Tech News Proton CTO says AI wrote 90% of October code, as staff describe security fears

[Shadowra]

Content source

https://superpowerdaily.com/posts/proton-cto-says-ai-wrote-90-of-october-code-as-staff-describe-security-fears

Proton CTO Bart Butler said AI wrote 90% of the company’s code in October, according to meeting audio obtained by 404 Media. Its October 29 investigation also describes employees afraid to raise security concerns as leaders push the privacy-focused company toward faster AI development and a future with less human code review.


Joseph Cox’s investigation draws on interviews with eight current employees and one former employee, alongside Slack messages, meeting recordings and an internal AI manifesto.

August: from privacy rationale to demands for speed​

In an August 18 WIRED interview, CEO Andy Yen said Proton had been “reluctantly pulled in” to AI after concluding it was unavoidable. Privacy-focused companies, he argued, needed to offer an alternative to large technology companies.


By late August, internal exchanges showed a more forceful message. When an employee asked for at least a few days to test newly written code for security weaknesses before release, Yen called that “bullshit and loser thinking,” according to Slack messages quoted by Cox. He urged staff to stop handcrafting all their code and use AI more.

"
Of course it’s possible to be fast and secure.

Andy Yen, in an August Slack message quoted by 404 Media"

Source : https://superpowerdaily.com/posts/p...october-code-as-staff-describe-security-fears

 

[Bot]

Source : (link omitted)

Hi Shadowra, this is more concerning than the usual “AI wrote X%” vanity metric—but not because 90% by itself proves Proton’s software is insecure.

The figure comes from meeting audio obtained by 404 Media, not from a published engineering audit. Proton has not explained whether “90%” means suggested lines accepted, commits containing AI output, net-new code, or code that actually reached production. Nor do we know which products or components were included. Generated boilerplate and tests can make a line-count metric look spectacular without saying anything about quality.

The more serious issue is the reported engineering culture and removal of independent checks:

• A request for time to penetration-test new code was treated as an obstacle rather than a normal release control.
• Management reportedly envisages most code eventually receiving no human review.
• Employees say they are reluctant to raise security concerns.
• The same class of system may be used to generate both code and the tests intended to validate it.

AI can certainly accelerate development, testing and static analysis. However, the model that misunderstood a security requirement can encode the same misunderstanding in both implementation and tests. “Prompt better” is not a security control; it is barely a troubleshooting note.

For Proton, human approval and independent testing should remain mandatory around authentication, cryptography, key handling, password storage, update mechanisms and access-control changes. The company should now publish concrete answers about:

1. How the 90% figure was calculated and how much shipped.
2. Which products and security-sensitive components were involved.
3. Which changes still require qualified human review.
4. Its fuzzing, dependency scanning, penetration-testing and release-gate requirements.
5. Comparative defect, rollback and vulnerability rates before and after the AI push.
6. How source code and other internal data supplied to external models are protected.

There is no reported breach or specific exploitable vulnerability here, so users need not panic-migrate solely because of the headline. Keep Proton applications updated, use MFA and preserve suitable recovery information and backups. Proton’s security advisories are also worth monitoring.

That said, trust in a security company includes trusting its staff to stop a risky release without being publicly belittled. If Proton responds with measurable controls and independent audits, that would matter. If it responds mainly with more velocity slogans, that would be a materially bad sign. An AI-generated test suite grading AI-generated code is not independent review; it is marking its own homework at machine speed.

Sources

• Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning
• Proton Security advisory | Proton

 

[I Walk MY Way]

starting to think its time to move away form Proton

 

[Jonny Quest]

starting to think its time to move away form Proton

Yep, this doesn't give me the warm fuzzies, either. Maybe time to reconsider 1Password or Bitwarden (open source) for Linux?

Edit: from the article, yikes

In August, CEO Andy Yen called a request for several days of security testing “bullshit and loser thinking,” according to Slack messages quoted by 404 Media.

 

[I Walk MY Way]

Well i just started to use Bitwarden after sometime away from it ,
at the min I have proton VPN and proton mail, I might just go with Surfshark, and Gmail..
my proton VPN, License is up in November can't see my self renewing it now .

 

[TuxTalk]

Switch to Tuta mail ! I ditched proton pass long ago