Signal’s Meredith Whittaker says AI chatbots ‘are not your friends’ and calls Copilot agents a backdoor

Signal president Meredith Whittaker has warned that AI chatbots “are not your friends,” “are not conscious beings,” and “are not sentient interlocutors,” pushing back against the growing tendency of users to treat AI systems as trusted companions. The comments came in a Bloomberg interview published this week in which Whittaker laid out her case that the agentic AI vision promoted by companies like Microsoft amounts to a new form of surveillance infrastructure.

Whittaker, who has led the encrypted messaging nonprofit since September 2022, acknowledged that she uses AI tools “to format a document here and there” but drew a hard line at anything more substantive. “I don’t ask them questions,” she said.

“I’m very serious about my thinking and writing, and I don’t want the process of working through an idea to be foreclosed or eclipsed by the response of a system that’s averaging what’s already out there,” she added.

Her sharpest criticism was directed at Microsoft AI CEO Mustafa Suleyman’s prediction that users would be able to let Microsoft Copilot handle all their Christmas shopping by eavesdropping on family group chats to determine who wants what. Whittaker methodically listed the access such a system would require: “my credit card, my browser, my Signal, the ability to message my siblings on my behalf, my home address, my calendar.”

“What you’ve just described is a system with very pervasive access across multiple applications and services,” Whittaker said. “In the context of Signal, it would constitute a kind of a backdoor.”

The backdoor framing is deliberate and carries weight coming from the head of Signal, which operates the most widely used end-to-end encrypted messaging protocol in the world. Signal’s encryption is also used by WhatsApp, which has more than two billion users. Whittaker has previously said the organisation would leave the EU rather than comply with any law requiring it to compromise its encryption, a position she reiterated when the European Parliament voted in April to let its ePrivacy derogation expire rather than extend voluntary scanning of private messages for child sexual abuse material.

The core of Whittaker’s argument is that agentic AI systems, which need near-total access to a user’s digital life to function, are structurally incompatible with end-to-end encryption. An AI agent that can read your messages before they are encrypted, or after they are decrypted, renders the encryption irrelevant from a privacy standpoint. It does not matter that the messages are encrypted in transit if a system with root-level access is processing them in plaintext on the device.

Whittaker has been making this case with increasing urgency. In January 2026, she warned at Davos that agentic AI was “perilous” for secure applications. In an essay for The Economist, she accused operating system vendors of “hollowing out” Signal’s ability to guarantee privacy by embedding agents into their platforms.

She has described prompt injection, where an attacker manipulates an AI agent into executing unintended commands, as the likeliest first exploit path against encrypted messaging platforms.

Microsoft is building an entire operating system around agent-first computing with Project Solara, unveiled at Build 2026, which replaces traditional apps with AI agents as the primary interface. Google, Apple, and OpenAI are pursuing similar strategies.

Whittaker’s position is that this architectural shift, where agents mediate every interaction between users and their devices, creates databases of entire digital lives that become prime targets for both hackers and governments.

The interview also touched on the broader AI anthropomorphism problem. Suleyman himself has warned about “seemingly conscious AI” and “AI psychosis,” where users believe chatbots are sentient. Whittaker’s framing was more direct: the systems are designed to mimic empathy and understanding, but the underlying mechanism is pattern-matching across training data, not comprehension.

Treating them as confidants means volunteering sensitive information to systems whose data handling practices are opaque and whose operators have commercial incentives to retain and analyse that data.

Whittaker’s position places her at odds with the dominant narrative in Silicon Valley, where the agentic future is presented as an inevitability that will make users more productive. Her counter-argument is that productivity gains achieved by surrendering control of your messages, calendar, contacts, and financial information to a corporate AI system are not gains at all, but a transaction in which users trade privacy for convenience without understanding the terms.