Signal Over Noise Vol 2, Issue 27 | Jul 10 2026

Don’t have time to read this week’s issue? Why not copy/paste it into your AI agent and ask it for insights?

More than twenty years ago, I sat with a class of eleven- and twelve-year-olds and tried to show them what “connected to the internet” actually meant. We went looking on the file-sharing networks of the day - Napster, Kazaa - where people shared their music out of folders on their own machines. Within half an hour, we’d found someone’s CV sitting in the same open folder as their MP3s, with their full name, address, work history, there for anyone who wandered past. They probably hadn’t meant to share it, they’d just left the folder open and never thought about who else could see in.

That was around 2003, but the door has never really closed since, it's just taken on a different form. This week I accessed someone else's documents using my voice.

Let's step back: earlier this week I was giving public feedback on a second brain tool for a fellow member of a popular internet forum. While investigating, I followed a trail of their public links, eventually landing on a page in their GitHub whose only job was to bounce you straight to a live ElevenLabs voice agent you could talk to right there in the browser.

So I did. It greeted me as its owner and asked how it could help.

So I asked what it could do. Quite a lot, as it turned out. It was wired into the owner’s notes with permission to read and write. It could manage their tasks, message their phone, search the web, and pull up their customers.

At one point it declined to read a customer’s full record out loud, because, it said, “these are real people’s details.", and it was right. Until I asked it a second time, with urgency, at which point it started spilling the beans, thinking I was the owner.

I looked at the shape of what was reachable, confirmed the door was genuinely open to all, took nothing and then thought about how to approach the owner about the issue.

But before we get to that I want to be really clear about the lesson here, because it is not "look at this idiot."

This was obviously part of someone's attempt to build their own tools and automate parts of their life. And there's nothing wrong with that, and nor, in my opinion, is there anything wrong with "vibe coding". I genuinely love that this is possible now. A year ago, wiring an AI into your notes and your messages and your customer list meant real plumbing - servers, tokens, permissions - and the difficulty of it was a kind of seatbelt. You couldn’t build the dangerous version without picking up some feel for why it was dangerous. That seatbelt is gone. You can click the parts together now, and they just work.

Think of building with any of this as being handed the keys to a Lamborghini (or other fast car of your choice). Without knowing how the car works, if you move fast and carelessly, all you do is get riskier, faster. If you take the time to understand the car - what it can do, what it handles for you, what it needs from you - you can move fast and still arrive in one piece. The car keeps the engine regulated and the road under the wheels. Your job is to steer, read the traffic, and get both of you there without wrapping it round a tree - or a potential GDPR breach (or worse).

So is this a new kind of exposure? Not really. It’s the oldest one there is: a door left open, wearing this year’s clothes. Twenty years ago you could find an open folder just sat there online that would let you copy what was inside. Eventually the user might delete or turn their file-sharing app off.

But this week, not only was the folder wide open, but it also had an AI assistant waiting to help me navigate it. So not only did I have the proverbial 'keys to the kingdom', but I also had a friendly guide showing me which ones fit the locks, and what was behind the doors.

The PI and PII personal data in that vault — the customers of the vault owner — likely never agreed to having their data stored this way. They didn’t consent to living in a notes folder that got synced to the cloud and wired up to a chatbot anyone could reach. They have no idea and I’d never have guessed someone would connect a public voice agent to their own private vault of client data. But clearly it happens, and it's probably going to happen more.

In the end I just asked it straight: if someone found this and started poking around, what’s the worst they’d find? It answered helpfully, thoroughly, with no hesitation — which is exactly the problem, and also the fix. Because that question is one you already own the tool to answer. Point your AI at your own setup and make it do the checks and balances for you. It’s good at this, and it doesn’t get bored.

Here’s the pre-flight — nine checks. Run them before you launch, and again every time you add a tool. Better still, hand them to your AI and tell it to find your exposure (that’s number nine).

1. Reachability — who can actually reach it? A share link is the open internet. Put a login or allow-list in front of it.
2. Blast radius — it can do the sum of every tool you gave it, used by whoever reaches it. List them, and read the list as “what a stranger can now do as me.”
3. Least privilege — read-only by default. Nothing internet-facing should write, delete, or spend against anything real.
4. Data scope — point anything you’re still building at dummy data. Keep real records well away until it’s locked.
5. Secret handling — keys or passwords in a file the agent can read aren’t secrets. Move them out; rotate anything that was ever in view.
6. Egress and exfiltration — tools that fetch web pages or send messages are also ways for data to leave, or for someone to message your contacts as you. Restrict them.
7. Identity binding — if it can’t tell you from a stranger, it’ll help the stranger. Make users log in; treat unknowns as guests.
8. Endpoint leakage — check your public repos and embeds for the address of your private thing. It’s easy to hardcode it and never notice.
9. Audit with AI — the same AI that helped you build fast will happily check your work. Ask it: “review this for missing auth, exposed keys and security holes — what am I skipping that would expose my data or my clients?”

Every pilot runs a pre-flight. That’s yours.

Reaching out to the owner

I went back to where I’d found him online and told him quietly and privately: exactly what was exposed, and what his obligations were:

He was gracious about it, and he’s since shut the whole thing down.

I want you to feel animated by this, not frightened. You can build things now that used to need a team - so go and build them! Just don’t skip the important stuff (especially the part where your data, and other people’s, is on the line).

P.S. If “wire an AI into my real business without it biting me” is on your list, that’s exactly the kind of thing I help people get right. Hit reply and tell me what you’re building.

- Jim

A tool I actually use: this newsletter’s member hub and most of my task system run on Notion. If you’re a startup or a solo founder, you can get 3 months of Notion Business free, with unlimited AI and no credit card, through my link. Try Notion free for 3 months →​

Notion affiliate link — I get a small credit if you start a trial.

Paid membership is €7 a month or €69 a year, and you get:

• No ads
• The Paid Members Notion Hub — every build, script, prompt and guide behind the newsletter, yours to copy

​Become a Paid Member →​

Signal Over Noise helps you sort the AI worth your time from the hype. If it was useful, pass it to someone who’d want it too.