Proton Sells Privacy. Its CEO Called Security Testing "Loser Thinking" 90% AI-Written Code, A Pentest Request Mocked In Slack, And A Bitcoin Wallet Under The Same Roof 90% of Proton's code in October was written by AI. When an engineer asked for a few days to pentest new code, the CEO called it "loser thinking". ---------------------- Proton sells encrypted email, a VPN, a password manager and a self-custodial bitcoin wallet. Its own site says it serves over 100 million people. The story comes from 404 Media (Oct 29): eight current and one former employee, Slack chats, meeting audio and a manifesto from the CTO. Proton's spokesperson did not dispute the reporting. So what happens when a privacy company decides review is the bottleneck? 👇 🔹The Slack Thread Nobody Was Supposed To Read🔹 End of August, in the security channel. An employee asks for a few days of pentesting before new code goes live. Andy Yen: "That's bullshit and loser thinking." Then: "stop lovingly handcrafting all our code and use AI more." Another engineer pushed back: security is "low in our prioritization at present". No direct answer. Same channel: "This will be the last year that we hire engineers." 🔹The Revenue Target Behind The Rush🔹 An internal document says Proton is not on track for its annual recurring revenue target, "due to insufficient velocity". Another line: "By all metrics that matter, we're an underperforming company." CTO Bart Butler said in a meeting that 90% of October's code was AI-written. Software on staff machines tracks how much. So AI isn't a product choice here. It's the growth plan. 🔹A Walk-Back With An Asterisk🔹 Friday, Oct 30: Yen cancelled the AI "re-interviews" that an internal email had called "consequential" for continued employment. Same all-hands: "Going forward, I'm still going to push." One employee says what the re-interviews measured will now feed performance reviews. His Reddit reply was downvoted more than 1,200 times. 🔹Why This Lands On Crypto Too🔹 Proton Wallet's pitch is simple: only you can access your bitcoin. Self-custody moves the trust from a company's balance sheet to its code. Nothing reported says wallet code skipped review. But the culture that ships it is now on the record. This week everyone is talking about exchange security. A self-custody wallet asks the same question, with no SAFU fund behind it. 🔹If You Use Proton Today (NFA)🔹 ▫️ Your keys 📝 Keep your wallet recovery phrase offline, whichever app holds it. ▫️ Your 2FA 📝 Don't keep your password manager and your authenticator codes in the same app. ▫️ The next releases 📝 Watch whether Proton publishes outside audits for code shipped since August. I'll relax if Proton publishes a review policy for AI-written code before next month's reorg. I'll worry more if the next serious bug comes from an outside researcher, not from Proton. The code can be 90% AI. The trust is still 100% human. Would you keep your keys with a company whose CEO calls pentesting "loser thinking"?
