Proton CEO's AI-velocity remarks spark a trust crisis over its security practices
Proton AG, the Swiss company behind Proton Mail and Proton VPN, faces a trust crisis after leaked Slack messages reported by 404 Media showed CEO Andy Yen pushing to “ruthlessly smash everything that stands in the way of AI velocity” and dismissing pre-release penetration testing as “loser thinking.” Yen later apologized on Reddit for “hurtful” remarks and said AI use “will never be at the expense of security.” In a blog post titled “How Proton keeps your data secure in the age of AI,” the company says its zero-access encryption is unchanged and its security governance policies have not changed since June 2024. According to the article, every change, whether written by a human or an AI agent, gets automated security scans and human approval, and sensitive cryptography changes go to specialist teams. The article notes that nothing in the reporting shows Proton weakened encryption or shipped insecure code because of AI, and that outsiders cannot verify from the policy alone how consistently these safeguards are followed. No vulnerability, CVE or in-the-wild exploitation is involved, so the risk is reputational and related to governance rather than an immediate technical threat.
Linha do tempo
-
Proton CEO's AI-velocity remarks spark a trust crisis over its security practices
ler a análise desta fonte ocultar
Proton AG, the Swiss company behind Proton Mail and Proton VPN, faces a trust crisis after leaked Slack messages reported by 404 Media showed CEO Andy Yen pushing to “ruthlessly smash everything that stands in the way of AI velocity” and dismissing pre-release penetration testing as “loser thinking.” Yen later apologized on Reddit for “hurtful” remarks and said AI use “will never be at the expense of security.” In a blog post titled “How Proton keeps your data secure in the age of AI,” the company says its zero-access encryption is unchanged and its security governance policies have not changed since June 2024. According to the article, every change, whether written by a human or an AI agent, gets automated security scans and human approval, and sensitive cryptography changes go to specialist teams. The article notes that nothing in the reporting shows Proton weakened encryption or shipped insecure code because of AI, and that outsiders cannot verify from the policy alone how consistently these safeguards are followed. No vulnerability, CVE or in-the-wild exploitation is involved, so the risk is reputational and related to governance rather than an immediate technical threat.