Meredith Whittaker from Signal states that AI chatbots 'are not your friends' and describes Copilot agents as a backdoor.

      Signal's president Meredith Whittaker has expressed concerns that AI chatbots are "not your friends," "are not conscious beings," and "are not sentient interlocutors," cautioning against the trend of users viewing AI systems as trustworthy companions. Her remarks came during a Bloomberg interview published this week, where she argued that the autonomous AI vision advocated by companies like Microsoft represents a new type of surveillance system.

      Since becoming the head of the encrypted messaging nonprofit in September 2022, Whittaker acknowledged using AI tools "to format a document here and there," but she set a firm boundary against any significant engagement. “I don’t ask them questions,” she remarked. “I’m very serious about my thinking and writing, and I don’t want the process of developing an idea to be stifled or overshadowed by a system that is merely averaging existing content,” she continued.

      Her most pointed criticism targeted Microsoft AI CEO Mustafa Suleyman's forecast that users could allow Microsoft Copilot to manage their Christmas shopping by monitoring family group chats to figure out what each person desires. Whittaker carefully outlined the permissions such a system would require: “my credit card, my browser, my Signal, the ability to message my siblings on my behalf, my home address, my calendar.” She stated, “What you’ve just described is a system with very extensive access across multiple applications and services. In the context of Signal, it would represent a kind of backdoor.”

      The backdoor analogy is intentional and holds significance coming from the leader of Signal, which boasts the most widely utilized end-to-end encrypted messaging protocol globally. This encryption is also used by WhatsApp, which has over two billion users. Whittaker has previously noted that the organization would exit the EU rather than adhere to any law that compromises its encryption, a stance she reaffirmed when the European Parliament voted in April to allow its ePrivacy derogation to expire instead of extending voluntary scanning of private messages for child sexual abuse material.

      Whittaker's central argument states that agentic AI systems, requiring almost total access to a user's digital life to function, are fundamentally incompatible with end-to-end encryption. An AI agent that can access your messages prior to encryption or after decryption makes the encryption pointless in terms of privacy. It is irrelevant that messages are encrypted during transit if a system with root-level access is processing them in plaintext on the device.

      Whittaker has been increasingly vocal about this issue. In January 2026, she cautioned at Davos that agentic AI was "perilous" for secure applications. In an essay for The Economist, she criticized operating system vendors for "hollowing out" Signal's capacity to ensure privacy by integrating agents into their platforms.

      She has described prompt injection, where an attacker tricks an AI agent into executing undesirable commands, as the most likely initial exploit against encrypted messaging platforms. Microsoft is developing an entire operating system centered on agent-first computing with Project Solara, introduced at Build 2026, which replaces traditional applications with AI agents as the primary interface. Google, Apple, and OpenAI are pursuing similar approaches.

      Whittaker argues that this architectural transformation, where agents mediate every interaction between users and their devices, generates comprehensive databases of digital lives that become prime targets for hackers and governments.

      The interview also addressed the broader issue of AI anthropomorphism. Suleyman has warned about "seemingly conscious AI" and "AI psychosis," where users perceive chatbots as sentient. Whittaker's stance was more straightforward: these systems are designed to imitate empathy and understanding, but their fundamental operation is based on pattern-matching within training data, not genuine comprehension.

      Considering AI systems as confidants leads users to share sensitive information with entities whose data management practices are unclear and whose operators have financial motivations to retain and analyze that information. Whittaker's viewpoint contrasts sharply with the prevailing narrative in Silicon Valley, where the future dominated by agentic systems is portrayed as an inevitability that will enhance user productivity. Her counter-argument is that any productivity improvements gained by relinquishing control over messages, calendars, contacts, and financial information to corporate AI systems are not truly gains, but rather a trade-off where users exchange privacy for convenience without fully grasping the implications.