Moxie Marlinspike from Signal to Protect Conversations of Billions of Meta AI Users

Moxie Marlinspike, creator of the Signal messenger and one of the primary architects of modern cryptography, has announced a partnership with Meta. His AI-correspondence encryption technology, developed for his own Confer chatbot, will be integrated into Meta AI. If all goes according to plan, billions of WhatsApp, Instagram, and Facebook users will get a fundamentally new level of privacy in conversations with artificial intelligence.

Marlinspike is one of the most significant figures in the world of digital security. In the 2010s, he developed the Signal Protocol—a cryptographic end-to-end encryption standard that today protects not only correspondence in the eponymous messenger, but also in WhatsApp (owned by Meta), Google Messages, Skype, and dozens of other services. His philosophy is simple: communication should be structured so that even the service provider cannot read users' messages.

He decided to transfer this principle into the age of artificial intelligence. Several years ago, Marlinspike created Confer—an experimental encrypted AI chatbot designed to prove that private conversations with AI are technically possible. Unlike most AI products, where user requests are processed and stored on company servers, Confer uses a trusted execution environment—an isolated computing context in which data is processed without the possibility of interception even by the server operators themselves.

The system is built so that no one—neither company employees nor outside observers—can gain access to the contents of correspondence. A technically non-trivial task. Standard end-to-end encryption works perfectly for message exchange between people: text is encrypted on the sender's device and decrypted only on the recipient's device, the server sees only encrypted data.

With AI, the situation is different: a language model must process the request, which means that at the moment of computation, the text inevitably exists in unencrypted form. The approach through a trusted execution environment (TEE) bypasses this limitation: processing occurs in a hardware-isolated context, the results of which are cryptographically verifiable, and the contents are inaccessible from outside. The scale of the potential effect is difficult to overestimate.

Meta AI is embedded in WhatsApp, Instagram, Facebook, and Messenger—an ecosystem with more than three billion monthly active users. Most of them have never thought about who sees their conversations with the AI assistant. Meanwhile, people are increasingly discussing topics with AI that require confidentiality: health status, family problems, financial decisions, professional matters.

Today these conversations go to servers without any cryptographic guarantees. The partnership looks unexpected against the backdrop of Meta's history. The company long associated itself with large-scale data collection—suffice it to recall the Cambridge Analytica scandal or numerous lawsuits surrounding ad tracking.

Marlinspike, by contrast, has always maintained a firm stance on privacy issues and repeatedly criticized major technology corporations for their attitude toward user data. That he chose Meta suggests either the seriousness of the company's intentions or that the scale of the audience seemed to him too significant for the industry to refuse. If the integration succeeds, it could become a turning point for the entire AI industry.

Today, privacy in AI products is largely a marketing promise: companies say they don't look at correspondence, but technically this is not backed by anything. Marlinspike's approach presupposes cryptographic verification: a user will be able to verify that their data is truly protected, rather than simply take the company's word for it. For an industry that is only forming standards of trust between people and AI, this step is capable of setting a new bar.