# Connecting an AI assistant to your notes? Mine could have read my passwords > Source: > Published: 2026-11-01 18:32:24+00:00 # Connecting an AI assistant to your notes? Mine could have read my passwords Jamie Watters Operational resilience and AI delivery practitioner. I was about to give an AI agent that keeps working when I step away a key to my second brain: the notes vault where I keep my plans, my tasks and everything I've filed. The key was a connection I already use. Before I handed it over, a check ran that had been waiting six days. It found the key opened more than my notes. It also opened the files where my other tools keep their passwords and keys. The agent is Claude Duet, which Anthropic opened as a research preview on 21 October. I'm piloting it. Anthropic says it "keeps working even when you step away" and checks your connected accounts "every few hours". The part that matters here is how you set it up: it "carries over your memory, skills, and connected apps from your Claude account" (Anthropic, 2026). Whatever you've already connected, it gets. One of my connected apps is a link that lets Claude read and write my notes from my phone and the Claude app. On 26 October another AI agent flagged that the link could read my whole vault, credentials included. It hadn't been confirmed. That went down as an issue, due to be checked by Saturday 31 October. Saturday came and went. It wasn't checked. On Sunday 1 November, with Duet waiting, an agent ran the check first. *Raised on a Monday, due on the Saturday, checked on the Sunday.* ## What the check found Most of the warning was true (Connector check, 2026). The link could read any file in my notes vault, of any type. Inside that vault sat a credentials folder and settings files holding keys for other services, one of them with 21 entries. The only test the server ran on a request was whether the file sat inside the vault. Those files did. Its only lock was a secret web address. No password, no sign-in. Anyone holding the address could read and write. And the address wasn't secret. The server wrote it into its own log file every time the link was used: 47,818 times by the morning of the check (Connector check, 2026). Anyone who could open that file on that machine had the address. It also sat in a project note saved to a private code repository, and in two test files. So the risk wasn't a clever break-out from the folder. That was blocked. It was what already sat inside the folder I'd shared. Look there first in yours. ## Why the agent's own safeguards wouldn't have caught it Duet asks you first before it sends a message, makes a payment, signs a document or deletes anything. Reading isn't on that list: "Claude Duet reads, drafts, and prepares work on its own" (Anthropic, 2026). Anthropic also built it so it "never directly sees your passwords or sign-in tokens". My link would have shown it mine anyway, as the contents of a file, without asking me first. My link felt safe because its address was long and random. But a secret address is only as secret as every place it gets written down, and mine was written down in four places I hadn't thought about. ## The fix, the same morning Here's the test that checked the fix, and you can run it on your own connection today: ask it for a file it shouldn't hand over. After the agent locked mine down that morning, before Duet got anything, it asked the live link for my credentials file and my settings file with keys. Both were refused. An ordinary note still came back (Connector check, 2026). If a link or key of yours has ever been written down somewhere it shouldn't, tightening the lock isn't enough. Change the key. My old address still works, and still sits in the old log lines, the repository note and the test files. Changing it is what makes those copies worthless. ## Six checks before you connect yours You don't need to read code to run these. Each one is a single question to the agent, a search of your own files or a look at a settings page. The first one alone would have caught mine. Don't connect until every answer is a pass. 1. What can it read? Before the agent gets the connection, ask the AI app it's already connected to (for me, Claude) to open a password export or a settings file with keys. Pass if it can't. 2. Are any keys in what you share? Search for passwords, keys and recovery codes. Pass if there are none. 3. Does it need your sign-in? Think back to connecting it. Pass if it made you sign in, not if pasting a web address was all it took. 4. Where is the secret written down? Search your notes and emails for the link. Pass if it's only in your password manager. 5. Can you cut it off? Pass if you find the disconnect switch in under a minute. 6. What can it do without asking? Ask the agent. Pass if nothing on its list surprises you. Mine still fails the third check: there's no sign-in, just the secret address. I haven't changed the address yet. It's due by 4 November, and until then the old one sits in 47,818 lines of a log (Connector check, 2026). Duet still doesn't have the link. ## Sources - Anthropic, "Introducing Claude Duet", 21 October 2026: [https://claude.com/resources/articles/claude-duet](https://claude.com/resources/articles/claude-duet) - Connector check, 1 November 2026: my own record of the check and the fix, run by an AI agent. Not published, because it names the files and addresses involved.