Signal president Meredith Whittaker used a Bloomberg interview to remind everyone that AI chatbots are not conscious, not sentient, and definitely not your friends. Her main target was Microsoft Copilot’s vision of an assistant that reaches into your bank card, your messages and your calendar at the same time. For Signal, that scenario is a backdoor dressed up as an assistant.
Key Takeaways
- Signal’s president pushed back on the chatbot-as-companion narrative in Bloomberg.
- The Copilot scenario requires combined access to bank, messages, browser and calendar.
- Signal frames that cross-app access as a structural backdoor against its security model.
The Warning From Bloomberg
The line lands almost as routine caution. “These are not your friends. These are not conscious beings. These are not sentient interlocutors.” Meredith Whittaker rolls out the three reminders she now considers necessary against the emotional weight chatbots have started to carry in everyday use.
The Bloomberg interview cuts across several themes the Signal president has owned since taking over. Privacy built as architecture, US tech policy, personal use of generative systems. It’s on that last point that Whittaker spells out her own working limits.
She only uses AI tools “to format a document here and there.” No substantive questions, no outsourced reasoning. She wants her thinking “to not be foreclosed or eclipsed by the response of a system”. The nuance matters. Whittaker is not rejecting the tool, she is rejecting cognitive outsourcing.
That stance lines up with a quieter pattern among some senior tech executives. Many have started to separate what they let a model handle from what they keep doing themselves. The Signal president draws the same lines, only with a far more visible megaphone.
The Copilot Case: Every Access, All at Once
The interview tilts when Whittaker turns to the commercial pitch behind Microsoft Copilot. The vendor showcases an assistant that takes over holiday shopping by reading through family chats, guessing the gifts, placing the orders, adjusting along the way.
On paper, it’s a productivity demo. In practice, Whittaker lists out the permissions the demo silently demands. The credit card, the browser, Signal itself, the ability to message her siblings on her behalf, her home address and her calendar.
Stacked together, that access has nothing to do with a one-off assistant. Whittaker describes a system with “very pervasive access across multiple applications and services”. The aggregated access is the actual product, not the conversational completion used as the storefront.
For Signal, the conclusion is straightforward. If a user installs a Copilot with those permissions, the app’s security model is bypassed without any technical flaw being exploited. The agent reads, and the agent writes. That’s what Whittaker calls “a kind of backdoor”, a backdoor that is legal, sanctioned and yet effective.
Encrypted messaging rests on a simple idea. Only the sender and recipient can read. When an AI assistant operated by a third-party vendor sits on the device, there is a third reader that no end-to-end encryption protocol stops.
Also on Horizon:
- Google Appeals Munich AI Overviews Ruling
- Claude Code Artifacts: Anthropic Opens Sharing
- Amazon Shelves the Artificial Film on Sam Altman
What Changes for the Tools You’ll Use at Work
Short term, Whittaker’s interview piles fresh pressure on Microsoft. The vendor keeps pushing a Copilot embedded everywhere across Windows, Office, Teams, Outlook and Edge. Each new surface widens what assistants can read, write and store.
Enterprise tech leads have started to pull back. AI usage policies are showing up, token budgets are being capped, third-party app inventories are being vetted. The question “what can this agent read” is replacing the one that dominated architecture boards a year ago, which was “how do we cut prompt costs”. The internal crackdown at Meta on AI tooling shows the same shift in focus.
Medium term, Signal’s stance becomes a market argument. The app is likely to harden its third-party API limits and restrict access from assistants that sniff message content. The competition on encrypted messaging shifts from raw performance to agent resistance.
On the regulatory side, Whittaker’s framing hands European authorities a ready-made vocabulary. GDPR speaks of purpose, minimization and proportionality. An agent scanning a user’s messages to buy a gift checks none of those boxes. Brussels does not need to draft a new regime, it just has to apply the one already in force.
One question Whittaker leaves open. If the user consents by ticking a box in the install wizard, does the consent still count? The Signal president doesn’t settle the debate. But her implicit answer is in the opening line of the interview. Chatbots are not your friends. And a friend does not ask for everything.
Follow the story on Horizon.
