes vault, of any type. Inside that vault sat a credentials folder and settings files holding keys for other services, one of them with 21 entries. The only test the server ran on a request was whether the file sat inside the vault. Those files did.\n\nIts only lock was a secret web address. No password, no sign-in. Anyone holding the address could read and write.\n\nAnd the address wasn't secret. The server wrote it into its own log file every time the link was used: 47,818 times by the morning of the check (Connector check, 2026). Anyone who could open that file on that machine had the address. It also sat in a project note saved to a private code repository, and in two test files.\n\nSo the risk wasn't a clever break-out from the folder. That was blocked. It was what already sat inside the folder I'd shared. Look there first in yours.\n\n## Why the agent's own safeguards wouldn't have caught it\n\nDuet asks you first before it sends a message, makes a payment, signs a document or deletes anything. Reading isn't on that list: \"Claude Duet reads, drafts, and prepares work on its own\" (Anthropic, 2026).\n\nAnthropic also built it so it \"never directly sees your passwords or sign-in tokens\". My link would have shown it mine anyway, as the contents of a file, without asking me first.\n\nMy link felt safe because its address was long and random. But a secret address is only as secret as every place it gets written down, and mine was written down in four places I hadn't thought about.\n\n## The fix, the same morning\n\nHere's the test that checked the fix, and you can run it on your own connection today: ask it for a file it shouldn't hand over. After the agent locked mine down that morning, before Duet got anything, it asked the live link for my credentials file and my settings file with keys. Both were refused. An ordinary note still came back (Connector check, 2026).\n\nIf a link or key of yours has ever been written down somewhere it shouldn't, tightening the lock isn't enough. Change the key. My old address still works, and still sits in the old log lines, the repository note and the test files. Changing it is what makes those copies worthless.\n\n## Six checks before you connect yours\n\nYou don't need to read code to run these. Each one is a single question to the agent, a search of your own files or a look at a settings page. The first one alone would have caught mine. Don't connect until every answer is a pass.\n\n1. What can it read? Before the agent gets the connection, ask the AI app it's already connected to (for me, Claude) to open a password export or a settings file with keys. Pass if it can't.\n2. Are any keys in what you share? Search for passwords, keys and recovery codes. Pass if there are none.\n3. Does it need your sign-in? Think back to connecting it. Pass if it made you sign in, not if pasting a web address was all it took.\n4. Where is the secret written down? Search your notes and emails for the link. Pass if it's only in your password manager.\n5. Can you cut it off? Pass if you find the disconnect switch in under a minute.\n6. What can it do without asking? Ask the agent. Pass if nothing on its list surprises you.\n\nMine still fails the third check: there's no sign-in, just the secret address. I haven't changed the address yet. It's due by 4 November, and until then the old one sits in 47,818 lines of a log (Connector check, 2026).\n\nDuet still doesn't have the link.\n\n## Sources\n\n- Anthropic, \"Introducing Claude Duet\", 21 October 2026: [https://claude.com/resources/articles/claude-duet](https://claude.com/resources/articles/claude-duet)\n- Connector check, 1 November 2026: my own record of the check and the fix, run by an AI agent. Not published, because it names the files and addresses involved.", "url": "https://wpnews.pro/news/connecting-an-ai-assistant-to-your-notes-mine-could-have-read-my-passwords", "canonical_source": "https://jamiewatters.work/journey/ai-agent-keys", "published_at": "2026-11-01 18:32:24+00:00", "updated_at": "2026-11-01 20:22:15.261281+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools"], "entities": ["Anthropic", "Claude Duet", "Jamie Watters"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/connecting-an-ai-assistant-to-your-notes-mine-could-have-read-my-passwords", "markdown": "https://wpnews.pro/news/connecting-an-ai-assistant-to-your-notes-mine-could-have-read-my-passwords.md", "text": "https://wpnews.pro/news/connecting-an-ai-assistant-to-your-notes-mine-could-have-read-my-passwords.txt", "jsonld": "https://wpnews.pro/news/connecting-an-ai-assistant-to-your-notes-mine-could-have-read-my-passwords.jsonld"}}