Talk by Šimon Podhajský (Head of AI, Waypoint) presenting a personal read-only AI system that queries personal data sources — email, journal, tasks, CRM, browser sessions, and notes — without modifying them. He argues the read/write trust asymmetry matters (reads are safe, writes dangerous), that cross-source pattern detection is more valuable than task automation, and that analyzing one's "cognitive exhaust fumes" beats building another action-oriented AI assistant. A GitHub template for the personal intelligence system and slides are referenced. # Channel Presentation Observations — Video `01a15ca9-ba27-75e0-876a-d51cb5789340` ## Video Identity - **Title:** "Cognitive Exhaust Fumes, or: Read-Only AI Is Underrated — Šimon Podhajský, Head of AI, Waypoint" - **Format evidence:** Speaker-led talk with slide references ("My own slide copy describes the security risk perfectly") and live demos ("Let me once again show you the demo"), consistent with a conference or meetup presentation. ## Explicit Self-Description - **Named speaker and role:** Title and transcript establish the presenter as **Šimon Podhajský, "Head of AI, Waypoint"** (title metadata; transcript self-introduction "Hi, my name is Shimon"). - **Speaker self-positioning:** He frames himself as building against the grain of the field: > "The whole personal AI space is obsessed with agents that act on your behalf. I built something different." - **Coined terminology:** The speaker claims authorship of a term: > "Cognitive exhaust fumes... It's my term for the digital activity that is a byproduct of your cognition." - **Security stance claim:** He explicitly disclaims security perfection: > "I'm not claiming the system is secure. I'm claiming that I've thought about where it isn't, and I've decided which risks I'm willing to carry." ## Intended Audience - **AI-savvy, tool-using practitioners:** The talk assumes familiarity with Claude skills, MCP servers, Cursor, Obsidian, Notion, SQLite databases, bash, and API token/context-window management ("this takes up a lot of tokens in the context window... the 1 million context window for 4.6"). - **An audience presumed to favor agents:** He anticipates disagreement: > "you don't want the AI to write your draft in the first place... Might be a hard sell for this crowd, I think" — indicating an audience inclined toward agentic AI. - **Security-aware listeners:** References to "Simon Willison's lethal triquetra" and "the mosaic effect" without full explanation assume prior exposure to AI security discourse. ## Claimed Scope of Content - **Personal AI systems design:** Demonstrates a read-only personal AI ("Fulan") built on **six sources, read access only, no write permissions**, with outputs landing in a separate Obsidian vault ("It could be separate Notion, separate text files, separate anything"). - **Applied use cases shown:** - Weekly reflection: a GTD-style synthesis producing "an occasionally brutal reflection on how you spent your week." - Cross-source network matching: querying "Given my recent reading, who in my network should I be discussing this with?" using browser history, CRM ("Clay"), and other sources. - **Risk analysis:** Explicit coverage of mosaic effect, lethal triquetra, exfiltration risk, and asymmetry of write errors: > "The downside of a read-only error is zero... The downside of a write error is unbounded." ## Demonstrated Presentation Patterns (Observable, Not Claimed) - **Opinionated, contrarian framing:** Positions read-only AI as "a different product category" and argues "the industry frames read-only as a limitation you graduate from. I think that's wrong." - **Show-your-work technical transparency:** Walks through implementation details (Python scripts, Claude skills, slash commands, Vivaldi SQLite, Clay MCP, bash "sorcery"), including admitting weaknesses: > "this is probably the weakest part. The Clay MCP takes forever to run." - **Balanced, risk-aware tone:** Ends with a "paranoid hat" section deliberately surfacing his own system's vulnerabilities, closing with: > "The worst security posture is the one you haven't examined." - **Philosophical/reflective layer beyond tools:** Discusses agency and human-AI boundaries: > "You're no longer observing your cognition. You're observing a human-AI hybrid." ## Notes on Evidence Boundaries - No curated metadata was supplied beyond the title; all audience and scope observations derive from the transcript. - The "Head of AI, Waypoint" affiliation appears only in the title; the transcript itself does not restate it. - No statements were made about the channel itself (e.g., subscriber base, upload cadence, or channel mission); identity conclusions must stay at the level of this single presentation. # Delivery Observations: Šimon Podhajský — "Cognitive Exhaust Fumes, or: Read-Only AI Is Underrated" ## Tone & Register - **Conversational, first-person, low-key.** The talk is framed around personal experience: "I built something different," "The three top uses I've found," "I'd rather miss out on automated emails than have a misfire nuke my life." - **Wry, dry humor.** Casual asides appear throughout: "occasionally brutal reflection," "the AI knows you, but won't blow up your life," "a FRM" (friend relationship manager), "Thank you, Claude." - **Direct, honest hedging.** He openly flags weaknesses rather than overselling: "Now, this is probably the weakest part," "the system isn't fireproof, and I'm not claiming that it is." ## Vocabulary & Signature Terms - **Invented/coined terminology, explained via metaphor:** - > "Cognitive exhaust fumes... it's my term for the digital activity that is a byproduct of your cognition." - > "Like exhaust fumes for a car engine, individually, it's just waste, but if you analyze the exhaust, you can diagnose the engine." - **Technical vocabulary assumed familiar:** "Claude skill," "slash command," "MCP," "SQLite database," "context window," "auto mode, or dangerous disk permissions," "bash sorcery." - **Borrowed external frameworks named explicitly:** "David Allen style getting things done," "Simon Willison's lethal triquetra," "the mosaic effect." ## Recurring Phrases & Patterns - **Repetition of the core constraint** — "read-only" / "read access only" recurs as an anchor phrase: - > "six sources, read access only, no write permissions" - > "The sources are read-only. The AI never writes back to them." - > "And all read-only. Nothing was sent. Nothing was scheduled." - **Antithesis as a rhetorical habit** — paired contrasts drive the argument: - > "The downside of a read-only error is zero... The downside of a write error is unbounded." - > "The agent saves me 30 seconds on a weather check. The observer shows me I've been avoiding my most important project for 2 weeks." - > "Observers and agents are different tools, and mayor isn't a broken butler." *(uncertain transcription; likely "an observer isn't a broken butler")* - **Parallel triads:** "intention action gaps, attention drift, and relationship decay"; "private data, untrusted content, and external communications"; "Your relationships, your career, your reputation." ## Teaching Habits & Structure - **Signposted roadmap:** "Let's get started... What does this enable you to do?... Let's take a closer look at the system... So, what about applications?" - **Metaphor extended across the talk:** the exhaust-fumes metaphor is recalled late: "It's a reflection on how you're thinking, assembled entirely from exhaust." - **Live demo narration with pacing acknowledgments:** - > "This takes a little bit of a while." - > "the Clay MCP takes forever to run" - > "This is now uh finished running" - **Anticipated objection / self-Q&A:** "At this point, you might be asking, 'Why not throw all this into open Claude on a read-only mount?' Which I have." - **Deliberate reframing of contrarian position toward the audience:** "Might be a hard sell for this crowd, I think, but worth considering." ## Filler & Disfluency - Occasional "uh" and "um" cluster in unscripted demo moments: "uh in plain language," "the articles um are most read." - Audience-audible reactions transcribed: "[snorts]," "[sighs]" — suggesting informal, spontaneous delivery during demos. ## Stable Patterns vs. Isolated Moments - **Stable (repeated):** read-only emphasis, contrast rhetoric, metaphor callbacks, self-deprecating honesty about limitations. - **Isolated:** the opening safety framing ("won't blow up your life") appears once; the "paranoid hat" framing is a single rhetorical turn: "Let's put on the paranoid hat." - **Uncertain:** speaker's tone of voice cannot be inferred from transcript alone; all tonal claims above rest on word choice and phrasing, not vocal delivery. # Position Record: "Cognitive Exhaust Fumes, or: Read-Only AI Is Underrated" **Speaker:** Šimon Podhajský, Head of AI, Waypoint (identified in video metadata; speaker self-identifies as "Shimon") ## Core Thesis - The speaker built a **personal AI system that observes but never acts** — it "knows you, but won't do anything instead of you or on your behalf, and won't blow up your life." - He argues the personal AI space is wrongly "obsessed with agents that act on your behalf"; his system is **read-only by fully intentional design**: six sources, read access only, no write permissions. ## Key Concept: Cognitive Exhaust Fumes - Speaker's own term: **digital activity that is a byproduct of your cognition**. - Analogy: like car exhaust fumes — individually waste, but analyzable to **diagnose the engine** (your thinking). ## The System ("Fulan") Three zones: 1. **Sources** — read-only; "the AI never writes back to them." 2. **Workspace** — where analysis happens. 3. **Output vault** — a separate Obsidian vault (though he notes it could be Notion, text files, "separate anything"). ## Claimed Use Cases - **Top three uses:** intention-action gaps, attention drift, relationship decay. - **Cross-source signal is the product:** "Your email client doesn't know what you journaled. Your task manager doesn't know what you're browsing." No single source reveals these patterns. - **Weekly reflection (David Allen / GTD-style):** AI synthesizes an "occasionally brutal reflection" — covers themes, tensions, commitments/relationships ("mostly notable by its omissions"), notable moments, and reflection questions. Runs in Claude via a custom skill launching a Python script against the read-only sources, calling the Anthropic API for structured outputs. Speaker's characterization: "not a productivity report. It's a reflection on how you're thinking, assembled entirely from exhaust." - **Network matching for reading discussions:** Asked "Given my recent reading, who in my network should I be discussing this with?" — combines four data sources, including the Vivaldi SQLite browser database and a Clay CRM ("or my friend relationship system… FRM") to map contacts to articles. Speaker notes: - The **Clay MCP is "probably the weakest part"** — takes forever to run. - Heavy token usage — "you probably don't want to do this in a session that is not clean." - Nothing sent or scheduled: "Just a suggestion for me to act on if I choose." - It even identified an article author within his network. - Conclusion: "Your browser doesn't know your contacts. Your CRM doesn't know what you're reading. The exhaust does." ## Stated Reasons for Read-Only Design ### 1. Asymmetric risk - "The downside of a read-only error is zero. I just ignore it. The downside of a write error is unbounded." - Personal AI operates in high-stakes domains: relationships, career, reputation. - "I'd rather miss out on automated emails than have a misfire nuke my life." ### 2. Epistemic purity (stated as "almost a matter of taste") - Write access **contaminates the exhaust**: "You're no longer observing your cognition. You're observing a human-AI hybrid, and you can't tell which patterns are yours." - Acknowledges the observer effect: "the observer changes your behavior, too, but the feedback loop is mediated by you, not automated." ### 3. Value per interaction - "The observer produces more value per interaction by a wide margin. The agent saves me 30 seconds on a weather check. The observer shows me I've been avoiding my most important project for 2 weeks." - Also claims less risk of exfiltration and cognitive pollution. ### 4. Different product category, not a stepping stone - "Read-only isn't a stepping stone to 'real agents'… It's a different product category." - "The industry frames read-only as a limitation you graduate from. I think that's wrong. Observers and agents are different tools." - He also raises (with acknowledged skepticism about audience reception — "Might be a hard sell for this crowd") the argument that "you should reclaim your agency" and that AI shouldn't write your drafts. - Notes he has tried throwing it into open Claude on a read-only mount — implying agents still compare unfavorably on value. ## Acknowledged Risks (the "paranoid hat") - **Mosaic effect:** aggregating many small pieces yields a revealing picture. "The same cross-referencing that makes the system useful makes it a devastating target." - **Simon Willison's "lethal triquetra"** (private data + untrusted content + external communications): the speaker initially believed his system avoided it, but states **it doesn't fully** — shell access still provides external communication ability. - He explicitly does **not** claim the system is secure: data is sent to Anthropic over a mostly open network, with "a lot more information lying around than is strictly speaking required." - His stated posture: "I've thought about where it isn't [secure], and I've decided which risks I'm willing to carry. It's different from not knowing. The worst security posture is the one you haven't examined." ## Closing Position - "Your digital exhaust is the most underused data set you own. Reflect on it and use it to make yourself better." # Video Attribution & Provenance Record **Video:** Cognitive Exhaust Fumes, or: Read-Only AI Is Underrated — Šimon Podhajský, Head of AI, Waypoint **Video ID:** 01a15ca9-ba27-75e0-876a-d51cb5789340 ## Speakers & Roles | Speaker | Role | Evidence | |---|---|---| | Šimon Podhajský ("Shimon") | **Sole speaker — creator/presenter** | Self-introduction: "Hi, my name is Shimon"; title metadata names him as Head of AI, Waypoint | - No guests, narrators, or other speakers appear in the transcript. - **Note:** Transcript speaker name is rendered "Shimon"; metadata spelling is "Šimon Podhajský." ## Referenced Sources & Third-Party Claims - **David Allen** — "getting things done"-style weekly reflection methodology (named, no direct quotation). - **Simon Willison** — originator of the "**lethal triquetra**" security risk model cited (private data, untrusted content, external communications). Presenter's paraphrase, not direct quote. - **Mosaic effect** — cited security concept; no named originator given in transcript. ## Tools / Products Referenced (by creator, not endorsements verified) - **Claude / Claude skills / Claude Code** (Anthropic API) — runs weekly reflection and cross-source queries. - **Obsidian** — output vault. - **Cursor** — used to preview output. - **Clay MCP** — CRM/"friend relationship system" search; creator flags it "takes forever to run." - **Vivaldi** — SQLite browsing database read as a source. ## Promotional Segments - **None flagged.** No sponsorships, ads, or product promotion identified in the transcript. The creator demonstrates his own system ("Fulan") as a talk subject, not a promotional segment. ## Provenance & Availability Notes - No curated metadata was supplied; comment availability **unknown**. - Demonstrations include creator-run screen demos (weekly reflection, cross-source contact suggestion); outputs shown are the creator's own data. - Creator explicitly disclaims system security: "I'm not claiming that the system is secure" — position statement, not verified fact. - No timestamps were available in the transcript; none were invented. Hi, my name is Shimon. Today, I'll talk about a personal AI system that knows you, but won't do anything instead of you or on your behalf, and won't blow up your life. So, that's good. In the process, I'll talk about the risks of personal AI and how read-only AI systems like this one mitigate them. Let's get started. The whole personal AI space is obsessed with agents that act on your behalf. I built something different. The starting point, six sources, read access only, no write permissions. The limitation is fully intentional. But first of all, what are cognitive exhaust fumes? What are they? It's my term for the digital activity that is a byproduct of your cognition. Like exhaust fumes for a car engine, individually, it's just waste, but if you analyze the exhaust, you can diagnose the engine. So, let's see some examples of what the exhaust reveals. What does this enable you to do? Three top uses I've found, intention action gaps, attention drift, and relationship decay. No single source tells you any of this, and the cross-source ability is what these have in common. Your email client doesn't know what you journaled. Your task manager doesn't know what you're browsing. The cross-source signal is the product. Let's take a closer look at the system. Here it is, Fulan. Three zones. The sources are read-only. The AI never writes back to them. The workspace is where the analysis happens. The outputs land in a separate Obsidian vault for me to review, but it doesn't have to be a separate Obsidian vault. It could be separate Notion, separate text files, separate anything. Could be any other system. And that's the whole thing. So, what about applications? Let's start with a David Allen style getting things done like spin on the weekly reflection. Based on the six sources, the AI synthesizes an occasionally brutal reflection on how you spent your week. Let's look at a real example. Everything runs in Claude. I've stored this logic in the weekly reflection \{slash\} command \{slash\} skill. And what it does is it launches a Python script that gets all the data that come from the read-only sources, and looks through them, and creates structured outputs with specified prompts that I've prepared. This takes a little bit of a while. It pings the Anthropic API to get those structured outputs back. And \[snorts\] once it does, it will create a markdown document that I will be able to review. This is now uh finished running, so it gives me an overview, and I can open it back up in Cursor, and I'll convert it to a preview that's more readable, and see that in fact, it does hit the themes of the week. It does hit some of the tensions and conflicts that I need to think about. Talks about my commitments and relationships, which is mostly notable by its omissions, and highlights the notable moments as well as reflection questions that I like to think about. In short, this is not a productivity report. It's a reflection on how you're thinking, assembled entirely from exhaust. Let's take another example. I like to discuss what I'm reading with others, but sometimes I think I shouldn't keep messaging the same three people about it. So, I asked the AI, "Given my recent reading, who in my network should I be discussing this with?" This is the cross-source magic. Four data sources, none of which were designed to talk to each other, combined into an insight you'd never get from any single tool. And all read-only. Nothing was sent. Nothing was scheduled. Just a suggestion for me to act on if I choose. Let me once again show you the demo. Once again, this is a Claude skill, \>\> \[sighs\] \>\> but in this case, I've hidden most of the guts of the Claude skill into the cross-origin query, and ask for the specific question uh in plain language. The plain language knows that it will auto that it will activate the specific skill for the cross-source queries, and it now goes through the databases that I've curated that I have regular interest for, looks through the Vivaldi SQLite database for the articles that I've been reading the most, and after a while, it will figure out which of these articles um are most read, still open on tabs, and which people might be curious about it based on the profile. Now, this is probably the weakest part. The Clay MCP takes forever to run, but it searches my CRM, or my friend relationship system, I suppose, so FRM, for people who might be interested in articles of on these topics. Um In this case, it's people interested in AI, or people in European tech, or people in education, which coincidentally are three things that I also am. Now, as you might notice, this takes up a lot of tokens in the context window, so you probably don't want to do this in a session that is not clean, but it's not a problem if it messes up a little bit of the 1 million context window for 4.6, and then you clear it again. So, at this point, it's getting the responses from all of the Clay searches. It synthesizes the people that I should talk to, and it maps them to one article each. That's what the or it's about to map them to one article each. Uh this requires a little bit of uh bash sorcery on behalf of Claude code, but if you're running it with auto to auto mode, or dangerous disk permissions, you can get rid of that as well. And indeed, when I take a look at the first results, those look like the people that I might want to talk to that I haven't talked to yet about the kinds of articles that I've been reading. So, thank you, Claude. Right, in this case, it even found the author of the article that I was reading that's in my network, so I should give them a whirl. In short, no source knows the whole of this. Your browser doesn't know your contacts. Your CRM doesn't know what you're reading. The exhaust does. So, why keep it read-only if it's so useful, after all? Here's the thing about the risk involved. It's asymmetric. The downside of a read-only error is zero. I just ignore it. The downside of a write error is unbounded. And personal AI operates in the high-stakes environment. Your relationships, your career, your reputation. I'd rather miss out on automated emails than have a misfire nuke my life. But there's also a subtler philosophical argument, almost a matter of taste. Read-only isn't just safer, it produces better analysis. The moment your AI writes to your data sources, the exhaust fumes are contaminated. You're no longer observing your cognition. You're observing a human-AI hybrid, and you can't tell which patterns are yours. Sure, the observer changes your behavior, too, but the feedback loop is mediated by you, not automated. You read the reflection. You decide what to do. That's a different thing from the AI writing your draft. And there's an argument to be made that you don't want the AI to write your draft in the first place, that you should reclaim your agency. Might be a hard sell for this crowd, I think, but worth considering. At this point, you might be asking, "Why not throw all this into open Claude on a read-only mount?" Which I have. Here's the thing. The producer The observer produces more value per interaction by a wide margin. The agent saves me 30 seconds on a weather check. The observer shows me I've been avoiding my most important project for 2 weeks. Not to mention that there's less risk of exfiltration and cognitive pollution. The argument I'm making here is that read-only isn't a stepping stone to \{quote\} real agents. It helps you do things well, yes, but it fits a different gap, serves a different need. It's a different product category. The industry frames read-only as a limitation you graduate from. I think that's wrong. Observers and agents are different tools, and mayor isn't a broken butler. So, that's the value proposition. But I'd be doing you a disservice if I stopped here. Let's put on the paranoid hat. What keeps me up at night? Let's start with the mosaic effect. There's something called the mosaic effect, where you put together a lot of small pieces of information and you get a picture. My own slide copy describes the security risk perfectly. The same cross-referencing that makes the system useful makes it a devastating target. So, careful there. The other side of the coin, Simon Willison's lethal triquetra. In case you don't know the lethal triquetra, it's a security risk model that combines three factors: private data, untrusted content, and external communications. I initially thought we only broke the lethal triquetra, and it doesn't, not fully. It removes the natural exfiltration circle channels, but the third leg is any ability to communicate externally, and shell access still has that. In short, the system isn't fireproof, and I'm not claiming that. Even in the best-case scenario, I'm still sending data to Anthropic on a network that's mostly open, with a lot more information lying around that is strictly speaking required. I'm not claiming the system is secure. I'm claiming that I've thought about where it isn't, and I've decided which risks I'm willing to carry. It's different from not knowing. The worst security posture is the one you haven't examined. With that said, I still think there's something worthwhile to be learned from all this. Your digital exhaust is the most underused data set you own. Reflect on it and use it to make yourself better. Thanks for listening.