Proton CEO: Privacy Is Possible in the AI Era, but Autonomous Agents Bring a New Risk

Proton CEO Andy Yen believes privacy can still survive the AI era, but only if the market moves away from the familiar model in which all data flows into Big Tech's clouds. His biggest worry isn't chatbots themselves. It's autonomous AI agents that users voluntarily connect to their email, files, and other services.

Why the concern is growing

Speaking at the Semafor World Economy conference in Washington, Yen noted that AI's growth comes with growing risks. These systems already help cybercriminals find vulnerabilities and steal data faster, and they help governments and corporations scale up surveillance. Meanwhile, the market still runs on a trade-off: the more data a model gets, the more convenient and accurate the service becomes. That's why privacy can no longer be treated as a niche issue. It's built into the economics of AI products.

Yen says the public now understands better how Big Tech makes money from user data, but that understanding is uneven. Older generations tend to value privacy more but don't always have the technical skills to protect themselves. Middle-aged users quickly put new tools to work and easily overestimate how much control they have over them. Younger users, by contrast, understand how ads, algorithms, and tracking work, but often don't care. That's why Yen sees education, not bans, as the main defense.

Betting on local AI

Against this backdrop, Proton has staked out a clear position: people want AI capabilities, but they don't want to hand their conversations and documents over to outside platforms for good. Yen says Lumo, the company's encrypted chatbot, is currently growing faster than any other Proton product.

He reads that as a sign that demand for privacy-first AI has moved beyond a narrow audience. Users are willing to try alternatives to Big Tech if they get not just a convenient interface but also a clear promise: their data won't become raw material for someone else's model or ad system.

• Lumo — Proton's chatbot with a focus on privacy
• Proton Scribe — an AI writing assistant for email that can run locally on the device
• Proton Workspace — an encrypted alternative to Google Workspace and Microsoft 365
• Born Private — a way to reserve a child's first email address in advance, outside Big Tech ecosystems

Yen considers local AI the most realistic answer to the privacy problem. His reasoning: the computing power of smartphones and laptops is growing fast, and over time models get not only bigger but also more efficient in compact versions. That makes on-device scenarios increasingly practical.

Yes, products with encryption and local processing are harder and more expensive to build than their cloud counterparts. But Yen doesn't see a technical ceiling here. In his view, the issue isn't fundamental impossibility but time, engineering discipline, and the cost of deployment.

Where protection ends

For Proton, the most dangerous scenario isn't encryption being broken. It's AI agents that users themselves grant access permissions to. If such an agent gains access to Proton Mail on a device and then makes a mistake, leaks data, or publishes it externally, the service's protections can no longer help.

At that point, the problem shifts from cryptography to permissions and agent behavior. The more tasks users hand off to autonomous systems, the higher the cost of a single wrong action.

"You can have the strongest encryption in the world, but if the user has given an agent access to their email and it goes off the rails,

Proton can't save them."

Yen allows that Proton could theoretically build its own agent with tighter restrictions, but that isn't the company's main focus right now. His position here looks sober: even a perfectly private service can't make up for careless automation on the user's side.

If the main fear used to be that the platform itself was reading your messages, there's now a new risk: you yourself are plugging in an operator that acts quickly, at scale, and not always predictably. For the market, this is no longer a debate about settings. It's a new threat model.

What it means

Yen's interview points to a simple shift: the AI debate is moving from "is data being collected?" to "who is acting on this data, and on whose behalf?" For companies like Proton, that's a chance to turn privacy into a competitive advantage. For users, it's a reminder that encryption and local models matter, but in the age of AI agents, controlling who you've given access to, and which actions you've allowed to run automatically, matters just as much.