Proton, the Swiss company behind Proton Mail and Proton VPN, built its brand on privacy. Now it faces a crisis of trust triggered by its own CEO.
Two weeks ago, 404 Media published leaked Slack messages in which CEO Andy Yen urged staff to “ruthlessly smash everything that stands in the way of AI velocity.”
When an engineer proposed spending a few days on penetration testing before shipping new code, Yen reportedly dismissed it as “loser thinking.”
The backlash was swift. Proton’s Reddit community, which gets 345,000 weekly visitors, filled with so many negative comments that moderators created a single megathread.
Yen apologised for his “hurtful” remarks and insisted that “our use of AI will never be at the expense of security.”
Proton followed up with a blog post. It says its end-to-end, zero-access encryption means neither Proton nor any AI tool can read customers’ emails, files or passwords.
The company also says all code gets the same checks, whether written by humans or AI: automated security scans, human approval, and specialist review for sensitive work such as cryptography.
Proton argues that defending systems without AI is “bringing a knife to a gunfight.” It uses its own models alongside non-public cyber models from OpenAI and Anthropic.
Yet that misses the real objection. The debate is not about whether AI can find vulnerabilities. It is about whether pressure for speed can override engineers’ security judgment.
Notably, nothing in the reporting shows Proton weakened its encryption or shipped insecure code. The damage lies in customers’ confidence that management will respect the processes they rely on.
The timing is awkward. Much of Proton’s growth came from users fleeing big tech, many of whom are deeply sceptical of AI.
Ironically, Yen once wrote in Slack that “perception is more important than truth.” That now sums up Proton’s challenge: reputations break in seconds and take years to rebuild.
For now, Proton’s architecture remains strong, and rivals such as Tuta and Mailfence are smaller and less tested. But in the privacy business, trust is the product, and Proton must earn it back.
