I have a shell script that sends a message to me on Slack, and I have instructions in CLAUDE.md that it should be invoked when a long task finishes or if my attention is needed. The Slack app API key is one way messaging, so it doesn't allow Claude to exfiltrate anything.