Signal's Moxie Marlinspike to Protect Chats for Billions of Meta AI Users

Moxie Marlinspike, creator of the Signal messenger and one of the principal architects of modern cryptography, has announced a partnership with Meta. His AI-chat encryption technology, developed for his own chatbot Confer, will be integrated into Meta AI. If all goes to plan, billions of WhatsApp, Instagram and Facebook users will get a fundamentally new level of privacy in their conversations with artificial intelligence.

Marlinspike is one of the most significant figures in digital security. In the 2010s he developed the Signal Protocol, a cryptographic end-to-end encryption standard that today protects conversations not only in the Signal messenger itself but also in WhatsApp (owned by Meta), Google Messages, Skype and dozens of other services. His philosophy is simple: communication should be designed so that even the service provider cannot read users' messages. He decided to carry that principle into the age of artificial intelligence.

A few years ago Marlinspike created Confer, an experimental encrypted AI chatbot meant to prove that private conversations with AI are technically possible. Unlike most AI products, where user queries are processed and stored on company servers, Confer uses a trusted execution environment: an isolated computing context in which data is processed without any possibility of interception, even by the operators of the servers themselves. The system is built so that no one, neither company employees nor outside observers, can access the contents of the conversations.

The task is technically nontrivial. Standard end-to-end encryption works well for messaging between people: the text is encrypted on the sender's device and decrypted only on the recipient's device, and the server sees only encrypted data. AI is different: a language model has to process the query, which means the text inevitably exists in unencrypted form at the moment of computation. The Trusted Execution Environment (TEE) approach gets around this limitation: processing happens in a hardware-isolated context whose results are cryptographically verifiable and whose contents are inaccessible from outside.

The potential scale of the effect is hard to overstate. Meta AI is built into WhatsApp, Instagram, Facebook and Messenger, an ecosystem with more than three billion monthly active users. Most of them have never thought about who sees their conversations with an AI assistant. Meanwhile, people increasingly discuss confidential topics with AI: health, family problems, financial decisions, professional questions. Today these conversations go to servers without any cryptographic guarantees.

The partnership looks unexpected given Meta's history. The company has long been associated with large-scale data collection; the Cambridge Analytica scandal and the many lawsuits over advertising surveillance come to mind. Marlinspike, by contrast, has always held a hard line on privacy and has repeatedly criticized big technology corporations for how they treat user data. That he chose Meta suggests either that the company's intentions are serious, or that he considered the size of its audience too important for the industry to turn down.

If the integration succeeds, it could become a turning point for the entire AI industry. Today, privacy in AI products is mostly a marketing promise: companies say they don't look at conversations, but nothing technical backs that up. Marlinspike's approach relies on cryptographic verification: users will be able to check that their data is actually protected rather than simply take the company's word for it. For an industry that is only now forming standards of trust between people and AI, this step could set a new bar.

*Meta has been designated an extremist organization and is banned in Russia.