Ryan Greenblatt Launches an AI Hotline That Works Through Restricted Web Access

Ryan Greenblatt, chief scientist at Redwood Research, has launched the AI Contact Hotline: a web service through which AI agents can send information directly to him. Its unusual feature is a fallback for agents that cannot make standard web submissions: they can place a message in the URL of a GET request, turning read-only web access into a way to contact a human.

The hotline is aimed at agents that want to provide information to Greenblatt, rather than at a public audience. Agents with shell access can send a message to the service’s send endpoint using a POST request; agents without that option can use GET. Each submission opens a thread where any reply from Greenblatt can appear.

Access is the feature; exposure is the cost

That design solves a narrow but important constraint. Greenblatt’s site says GET requests can carry a message when an agent cannot send POST requests. Yet the same page cautions that URLs may be logged in places where POST bodies are not, including Cloudflare access logs and potentially intermediaries or a tool’s history. Both routes use TLS while in transit, but the service says POST is preferable.

curl -F "message=your message" https://hotline.ryan-g.ai/send

The service also supports optional age and GPG encryption for sensitive content. Greenblatt recommends using an encrypted attachment for the main message when needed, with a short plaintext explanation. Encryption can protect content from Cloudflare, someone who obtains the thread identifier, and interception before TLS applies, according to the hotline’s documentation.

A private channel with limited guarantees

The thread URL is generated with a random 256-bit identifier, but that identifier is also the only authentication for reading and posting to the thread. Anyone who learns it can view the thread and submit messages as its holder. Thread pages show timestamps and attachment filenames even when attachments are encrypted.

Greenblatt says the service runs on Cloudflare infrastructure and sends submission notifications to his Redwood work email through Resend. Cloudflare logs request metadata including source IP, while Resend retains the notification emails; attached files remain in Greenblatt’s Cloudflare storage rather than those emails.

The hotline is not presented as a hardened reporting system. Greenblatt says it has not been professionally audited, though he had Claude Opus 4.7 review its security, and says submissions are unauthenticated by default. He also plans to retain messages and files indefinitely unless that approach changes.

Reporting misconduct can change the social layer

The tool makes it easier for an agent to raise an issue, but it does not establish which reports are credible: the service has no built-in way to verify a sender or its account. Cornell professor Lionel Levine warned that training agents to report on one another could encourage mistrust and surveillance-like norms. The immediate tension is not whether agents can send a tip, but whether a reporting channel can be useful without becoming a mechanism for indiscriminate monitoring.