The AI That Only Watches

A confession

Here’s something I only admitted out loud this week: I’d stopped reading my own morning briefs.

I have an agent that assembles one every morning. It reads my calendar, my Slack channels, my reading list, the feeds I follow, and lays out what matters for the day. It’s good. And precisely because it’s good, I quietly outsourced my own attention to it and then stopped opening it. The agent kept reading everything. I stopped. For a busy stretch I was flying on the assumption that “the system has it,” which is a comfortable and slightly dangerous place to be.

That gap is exactly the thing Šimon Podhajský was poking at in a short, easy-to-miss conference talk with a deliberately unglamorous title: Read-Only AI Is Underrated [1]. His premise: build a personal assistant that has no write permissions at all (it can only read a handful of your sources) and point it at your “cognitive exhaust,” the digital byproduct of your own thinking. Email you sent. Notes you took. Tasks you opened and never closed. Things you said you’d do.

The read-only constraint isn’t a safety compromise you accept reluctantly. It’s what, for me, makes the thing trustworthy enough to point at your entire life.

What “cognitive exhaust” actually is

Every knowledge worker leaves a trail. Not the polished output. The exhaust. The half-written note. The three tabs left open for a week. The message you starred and never answered. The calendar block you keep moving. Individually these are noise. In aggregate they are a remarkably honest record of where your intention and your action have drifted apart.

A read-only assistant’s job is to read that exhaust and surface the gaps:

• Intention–action gaps: you said (in a note, a message, a task) you’d do a thing, and the trail shows you didn’t.
• Attention drift: what you meant to focus on this week versus where your time actually went.
• Relationship decay: people you used to talk to weekly who’ve fallen off, with no decision to let them.

None of that requires the assistant to do anything. It requires it to notice, which is the part I’d stopped doing for myself. (I’ve written before about treating your own notes and trail as a queryable system rather than a pile of files [2].)

Why the limitation is the feature

We’ve spent two years measuring assistants by how much they can do. More tools. More autonomy. Longer agent runs. The implicit scoreboard is agency. And agency is genuinely useful — I build agents that act, and I’ll keep doing it. But agency is also where the irreversible risk lives:

• An assistant with write access to your inbox can send the wrong thing to the wrong person.
• An assistant with tool access is an attack surface — a poisoned document or web page can try to steer it into doing something you never asked for.
• An assistant that acts on your behalf forces you to supervise it, which is its own tax on attention.

A read-only assistant has none of those failure modes, for a boring reason: it has nothing to do. You can point it at six of your most private sources precisely because it can’t act against them. The worst thing it can do is show you a pattern you didn’t want to see. Measured in actions, the blast radius of a read-only system is a conversation.

That is not the same as no risk, and it’s worth being precise. Pointing a model at six private sources still means broad read access, and a poisoned note or web page it ingests can still skew what it tells you — indirect prompt injection through retrieved content is a documented attack class, not a hypothetical [3]. What read-only removes is the worst case in this threat model, action on your behalf: it can’t act on the manipulation. It can’t be prompt-injected into sending the thing or deleting the thing, because it has no send and no delete. The reading surface stays broad, but what an attack can achieve shrinks to “it might mislead you in a summary,” which you can sanity-check, instead of “it might take an irreversible action on your behalf.”

This is the same trade I keep coming back to in my own setup. The parts of my agent stack that write (file to Salesforce, edit the vault, post a draft) I watch closely and gate carefully. The parts that only read and summarize, I trust almost blindly. And it turns out the read-only parts are where most of the day-to-day value actually is.

Observe, don’t act — as a design stance

There’s a broader pattern here that’s worth naming. We tend to think of the “assistant” and the “agent” as the same thing on a maturity curve: the assistant answers, the agent acts, and acting is the grown-up version. Podhajský’s talk is a useful reminder that those are two different products with two different risk profiles, and the observe-only one has been underbuilt because it’s less impressive in a demo.

“Look, it noticed you’ve been ignoring your morning brief” is a worse demo than “look, it booked the meeting for you.” But in daily use, the noticing is what changes behavior. The booking just moves work around.

If you want to try the idea without building anything: point whatever assistant you already have at a read-only slice of your own exhaust (last week’s sent mail, your open tasks, your notes from the last ten days) and ask it exactly one question. Where did what I said I’d do and what I actually did come apart? Give it no ability to fix anything. Just let it tell you.

One question, not twenty. A read-only assistant that hands you an exhaustive list of everything you’ve dropped just becomes another feed you’ll learn to ignore, the same way I learned to ignore my morning brief. The value isn’t a complete audit of your failings. It’s a small number of gaps that actually move you. That single read-only loop is, in my experience, worth more than most of the write-enabled automation I’ve built.

The upgrade nobody’s selling

The market is selling you more permissions. The upgrade that actually helped me this month was fewer: an assistant whose entire job is to watch my own trail and tell me when I’ve drifted from it — including, apparently, when I’ve drifted from reading the assistant that watches everything else.

Read-only isn’t the training-wheels version of an AI assistant. For a whole class of “help me see myself clearly” problems, it’s the finished one.

So here’s my question for you: if you gave your assistant zero ability to act and pointed it only at your own cognitive exhaust — what’s the first uncomfortable gap you think it would surface?

Sources

• [1] Cognitive Exhaust Fumes: Read-Only AI Is Underrated — Šimon Podhajský (AI Engineer, Apr 2026) — the talk this post responds to.
• [2] Your Obsidian Vault Is a Knowledge Graph — my own prior work on treating your notes/exhaust as a queryable system.
• [3] Greshake et al., “Not what you’ve signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection” (arXiv:2302.12173) — the indirect-prompt-injection attack class: adversaries injecting instructions into data an LLM application retrieves.

About the Author

Stefan Christoph is a Principal Solutions Architect at AWS, focused on agentic AI, media & entertainment, and helping builders move from demo to production. He writes about AI architecture, developer productivity, and the future of software.

This is a personal blog. Opinions expressed here are my own and do not represent the views or positions of my employer.

Learn more →

• AgenticAI
• ToolsForThought
• HumanInTheLoop