A read-only AI can find patterns across email, journals, tasks, CRM records, browser sessions, and notes without changing any of those sources.
2
Cross-source analysis can reveal intention-action gaps, attention drift, relationship decay, and neglected projects that individual apps cannot see.
3
Read-only systems reduce the cost of mistakes and keep the user's data closer to an observation of their own behavior, although they still carry serious security risks.
Summary
Šimon Podhajský presents a personal AI system with read access to six data sources and no permission to modify them. The system collects digital traces of his activity, then analyzes them across sources to produce weekly reflections, identify projects he is avoiding, and suggest people to contact about what he is reading. He argues that the value comes from observing patterns that no single application can see. Read-only access also changes the risk calculation: an incorrect analysis can be ignored, while an incorrect email or calendar action can damage relationships, work, or reputation. Podhajský also says write access contaminates the data being observed because the system becomes part of the user's behavior. He is open about the remaining risks, including the mosaic effect, data sent to Anthropic, untrusted content, and shell access. The talk makes a practical case for treating personal observers as a separate product category from agents.
Digital exhaust reveals patterns that individual apps cannot see
Podhajský calls the digital activity produced by thinking and working "cognitive exhaust fumes." A single trace may look like waste, but the combined traces can reveal how the underlying person is operating. He names intention-action gaps, attention drift, and relationship decay as three uses. Email does not know what was written in a journal, and a task manager does not know what was browsed. The useful signal appears when those sources are considered together. His system starts with six read-only sources and sends the analysis into a separate workspace, such as an Obsidian vault, Notion, or text files. The sources remain unchanged throughout the process.
A weekly reflection can turn activity data into a difficult personal review
The first application is a David Allen-style weekly reflection. A Claude command launches a Python script, gathers data from the read-only sources, and asks prepared prompts to create structured outputs. Those outputs become a Markdown document that Podhajský reviews in Cursor. The resulting reflection covers the themes, tensions, conflicts, commitments, relationships, notable moments, and questions raised by the week. He says the omissions around commitments and relationships can be especially revealing. This is not a productivity report that counts completed work. It is an account of how he spent and thought about the week, assembled from traces produced by his normal digital activity.
Cross-source queries can suggest useful conversations without sending anything
Podhajský uses a second application to answer a personal question: given what he has been reading, who in his network might want to discuss it? The query combines browser history, article-reading data, and a relationship or CRM system. A Vivaldi SQLite database identifies articles he reads often or leaves open, while Clay searches his contacts for people interested in related areas such as AI, European technology, or education. The system then maps possible contacts to individual articles. It even finds an author of one article who is already in his network. The result is only a suggestion. No message is sent and no meeting is scheduled.
Read-only access makes mistakes cheap while write mistakes can damage a life
Podhajský describes the risk as asymmetric. If a read-only analysis is wrong, he can ignore it. If an AI sends a wrong email or makes another incorrect change, the consequences can affect relationships, career, and reputation. He would rather miss an automated email than have a misfire damage his life. This argument depends on the setting: personal AI operates on information and actions with real social consequences. The system still produces useful outputs because it gives him observations and suggestions while leaving the decision with him. The boundary is simple: the AI can inspect his sources, but it cannot act in them.
Podhajský gives a second reason to keep the system read-only. Once an AI writes to the data sources, the digital exhaust is no longer a clean observation of his behavior. It becomes a record of a human-AI hybrid, making it harder to tell which patterns came from him. He accepts that reading an AI reflection also changes behavior, but the feedback loop passes through his own decision. He reads the reflection and chooses what to do. He also argues that people may want to write their own drafts instead of handing that part of their agency to an AI. Read-only access therefore affects the quality of analysis as well as safety.
An observer can produce more useful value than an agent
Podhajský compares an agent that saves a few seconds on a weather check with an observer that reveals he has avoided his most important project for two weeks. The observer operates at a different level. It finds patterns across activity instead of completing an isolated task. He rejects the idea that read-only systems are an early stage on the way to agents. They address a different need and belong to a different product category. In his view, an observer is not a broken butler. It helps him see what is happening, while he remains responsible for deciding and acting on the result.
Cross-referencing personal data creates serious security exposure
The same cross-source access that makes the system useful also creates a strong target. Podhajský discusses the mosaic effect, where many small pieces of information combine into a revealing picture. He also cites Simon Willison's lethal triquetra, which combines private data, untrusted content, and external communications. The system removes some natural ways to exfiltrate information, but shell access still provides an external communication path. Data is sent to Anthropic over a mostly open network, and more information may be present than the task strictly needs. Podhajský does not call the system secure. He says he has examined its weaknesses and chosen which risks to accept.
"I'm not claiming the system is secure. I'm claiming that I've thought about where it isn't, and I've decided which risks I'm willing to carry."10:55
Who should watch
You have personal data spread across email, notes, tasks, browsing history, and relationship records, and want analysis that connects those sources without giving an AI permission to change them.
You are building an agent and need to compare the value of observation with the risks of automated actions in personal or professional systems.
You care about self-review and want to inspect attention drift, neglected commitments, or relationship patterns rather than automate another small task.
