Meredith Whittaker does not mince words. AI chatbots are not your friends. They are not conscious beings. They are not sentient interlocutors.
The president of Signal delivered that blunt assessment in a recent Bloomberg interview. Her message lands at a moment when Microsoft, Google, Apple and OpenAI race to embed autonomous agents into operating systems, email, calendars and messaging apps. Those agents promise convenience. Whittaker sees surveillance.
She leads the nonprofit behind the encryption protocol that protects messages for hundreds of millions of users, including those on WhatsApp. Since taking the role in 2022, Whittaker has steered Signal away from compromises on privacy. The organization has said it would exit markets rather than weaken its encryption. That stance gained fresh relevance in April when European lawmakers let a key privacy derogation lapse rather than mandate scanning of private messages.
Whittaker uses AI tools herself. She turns to them to format documents. But she draws a firm line. “I don’t ask them questions,” she told Bloomberg. “I’m very serious about my thinking and writing, and I don’t want the process of working through an idea to be foreclosed or eclipsed by the response of a system that’s averaging what’s already out there.” Short. Direct. A warning against outsourcing cognition.
Her sharpest pushback targets visions promoted by Microsoft AI CEO Mustafa Suleyman. He described a future in which Copilot handles Christmas shopping by listening in on family group chats, figuring out gift preferences, and completing purchases. Whittaker listed exactly what such a system would demand: access to credit cards, browsers, Signal messages, the power to message siblings on the user’s behalf, home addresses and calendars.
“What you’ve just described is a system with very pervasive access across multiple applications and services,” she said. “In the context of Signal, it would constitute a kind of a backdoor.”
That word carries particular force from the head of an organization whose entire purpose is to prevent backdoors. Signal’s protocol underpins end-to-end encryption that keeps messages unreadable in transit. Yet an agent granted device-level or application-level access can read plaintext before encryption or after decryption. The math no longer matters if the system sees everything anyway.
This tension sits at the heart of the conflict. Agentic AI systems need deep integration to act on behalf of users. They must read emails, scan calendars, inspect chat histories and authorize payments. Microsoft’s Project Solara, unveiled at Build 2026, envisions replacing traditional apps with AI agents as the primary interface. Similar efforts come from Google, Apple and OpenAI. The architectural shift creates rich databases of personal behavior. Those stores attract both hackers and governments. The Next Web reported on Whittaker’s critique of this model as incompatible with encryption guarantees.
She raised similar alarms earlier. At Davos in January 2026 she called agentic AI perilous for secure applications. In an essay for The Economist she accused operating system vendors of hollowing out Signal’s privacy assurances by embedding agents directly into platforms. Prompt injection attacks, in which adversaries hide malicious instructions inside ordinary content, represent the most immediate threat according to her analysis. An agent could be tricked into exfiltrating data or taking unauthorized actions.
Recent security research backs parts of her concern. Microsoft 365 Copilot draws data from the Microsoft Graph, which connects emails, files, chats and meetings. Over-permissioned accounts create vectors for rapid data exposure. Researchers documented prompt injection chains that let attackers pull sensitive information without obvious user interaction. One exploit used invisible encoding to smuggle data out through links presented by the AI itself. Witness.ai detailed these risks in analysis published this year, noting that traditional security tools struggle to monitor what an AI interprets from content it processes.
Microsoft has responded with technical safeguards. The company deploys classifiers to detect jailbreak attempts and prompt injection patterns. It promises not to train models on customer data and complies with regulations including GDPR. Yet diagnostic and telemetry data can be retained for up to 18 months in pseudonymized form. Dutch privacy authority SURF maintained an orange risk rating for Copilot in May 2026, citing incomplete mitigation of certain data protection issues including flex routing of traffic. SURF’s assessment highlighted ongoing gaps despite Microsoft’s updates.
Whittaker’s critique extends beyond technical vulnerabilities. She points to the anthropomorphism baked into these systems. They mimic empathy and understanding through pattern matching on vast training data. Users who treat them as confidants hand over sensitive details to opaque commercial entities with incentives to retain and analyze that information. Suleyman himself has cautioned about “AI psychosis” in which people attribute consciousness to the models. Whittaker cuts through the hype with simpler language. These systems average existing content. They do not think.
Her position puts her at odds with much of Silicon Valley’s narrative. Executives frame agentic AI as an inevitable productivity leap. Whittaker counters that the bargain trades meaningful control over personal data for superficial convenience. The productivity gains come at the expense of privacy boundaries that encryption once protected. When agents mediate every interaction, the distinction between encrypted transit and plaintext processing on device collapses.
Signal’s own user base continues to grow. The app counts roughly 70 million monthly active users. Its protocol secures communications for billions through licensing to other services. Whittaker has advised governments and civil society groups on AI policy for years, previously co-founding the AI Now Institute. Her voice carries weight precisely because Signal has maintained a consistent refusal to participate in surveillance business models.
Recent discussions on X echo her warnings. Users highlighted the need for tight scoping, approval mechanisms and audit trails for any AI granted privileged access. Others noted the illusion of friendship serves commercial interests more than user needs. The conversation reflects broader unease as AI agents move from experimental tools to embedded infrastructure.
Yet adoption accelerates. Enterprises integrate Copilot into workflows. Consumers experiment with personal assistants that book travel, manage schedules and draft communications. The convenience is real. So are the risks. An agent that can act must be trusted with data that encryption was designed to shield. Whittaker argues the two cannot coexist without fundamental redesign.
She does not reject AI outright. The technology has uses. Formatting documents. Summarizing public information. The danger arises when systems cross into personal domains without clear boundaries or user comprehension of the access granted. Treating a chatbot as a friend or therapist volunteers intimate details to systems whose operators face commercial pressure to improve models through data.
The coming months will test these tensions. Microsoft and competitors push agent-first computing. Privacy advocates and encryption-focused organizations push back. Regulators examine data retention, prompt injection defenses and cross-app permissions. Whittaker’s message offers a clear stake in the ground. Remember what these systems are. And what they are not. The distinction matters more than the hype suggests.
Her Bloomberg interview arrives as fresh research continues to surface new attack vectors against AI agents. Security teams report persistent challenges with latent permissions and adversarial content manipulation. The architectural choices being made today will shape what privacy means for the next decade. Signal’s leader has made her view plain. Pervasive access by design undermines the protections encryption promises. Users should listen closely before handing over the keys.
WebProNews is an iEntry Publication