Signal president warns AI agents are making encryption irrelevant

Signal Foundation president Meredith Whittaker said artificial intelligence agents embedded within operating systems are eroding the practical security guarantees of end-to-end encryption (E2EE).

The remarks were made during an interview with Bloomberg at the World Economic Forum in Davos. While encryption remains mathematically sound, Whittaker argued that its real-world protections are increasingly bypassed by the privileged position AI systems occupy inside modern user environments.

Whittaker, a veteran researcher who spent more than a decade at Google, pointed to a fundamental shift in the threat model where AI agents integrated into core operating systems are being granted expansive access to user data, undermining the assumptions that secure messaging platforms like Signal are built on. To function as advertised, these agents must be able to read messages, access credentials, and interact across applications, collapsing the isolation that E2EE relies on.

This concern is not theoretical. A recent investigation by cybersecurity researcher Jamieson O’Reilly uncovered exposed deployments of Clawdbot, an open-source AI agent framework, that were directly linked to encrypted messaging platforms such as Signal. In one particularly serious case, an operator had configured Signal device-linking credentials inside a publicly accessible control panel. As a result, anyone who discovered the interface could pair a new device to the account and read private messages in plaintext, effectively nullifying Signal’s encryption.

Signal, a nonprofit organization focused on privacy-preserving communications, is widely used by journalists, activists, and government and military personnel around the world. Its Signal Protocol is considered a gold standard in modern cryptography and is also used by platforms such as WhatsApp and Google Messages. However, Whittaker warned that encryption alone cannot protect users when AI systems operate with near–root-level access on their devices.

During the interview, she described how AI agents are marketed as helpful assistants but require sweeping permissions to work. As Whittaker explained, these systems are pitched as tools that can coordinate events or communicate on a user’s behalf, but to do so they must access calendars, browsers, payment methods, and private messaging apps like Signal, placing decrypted messages directly within reach of the operating system.

Whittaker characterized this architectural shift as “breaking the blood-brain barrier” between applications and the operating system. Once that boundary is crossed, either through compromise or intentional design choices, individual apps can no longer guarantee privacy on their own. She said companies deploying AI agents, particularly at the OS level, must recognize how reckless such designs can be if they undermine secure communications.

In O’Reilly’s Clawdbot research, he identified hundreds of exposed control panels reachable over the public internet, some lacking any authentication. These interfaces provided access to full conversation histories, API keys, OAuth tokens, and command execution features across services including Slack, Telegram, Discord, WhatsApp, and Signal. In several instances, Signal device-pairing data was stored in plaintext, enabling attackers to take over accounts remotely.

According to O’Reilly, the issue extends beyond individual bugs and reflects a broader pattern. AI agents require extensive privileges to function, yet they are frequently deployed without adequate security hardening. Common misconfigurations, such as treating all connections from loopback addresses as trusted when used behind reverse proxies, can expose systems to the internet unintentionally. Even when authentication is enabled, concentrating credentials and conversation history in a single system creates an especially attractive target.

Whittaker emphasized that debates around encryption should not be confined to abstract or academic arguments. Although the Signal Protocol itself remains cryptographically secure, she warned that privacy in practice depends on the security of the entire system. If the layer that processes decrypted messages is compromised, the protections encryption provides become irrelevant.