Every day, billions of chat messages sent through Signal, Meta’s WhatsApp, and Apple’s Messages are protected by end-to-end encryption. This feature, which makes it impossible for tech companies and anyone other than the sender and recipient to spy on your messages, has become mainstream over the past decade. However, as generic AI platforms are exploding in popularity, people are now exchanging billions of messages per day with AI chatbots that don’t offer the security of end-to-end encryption – making it easier for AI firms to access everything you talk to.
This is by design, given that platforms often want to train their AI models on as much user data as possible and have made it harder to avoid using your information as training data. But as chatbots and AI agents have become more capable, some technologists and companies are pushing to create more limited and privacy-focused systems.
“As LLMs are able to do more, we should expect to see even more data flowing into them,” Marlinspike wrote in a brief blog post about its collaboration with Meta published Tuesday. “At the moment, none of this data is private. It is shared with AI companies, their employees, hackers, subpoenas, and governments. As is always the case with unencrypted data, it will inevitably end up in the wrong hands.”
Marlinspike wrote that he would “work to integrate Confer’s privacy technology so that it can underpin Meta AI.” He also stressed that Confer, which launched earlier this year, will continue to operate independently of Meta. The goal of the project, Marlinspike said, is to offer a technology that “allows everyone to have the full power of AI along with the full privacy of encrypted conversations.”
In 2016, Marlinspike worked with Meta-owned WhatsApp to introduce simultaneous end-to-end encryption across more than a billion accounts. Over the past year, WhatsApp has introduced a meta AI chatbot to its app, which is not protected by the company like personal chats are.
“People use AI in ways that are intensely personal and require access to confidential information,” WhatsApp chief Will Cathcart wrote on social media platform X on Wednesday about the collaboration with Confer. “It’s important that we build that technology in a way that gives people the power to do that privately.”
Adoption of encrypted AI is still emerging. Cryptographic schemes used in end-to-end encryption for traditional digital communications are not easily or directly translatable to data security for generative AI. For its part, Confer is still a new project, and Marlinspike’s blog post didn’t provide specific details about how the collaboration with Meta will actually work or what the specific goals are for the integration.
Neither Marlinspike nor Meta provided additional comment to WIRED prior to publication.
Mallory Knodell, a cryptography researcher at New York University, says it would be great for “people using chatbots that use meta AI to maintain privacy and confidentiality within that exchange.” Importantly, this means AI won’t be able to access chat data for meta training, says Knodel, who recently published a study with colleagues on end-to-end encryption and AI. “I really hope more AI chatbots take this approach.”
Knodel’s initial, early assessment of Confer indicates that the platform is not perfect, but an important example of building a personal AI chatbot.
<a href