Proton Apologizes, Denies Tracking Staff AI Use and Promises to Publish Its AI Policies After a 404 Media Report
Hey everyone, we have heard your concerns about Proton’s AI strategy and culture and after internal discussions, we want to share a few things with you. First, Proton does not install tracking software on employees' laptops to measure how much AI-generated code they produce. This rumor stemmed from a misunderstanding about how MDM software works, and it's not true. Second, our use of AI will never be at the expense of security. In the past year, contrary to what has been alleged, additional layers of security review have been added to meet the threat posed by hostile AIs scanning Proton's open-source code for vulnerabilities. Our code is open source, and its security remains open for all to verify. We want to prove this to you, so in the interest of transparency, we will lift the hood on how we use AI internally at Proton. This includes publicly releasing and open sourcing several of the internal tools that we use, including more advanced versions of Lumo with greater capabilities, which have never been made available outside of the company. We will also publish how code reviews and security reviews at Proton are done, and detail our AI policies, including where AI is permitted, and where it is not, and our rationale. Instead of just being able to see the final open-source code that we produce to verify security, you will also be able to assess how that code was produced. Lastly, we are not re-interviewing our staff about AI usage, and there are no job losses due to AI re-interviews. You can hold us to these commitments. We're aware that we haven't lived up to the high standard you ought to hold us to, and for that we can only apologize, we are sorry.
Context
A privacy company whose brand rests on trust is being pushed by its users to show how AI is used to write its code, a test of how far AI coding can go in security software.
Proton is a Swiss company that makes encrypted email, VPN and storage products, and an AI assistant called Lumo. On October 29, 404 Media published an investigation based on current and former employees describing a hard push by CEO Andy Yen to use AI in engineering.
Deep dive
Proton posted a statement on Friday responding to concerns about its AI strategy and culture, and ended it with an apology, saying it had not lived up to the high standard users hold it to.
Proton said it does not install tracking software on employees' laptops to measure how much AI generated code they produce, and that this rumor came from a misunderstanding of how its device management software works. It said its use of AI will never come at the expense of security, and that it has added more security review this year. It also said it is not re interviewing staff about AI usage and that there are no job losses from such interviews.
Proton promised to publish how it does code and security reviews, to detail where AI is and is not allowed, and to open source several internal tools, including more advanced versions of Lumo.
The statement follows a 404 Media investigation, based on eight current and one former employee, which reported that Yen dismissed concerns in a staff Slack message as loser thinking, and that Proton had installed software tracking AI written code. The Verge reported that Yen cancelled the planned staff re interviews and said there would be no job losses from AI. Frandroid notes that some users said they had cancelled paid subscriptions.
What to expect next
Watch for when Proton actually publishes its AI policies, review process and the promised Lumo tools, and how detailed they are. Frandroid recalls that when Lumo launched in July 2025, the European Open Source AI Index rated it the least open of the assistants marketed as open, so users will check the details. Further reporting from 404 Media or staff could test Proton's denials. Subscriber numbers will show whether the apology was enough.