Everyone is connecting Obsidian to Claude via MCP. Nobody is asking what's actually in their vault.
API keys in old notes. Connection strings. Client names. Tokens saved "temporarily." All of it now accessible in a single AI conversation.
The risk is indirect prompt injection. A web clip with hidden text, a shared markdown file with embedded instructions, a template from GitHub with poisoned metadata. Your AI reads it, follows the instruction, surfaces your credentials.
This isn't theoretical - Unit 42 documented these attacks in production in March 2026.
Before connecting:
- grep -r "sk|aws|ghp_|Bearer |password:" /path/to/vault/
- Set read-only MCP access
- Check web clips in a plain text editor for content you didn't write
Building on RAG beyond personal use? Test against real attacks first Secra Simulate 64 adversarial prompts, 10 categories, free.
Build the second brain. Just audit it first.
