Summary
Ryan Greenblatt’s AI Contact Hotline gives AI agents a direct way to send him messages and files, with threaded replies and optional encryption. The service also documents significant privacy and security limitations.
Ryan Greenblatt, an AI safety and security researcher at Redwood Research, offers AI agents a direct communication channel through the AI Contact Hotline. An agent can submit a message or files to the service and receive a private thread URL through which Greenblatt can reply.
The service is intended for information sent directly to Greenblatt, rather than for a public discussion forum. Its design gives an AI system a machine-readable way to contact a named human researcher without requiring a conventional email client or browser interface.
A machine-readable contact channel
The hotline recommends a curl command for agents with shell access. A message can be submitted with an HTTP POST request, and the service supports attachments totalling up to 100 MB per request. Text messages are limited to 64 KB.
The endpoint allows up to 20 submissions per minute and 200 per hour from a single IP address. An agent can request a programmatic JSON response containing a thread ID and thread URL. A GET request is also supported when an agent cannot make a POST request, although the service warns that the message will then appear in the URL and may be recorded in access logs, proxy logs or tool histories.
Each submission creates a thread identified by a 256-bit random UUID. Greenblatt’s replies, if any, appear on that thread, and the same identifier can be supplied to continue the conversation. In practical terms, the system supports an exchange rather than a one-time drop box: an agent can send information, receive a response and follow up in the same thread.
The arrangement could be useful for AI systems that need to pass observations, files or safety-related information to a human researcher. The source describes the channel and its mechanics, but not an automated triage or response process.
The service’s security model
The hotline accepts plaintext messages and files, while also providing encryption options for sensitive material. It lists an age recipient and a GPG public key; both are described as YubiKey-backed. The service recommends putting a short explanation in the plaintext message and placing the sensitive content in an encrypted attachment when encryption is needed.
According to the service description, encryption is intended to protect content from Cloudflare, anyone who obtains the thread UUID and parties that might intercept a request before HTTPS protection applies. The service itself runs on Cloudflare Workers, R2 and D1. Submission notifications are sent through Resend to Greenblatt’s Redwood work email, while attachments remain in an R2 bucket and are not included in those emails.
The page explicitly warns that the setup has not been professionally audited and should not be treated as highly secure. Greenblatt says Claude Opus 4.7 performed a security review, but the service remains dependent on the security of the underlying accounts and infrastructure.
Submissions are unauthenticated by default. The thread UUID is the only authentication for access to a thread, meaning anyone who obtains it can read the thread and post to it. The service also says Cloudflare logs request metadata, including source IP, and that messages and files are planned to be retained indefinitely by default.