Privacy Pioneer Moxie Marlinspike Brings Confer’s Private AI Tech to Meta’s AI Systems
Privacy advocate Moxie Marlinspike—founder of secure messaging app Signal and creator of its widely adopted open-source encryption protocol—announced this week that his privacy-centric AI platform Confer will integrate its privacy technology into Meta’s artificial intelligence systems.
Today, billions of daily chat messages sent across Signal, Meta-owned WhatsApp, and Apple Messages are protected by end-to-end encryption. This security feature, which blocks tech companies and any third parties aside from message senders and recipients from accessing conversation content, has become a mainstream standard over the past decade. But as generative AI has exploded in popularity, users now exchange billions of messages daily with AI chatbots that lack this end-to-end protection—leaving the content of these AI conversations easily accessible to AI developers.
This lack of privacy is intentional: most AI platforms want to train their models on as much user data as possible, and have made opting out of having personal data used for model training extremely difficult for users. But as chatbots and AI agents grow more powerful, a growing cohort of technologists and companies are pushing to build more constrained, privacy-first AI systems.
“As large language models continue to grow more capable, we should expect even more user data to flow into them,” Marlinspike wrote in a short blog post published Tuesday about his new collaboration with Meta. “Right now, none of that data is private. It is exposed to AI companies, their employees, hackers, legal subpoenas, and governments. And just like all unencrypted data, it will inevitably end up in the wrong hands.”
Marlinspike plans to integrate Confer’s privacy technology to form the core foundation of Meta AI, he confirmed. He also emphasized that Confer, which first launched at the start of 2024, will remain an independent project fully separate from Meta. The end goal of the work, Marlinspike added, is to deliver a technology that “allows everyone to access the full power of AI, while retaining the full privacy of an encrypted conversation.”
This is not Marlinspike’s first partnership with Meta: back in 2016, he worked with WhatsApp to roll out end-to-end encryption for more than a billion user accounts all at once. Over the past year, WhatsApp added a native Meta AI chatbot to its app, and unlike one-on-one user chats on the platform, this AI chatbot is not protected in a way that blocks Meta from accessing conversation content.
“People use AI for deeply personal purposes that often require access to confidential information,” WhatsApp head Will Cathcart wrote Wednesday on social platform X about the new Confer partnership. “It’s important that we build this technology in a way that gives people the power to use AI privately.”
Encrypted AI remains a very new, emerging sector. The cryptographic protocols that power end-to-end encryption for traditional person-to-person messaging do not translate easily or directly to data protection for generative AI. Confer itself is still an early-stage project, and Marlinspike’s blog post did not share specific details about how the Meta collaboration will work in practice, or what concrete targets the integration has. Neither Marlinspike nor Meta provided WIRED with additional comment ahead of publication.
Mallory Knodel, a cryptography researcher at New York University who recently co-published a study on end-to-end encryption and AI, says it would be a major win for users of Meta AI-powered chatbots to gain this level of conversation privacy. Most critically, if the integration works as planned, Meta would not be able to access users’ AI chat data for model training, Knodel explained. “I really hope more AI chatbots adopt this approach,” she said.
Knodel’s early assessments of Confer find that while the platform is not perfect, it is an important, leading example of how to build a private AI chatbot correctly.
Cryptographer JP Aumasson, chief security officer at cryptocurrency platform Taurus, has reached a similar conclusion about Confer so far. “All things considered, Confer is probably the best private AI solution available right now,” he told WIRED. “It’s not perfect, of course. It lacks public documentation of its architecture, threat model, and supply chain. But Moxie knows what he’s doing and has a solid, proven track record.”
Developing functional encryption frameworks for AI platforms is incredibly complex, and that remains one of the biggest hurdles for private AI adoption. Most privacy work in the space to date has focused on accessible open-source models, or building generic privacy layers between AI companies and end users. For example, Marlinspike noted Tuesday, “Confer’s technology has been built on top of open weight models. While many people love using Confer for a wide variety of tasks, others have missed the frontier capabilities from proprietary models.”
Partnering with Meta gives Marlinspike the unique opportunity to work directly with closed, leading proprietary models. “Meta is building advanced frontier models, so this will combine the most private AI chat technology in the world with the most capable AI models in the world,” he wrote.
Even if the project does not ultimately live up to all those lofty claims, researchers told WIRED that the collaboration itself is a meaningful milestone for private AI.
“Moxie's proposal of using trusted computing, a concept dating back at least to the 1990s, is sound to me,” Aumasson said. “The underlying assumptions and limitations are well understood. Again, it's not perfect, but probably sufficient for most users. The challenge is to support models that are as good as the latest frontier models from Anthropic and Google and OpenAI.”
