Proton defends AI push after leaked CEO messages spark trust crisis

Swiss privacy company Proton published a defense of its internal AI practices on the day its community crisis demanded answers, telling customers that its security governance policies have not changed since June 2024 and that "no AI tool" can read their data because the company holds no encryption keys.

The blog post, titled "How Proton keeps your data secure in the age of AI" and signed by the Proton Team, arrived two weeks after 404 Media published leaked Slack messages in which CEO Andy Yen urged staff to "ruthlessly smash everything that stands in the way of AI velocity." The report, based on those messages and interviews with anonymous insiders, triggered a backlash in Proton's privacy-focused community and forced the company into a public reckoning over whether speed is overriding security.

The stakes are high for a company whose entire business rests on trust. Proton, founded by engineers at CERN, sells privacy-first products including Proton Mail, Proton VPN and Proton Pass. The for-profit Proton AG is primarily owned by the nonprofit Proton Foundation, a structure built to keep the company "private by default" and one that "places people over profits."

What did the leaked messages say?

The 404 Media report described a push by Yen to accelerate AI adoption across engineering. His Slack messages, quoted verbatim in the reporting, instructed Proton engineers to "stop lovingly handcrafting all our code and use AI more."

One exchange drew particular attention. After an employee proposed spending at least a few days on penetration testing before shipping new code, Yen reportedly replied: "That's bullshit and loser thinking. Of course it's possible to be fast and secure. Stop thinking always of how to be slower, and focus more on how to be faster."

Another Yen message has become the defining artifact of the crisis. He told a Proton engineer: "perception is more important than truth, the truth doesn't matter if you don't win on perception." Critics read it as an instruction to shade the truth. Yen later disputed that reading in a reply to a Reddit commenter:

I do not believe perception should be more important than truth. I am stating that unfortunately it often ends up being the case. If you place it into the context in which it was said, it can be understood as, "it doesn't matter that the truth is that Proton's PQC implementation is better, this truth is irrelevant as long as it is not perceived to be this way, and we therefore need to correct that perception"

How did the community react?

Reddit hosts an especially active Proton community with 345,000 weekly visitors. It filled quickly with comments, the majority of them negative, and moderators created a single megathread with separate pages for general criticism, support of the AI usage, and "leaving your goodbyes" — a section for users announcing their departure from the platform.

Yen chose that forum to respond publicly. He apologized for "hurtful" remarks and said he is "determined to do better." He also addressed the security question directly:

But most importantly, I need to categorically state that our use of AI will never be at the expense of security. In the past year, contrary to what has been alleged, actually additional layers of security review have been added to meet the threat posed by hostile AIs scanning Proton's open source code for vulnerabilities. Fast and secure need not be mutually exclusive. We also leverage AI to find vulnerabilities in our own code before attackers do. Our code is open source, and its security remains open for all to verify. [emphasis in original]

Notably, nothing in the 404 Media reporting demonstrates that Proton weakened its encryption or shipped insecure code because of AI. The damage is subtler: Yen's remarks undermined confidence that management will consistently respect the security processes its customers depend on.

What does the new blog post claim?

Proton shared the blog post with ZDNET ahead of publication. It followed up on Yen's promise to "lift the hood on how we use AI internally at Proton" and emphasized the company's end-to-end, zero-access encryption architecture.

We do not hold the keys to your emails, files, or passwords, so we cannot read them, and no AI tool can, either. Our documented security governance policies have not changed since June 2024, before AI was even a major factor in our work here, and they all still apply.

The post clarified Proton's review pipeline:

• Code receives the same checks whether written by a human, an AI agent, or a combination of both.
• Every change gets automated security scans and requires human approval.
• Sensitive changes, such as core cryptography work, require review by specialist teams.
• Major feature designs are reviewed for security, dependencies, testing and deployment plans.

Those policies address the most serious technical concerns raised by the controversy. But outsiders cannot determine from a policy document alone how consistently those safeguards are followed in day-to-day development.

Can AI and security coexist at Proton?

Proton argues it cannot afford to skip AI. "Because of AI, attacks that once might have required a nation-state can now be executed by almost anyone," the company wrote. "A defender relying on manual processes and hand-crafted tools is bringing a knife to a gunfight."

The company says it uses AI to review code changes, identify vulnerabilities through continuous security reviews, and monitor an attack surface that has "grown far beyond what unaided humans could monitor." It deploys its own models alongside non-public cyber models from OpenAI and Anthropic.

The argument, however, does not answer the actual objection. The controversy is not about whether Proton should use AI to find vulnerabilities; it is about whether pressure for "AI velocity" can override the judgment of engineers responsible for keeping products secure. As Proton itself framed it: "An attacker only needs to find one flaw, while a defender needs to close all of them."

Why does this fight matter beyond Proton?

The dispute sits at the intersection of two opposing forces in modern software development. AI-based tools now routinely find severe vulnerabilities in existing codebases — and can exploit them immediately. At the same time, a global movement remains skeptical of AI's benefits and openly opposed to the data centers where AI systems run.

Much of Proton's growth in recent years came from people fleeing big tech. Its most passionate customers are precisely the audience most predisposed to distrust AI companies and AI-driven development. A traditional software company would have rolled out AI features cautiously and revealed an AI-centric security strategy deliberately. That did not happen here. Yen's blunt remarks exposed a management culture that many employees and customers found troubling, and public displays of contempt are difficult to walk back — inside the workforce and out.

Yen himself, on Reddit, acknowledged the shift underway: "AI is here, and it will unquestionably change how software is developed forever, and Proton must also change."

Can Proton rebuild trust?

For privacy-focused users, Proton remains a viable choice, according to ZDNET's assessment. Its architecture is solid, its development staff is intact for now, and the backlash has focused management's attention on what matters. Most alternatives, such as Tuta and Mailfence, are small and untested at comparable scale.

ZDNET's writer, for one, reports continuing to use Proton Pass and Proton VPN, calling both solid and reliable products — but has moved secondary email accounts from Proton Mail to Fastmail, a switch long considered because of Proton Mail's slow performance and hastened by current events.

The company's own words describe the challenge with precision. It takes seconds to destroy a reputation. Rebuilding the perception that a company and its management can be trusted can take months or years — and Proton now has to win on both truth and perception at once.