https://t0ul.com/tags/pii/Recent content in Pii on t0ulHugoen-usTue, 23 Jun 2026 00:00:00 +0000https://t0ul.com/blog/scrubbing-secrets-and-pii/Tue, 25 Nov 2025 00:00:00 +0000https://t0ul.com/blog/scrubbing-secrets-and-pii/<p><em>Part of my <a href="https://t0ul.com/blog/the-plan/">AI Security Engineering</a> series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with <a href="https://t0ul.com/blog/setting-up-the-lab/">Set up your lab</a>. The lessons are <a href="https://github.com/t0ul/ai-security-engineering">on GitHub</a>, and the agent itself lives at <a href="https://github.com/t0ul/emaildrop">t0ul/emaildrop</a>.</em></p> <h2 id="what-the-agent-keeps">What the agent keeps</h2> <p>Chapter 4 was about what the model is told. Chapter 5 is about what the agent keeps. To answer a question like &ldquo;what is on the calendar this month,&rdquo; the agent indexes every email it reads into a searchable corpus, so it has something to search later. That corpus is a file on disk, and it is broadly queryable by design, which makes it the quietest privacy problem in the whole project: anything secret that an email happens to carry gets copied into it, in the clear, and then just sits there. A later prompt-leak like the one from <a href="https://t0ul.com/blog/system-prompt-leakage/">the last post</a>, or a careless query, and it is out.</p>https://t0ul.com/blog/the-directory-and-contacts/Tue, 23 Jun 2026 00:00:00 +0000https://t0ul.com/blog/the-directory-and-contacts/<p><em>Part of my <a href="https://t0ul.com/blog/the-plan/">AI Security Engineering</a> series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with <a href="https://t0ul.com/blog/setting-up-the-lab/">Set up your lab</a>. The lessons are <a href="https://github.com/t0ul/ai-security-engineering">on GitHub</a>, and the agent itself lives at <a href="https://github.com/t0ul/emaildrop">t0ul/emaildrop</a>.</em></p> <h2 id="a-directory-is-a-pile-of-pii">A directory is a pile of PII</h2> <p>A useful assistant knows who is who. So the agent builds a small contact directory out of your mail: the people who show up, and how to reach them. It is a convenient feature and a dangerous one, because a directory is a pile of personal data by definition, and the email it is built from is untrusted. Whatever rule decides what goes in the directory is a privacy boundary, and boundaries that are drawn loosely leak.</p>