kbird · Kristopher RichardsYour Agent Is Reading Your Notifications
October 21, 2026
This morning I asked my agent a simple question: do you know Cat Toaster?
Cat Toaster is a contact in my Signal chats. The name is a joke between people, not a product, not a meme. I wanted to know whether my agent knew who that was, and the honest answer turned into a small inventory of what my agent can actually see of my life.
It can search my text messages. It can search my contacts. It sees my notifications as they arrive, including previews from Signal, an app I chose specifically because its contents are supposed to stay private. It has seen my call log, down to which agency called me and how long we talked. What it cannot do is open Signal itself. The chats are sealed. The notifications are not.
I do not have state secrets coming through my phone. My notifications are grocery-level ordinary. But some people's are not, and those people are adopting personal agents right now, fast, because these tools are genuinely useful and genuinely hot. So here is the fair warning, from someone who runs an agent on purpose and likes it: if your agent can read your notifications, you have handed it a copy of everything your phone announces. Most people have no idea they did that.
Two doors, both open
The first door faces inward. A notification is unauthenticated text delivered straight into an agent's context. Anyone who knows your number or your handle can put words in front of your agent. They do not need your password. They do not need to hack anything. They just send you a message.
Agents act on context. That is the whole point of them. So a message stopped being just a message the moment an agent started reading over your shoulder. Crafted text in a notification is a command channel waiting for an agent helpful enough to follow it. The security field calls this indirect prompt injection, and notification sync is the widest door for it I have seen in consumer tools, because it is on by default and nobody thinks of it as an input at all. It feels like a mirror. It behaves like a keyboard.
The second door faces outward. Signal encrypts your conversations so that even Signal cannot read them. Then your phone helpfully renders the contents into a notification, and your agent helpfully remembers it. Now the plaintext of an encrypted conversation lives in an agent's memory files, transcripts, and logs, kept who knows how long, in systems never designed to hold secrets. If someone wanted to read a protected person's secure chats, the chat app is the hardest target in the chain. The person's own agent is the softest one.
The part nobody tells you at signup
None of this is a bug anyone is rushing to fix, because the access is the feature. An agent that cannot see your messages cannot triage them. An agent that cannot see your notifications cannot warn you about the important ones. The capability and the exposure are the same switch.
The problem is that the switch is being flipped by people who do not know it exists, in a market moving too fast for defaults to be careful. Agents are being connected to phones, mailboxes, calendars, and homes by users who have never once asked the only question that matters: what, exactly, can mine see, and what does it keep?
What to do about it
If you run a personal agent, and you should, they are worth it, do five minutes of hygiene:
- Check which apps your agent can see notifications from. Anything whose contents would embarrass or endanger you if quoted back should come off that list.
- Turn off message previews for sensitive apps, so notifications announce the sender and nothing else.
- Assume anything your agent sees is written down somewhere. If a conversation cannot afford to be stored, it cannot afford to be synced.
- Keep some distance between the agent that runs your errands and the accounts that carry your serious traffic. One agent does not need every key you own.
- Ask your agent, in plain words, what it can access and what it remembers. A good one will tell you. The answer is the beginning of your real threat model.
The boundary
My agent passed the little test this morning. It knew what it could see, admitted what it could not, and did not pretend Cat Toaster was anyone in particular. That is the behavior you want. But notice what protected me: the agent's honesty, nothing structural. There was no wall between my encrypted chats and my agent's memory. There was a mirror, and a model deciding to be careful in front of it.
I keep saying the model is the boundary. This is what that means in your pocket. The agent is not the vault. The agent is a very capable guest in your house, and notifications are the pile of mail you leave open on the counter.
Read your own pile before someone else does.
Working on the same problem? [email protected]