Proton is facing a growing backlash from some of its users following reports about CEO Andy Yen's approach towards artificial intelligence, software development and internal security practices. Some customers say they have cancelled paid subscriptions after allegations emerged that Yen criticised employees who wanted additional time for security testing and pushed engineering teams to make greater use of AI-generated code.
The controversy stems from reporting based on interviews with eight current Proton employees and one former employee, along with internal Slack conversations, meeting recordings and company materials related to artificial intelligence. The allegations have created an uncomfortable situation for Proton because the company has spent years positioning itself as a privacy-focused and security-conscious alternative to much larger technology companies.
The Controversy Centres Around Proton's Growing AI Push
Proton is best known for Proton Mail, but its ecosystem now includes services covering VPNs, password management, cloud storage, calendars and other privacy-focused tools. Security and privacy are therefore fundamental parts of the company's identity rather than secondary features added to otherwise conventional software.
The recent controversy concerns allegations that Proton's internal development culture is increasingly prioritising speed and AI adoption. According to the report, some employees believe the pressure to move quickly could conflict with the careful security practices users expect from a company handling sensitive communications and personal information.
For Proton customers, that tension matters because many deliberately choose the company precisely because they want an alternative to mainstream technology providers.
An Employee Reportedly Asked For More Penetration Testing
One particularly controversial exchange reportedly occurred after an employee suggested allowing several days for penetration testing newly developed code before deploying it into production. Penetration testing attempts to identify security weaknesses by deliberately attacking systems before real attackers have the opportunity to do so.
According to the report, Yen rejected that approach and allegedly described the proposal as "bullshit and loser thinking." He reportedly argued that speed and security do not need to be treated as mutually exclusive objectives and that Proton should be capable of achieving both.
The wording of that response has become one of the main reasons the story attracted so much attention among Proton users.
The Phrase Struck A Nerve With Security-Conscious Customers
Calling additional security testing "loser thinking" naturally sounds particularly provocative when associated with the CEO of a company whose brand is built around security and privacy. Even if the broader argument was that development teams should become faster without reducing security, many users interpreted the reported wording as dismissive of cautious engineering practices.
Software security frequently depends on taking enough time to test assumptions, review code and examine potential attack paths before releasing changes. Faster development can certainly coexist with good security, but rushing security-sensitive software can also introduce vulnerabilities that remain unnoticed until after deployment.
That distinction is especially important for applications protecting encrypted email, passwords, private files and VPN traffic.
Yen Reportedly Told Developers To Stop "Lovingly Handcrafting" Code
The report also claims Yen encouraged Proton engineers to increase their use of artificial intelligence rather than manually writing as much code themselves. He allegedly told employees to stop "lovingly handcrafting all our code and use AI more."
That statement has become another focal point for users concerned about how AI-generated code is being incorporated into security-sensitive products. AI coding tools can accelerate development significantly, but generated code still requires careful review, testing and security validation.
The debate therefore is not necessarily about whether Proton should use AI at all. The larger concern among critics is whether pressure to increase AI-generated development could weaken existing quality-control processes.
AI-Generated Code Is Not Automatically Insecure
Using AI to generate software does not inherently make that software insecure. Human developers introduce bugs as well, and modern AI assistants can sometimes identify problems, write repetitive code and accelerate testing.
The real question is what happens after the AI creates the code. Proper review, automated testing, penetration testing and security assessment remain important regardless of whether a human or AI produced the initial implementation.
A responsible engineering process can incorporate AI while maintaining strong controls. Problems arise when faster generation is treated as a reason to reduce those controls.
Proton Users Expect A Higher Security Standard
This issue carries additional weight because Proton does not market itself as an ordinary technology company. Privacy and security are the central reasons many customers are willing to pay for its products.
Someone choosing Proton Mail instead of Gmail may be making a deliberate decision to reduce dependence on advertising-driven technology ecosystems. A Proton VPN subscriber may similarly choose the service because they trust the company's privacy philosophy.
That means decisions involving security practices can affect customer confidence much more dramatically than they might at a company whose brand is built mainly around convenience or entertainment.
Some Users Say They Have Cancelled Subscriptions
Following publication of the allegations, several Proton customers publicly stated that they were cancelling their subscriptions. Reddit discussions became particularly critical, with some users saying the reported comments conflicted with the principles that originally attracted them to Proton.
One recurring concern is that Proton risks becoming too similar culturally to the large technology companies it frequently positions itself against. Critics argue that aggressively pursuing AI development and growth could undermine the more cautious privacy-focused identity that helped Proton build its audience.
For those users, the controversy appears to involve company culture as much as one particular development decision.
The "Big Tech" Comparison Could Be Particularly Damaging
Comparisons with companies such as Google and Microsoft may be especially uncomfortable for Proton because much of its appeal comes from offering an alternative to those ecosystems. Proton frequently emphasises privacy, encryption and European digital sovereignty when differentiating its products.
Some users therefore see the reported management approach as inconsistent with that identity. Their concern is not simply that Proton uses AI, because virtually every major technology company is now experimenting with the technology.
Instead, the fear is that Proton could gradually adopt the same growth-at-all-costs mindset its customers hoped to avoid by choosing a smaller privacy-focused provider.
One User Argued That Customers Define Quality
A Reddit user responding to the controversy argued that Proton's leadership may be overlooking a fundamental reason people choose the company. According to the user, Proton's customers do not necessarily want another Google or Microsoft; they want a company that shares their values.
The same user argued that customers ultimately determine whether a product meets their definition of quality rather than the company's CEO. That sentiment reflects the unusual relationship privacy companies often have with their communities.
Customers are not purchasing only storage space, email hosting or VPN bandwidth. Many are also buying into the philosophy associated with the service.
Some Users Are Calling For Andy Yen To Resign
The backlash has escalated beyond criticism of individual remarks, with some users calling for Yen to step down as CEO. At least one Reddit user publicly said their Proton subscription had been cancelled and would remain cancelled until leadership changes.
Similar calls have appeared on Proton's own user forum. One post requesting Yen's resignation had reportedly accumulated hundreds of likes and numerous comments at the time the original report was written.
Whether these complaints represent a significant portion of Proton's broader subscriber base remains unclear. Online backlash can be highly visible without necessarily translating into large-scale cancellations.
The Reaction Nevertheless Creates A Reputation Problem
Even if relatively few subscribers leave, the controversy presents a reputational challenge. Trust is extremely difficult to quantify, but it is particularly valuable for companies selling privacy and security services.
Customers need confidence that sensitive information is being protected not merely through marketing promises but through engineering culture and operational practices. Reports suggesting employees are uncomfortable raising security concerns can therefore create uncertainty far beyond the specific incident being discussed.
For Proton, reassuring users may require demonstrating how AI-generated code is reviewed and how security testing fits into its development lifecycle.
Employees Reportedly Feel Uncomfortable Raising Concerns
The report includes allegations from employees who say they have become reluctant to challenge the company's direction on AI. One unnamed worker characterised Yen's enthusiasm for the technology in extremely strong language, describing the CEO as being in "full AI psychosis."
That is obviously the opinion of an individual employee rather than an objective description of Proton's management. Nevertheless, the quote illustrates the level of frustration reportedly present among at least some people inside the company.
If employees genuinely believe raising technical concerns could damage their careers, that would represent a much broader organisational issue than disagreement over a particular AI tool.
Healthy Security Cultures Need Internal Disagreement
Security engineering benefits from employees being willing to challenge assumptions. Someone needs to ask whether a new feature has been sufficiently tested, whether a design exposes unnecessary data or whether an apparently harmless shortcut creates another attack surface.
Those conversations can slow development temporarily, but they can also prevent expensive incidents later. Organisations dealing with security-sensitive products generally need engineers to feel comfortable raising concerns without fearing retaliation.
A culture where speed is valued should therefore still leave room for technical disagreement.
Proton Reportedly Plans To Evaluate Employee AI Usage
The controversy follows earlier reporting that Proton planned to evaluate employees based partly on how they incorporate artificial intelligence into their work. A leaked email reportedly indicated that employees would be interviewed about their AI usage.
According to the report, those assessments could influence future roles and potentially continued employment. This would make AI adoption more than an optional productivity experiment and turn it into something employees may feel pressure to demonstrate.
Companies routinely evaluate how workers use new technologies, but linking AI adoption to employment naturally raises questions about whether employees can reject the tool when they believe it is inappropriate for a particular task.
Proton Once Reportedly Restricted AI Use
Another striking aspect of the story is the reported change in Proton's attitude towards AI. The company had previously been described as restricting or banning AI usage internally before moving towards much greater adoption.
Such a shift is not necessarily unusual. Generative AI tools have improved extremely quickly, and many organisations that prohibited them initially have since developed approved ways to use them.
The issue is how quickly the organisation moves from caution to aggressive adoption and what safeguards remain during that transition.
The Company Reportedly Installed AI-Code Tracking Software
Proton has also reportedly installed software on employee computers to determine how much code is being generated using artificial intelligence. If accurate, this indicates that AI adoption is being measured rather than simply encouraged informally.
Metrics can help companies understand whether expensive AI tools actually improve productivity. However, using the percentage of AI-generated code as a performance measure can create potentially problematic incentives.
Developers might feel encouraged to generate more code with AI even where manual implementation would be clearer, safer or easier to maintain.
More AI-Generated Code Is Not Automatically Better Productivity
Software engineering productivity cannot be measured simply by counting lines of code. A developer who writes 500 lines may not have accomplished more than someone who solves the same problem elegantly with 50.
The same principle applies to AI-generated code. Producing code quickly is valuable only if that code is correct, secure and maintainable.
If engineers are rewarded primarily for increasing AI usage, they may optimise towards the metric rather than the actual quality of the software.
The challenge for management is measuring whether AI improves outcomes rather than merely increasing output.
Reports Suggest Proton May Reduce Human Engineering Hiring
The original reporting also claims Proton intends to reduce or stop hiring human engineers while increasing the amount of code created through artificial intelligence. That would represent a much more aggressive AI strategy than simply giving existing developers access to coding assistants.
If implemented, such a policy could significantly change how Proton builds and maintains its products. Human engineers would increasingly become reviewers, architects and supervisors of AI-generated implementation rather than writing all code directly.
Whether this improves productivity without compromising quality would depend heavily on the surrounding engineering processes.
AI Still Needs Experienced Engineers Around It
AI coding systems can produce impressive results, but they do not remove the need for experienced software engineers. Someone still needs to understand architecture, security requirements, dependencies and how different systems interact.
Generated code can also contain subtle mistakes that look perfectly reasonable during a superficial review. Security vulnerabilities are particularly dangerous because they may remain invisible during normal usage.
The more code AI produces, the stronger the review and testing processes arguably need to become.
Privacy Software Raises The Stakes Even Further
A bug in an ordinary application may cause inconvenience. A vulnerability in an encrypted email service, password manager or VPN can potentially expose sensitive information.
That is why the quality expectations surrounding Proton are unusually high. Customers trust the company's products specifically because they are supposed to provide greater protection than mainstream alternatives.
The consequences of poor security engineering could therefore affect not only software stability but the core promise of the brand.
Speed And Security Are Not Necessarily Opposites
Yen's reported argument that companies can operate both quickly and securely is not inherently unreasonable. Modern development practices use automated testing, continuous integration and sophisticated security tooling precisely to reduce the need to choose between speed and quality.
The disagreement concerns how that principle is implemented. Faster development should ideally come from better automation and stronger processes rather than simply removing steps perceived as slowing releases.
If AI accelerates code generation, security testing needs to scale alongside it.
Automation Could Actually Improve Security
AI itself could potentially strengthen Proton's security rather than weaken it. Models can help identify suspicious code patterns, generate tests and assist with vulnerability analysis.
Automated static analysis and AI-assisted review can also inspect far more code than a small security team could manually examine. Combined properly, these tools could allow companies to move quickly while maintaining rigorous security standards.
The critical factor is whether AI complements human expertise or is used primarily to replace it.
Penetration Testing Still Serves A Different Purpose
Automated tools cannot completely replace penetration testing. Pentesters approach systems from the perspective of attackers, looking for combinations of weaknesses that ordinary automated tests may not recognise.
They may identify logic problems, authentication weaknesses or unusual interactions between components that pass conventional unit tests.
For a privacy company, retaining that adversarial testing mindset remains particularly important.
The controversy therefore focuses partly on whether development speed is being prioritised over this deeper validation.
Users Are Responding To Culture, Not Just Technology
Interestingly, much of the backlash appears less concerned with AI itself than with the reported attitude surrounding its use.
Many Proton customers are technically sophisticated and already use AI tools themselves. Their objection is not necessarily that developers should never use AI.
Instead, they appear concerned by reports suggesting caution is dismissed as weakness and AI adoption may be driven through pressure rather than carefully evaluated engineering decisions.
That cultural distinction is important.
Proton's Community Has Historically Been Part Of Its Strength
Privacy-focused technology companies often depend heavily on enthusiastic communities. Users recommend products to friends, participate in forums and defend companies they believe represent alternatives to dominant platforms.
That advocacy can become extremely valuable because trust is difficult to manufacture through advertising alone.
The downside is that communities can react strongly when they believe the company is abandoning the principles that earned their support.
The current controversy demonstrates how quickly that goodwill can turn into criticism.
European Digital Sovereignty Is Part Of Proton's Appeal
Proton's Swiss identity has also played an important role in its positioning. Many users see the company as part of a broader European alternative to American technology giants.
That appeal has become even stronger as debates around digital sovereignty, cloud dependence and data jurisdiction intensify.
Proton therefore represents more than another email provider to some customers. It represents the possibility of using mainstream-quality digital tools without placing everything inside the ecosystems of Google, Microsoft or other giant platforms.
Any perception that Proton is culturally becoming similar to those companies could therefore be especially damaging.
AI Adoption Does Not Automatically Turn Proton Into Big Tech
At the same time, adopting artificial intelligence does not necessarily mean Proton is abandoning its privacy principles. AI is rapidly becoming a standard software-development tool across virtually every part of the technology industry.
A privacy company can use AI-generated code while maintaining strong encryption, careful data handling and independent security audits.
The real test is whether development practices continue producing software that meets Proton's established security expectations.
That will ultimately matter more than simply counting how much code came from an AI assistant.
The Company Needs To Reassure Customers With Evidence
Responding effectively to the controversy may require more than a public statement defending AI use.
Users concerned about security will likely want evidence that code reviews, penetration testing, audits and other safeguards remain intact.
Transparency around how AI-generated code moves from initial generation into production could help address some concerns.
A company built around trust benefits from explaining its engineering safeguards clearly rather than asking customers simply to assume they exist.
Independent Audits Could Become Even More Important
External security reviews may also gain importance as AI becomes more deeply integrated into Proton's development process.
Independent auditors can provide another layer of assurance that internal pressures around speed are not compromising security.
Open-source components can additionally allow outside researchers to examine how important parts of the system work.
For privacy-focused products, independent verification often provides stronger reassurance than company statements alone.
Customer Cancellations Are A Powerful Signal
Subscription businesses receive particularly clear feedback when customers cancel. Complaints on forums can sometimes be dismissed as temporary outrage, but cancellations directly affect recurring revenue.
Even a relatively small number of users publicly announcing departures can therefore attract management attention.
The bigger question is whether the current reaction remains concentrated among highly engaged community members or spreads into Proton's wider customer base.
That will become clearer over time.
Online Backlash Can Also Exaggerate The Scale Of A Problem
It is worth remembering that Reddit and forum discussions do not necessarily represent every Proton customer.
People who are angry are far more likely to write lengthy posts than users who remain satisfied with the service. A highly upvoted discussion can therefore create the appearance of universal outrage even when most subscribers have not changed their behaviour.
The reported cancellations should still be taken seriously, but their overall scale cannot be determined purely from social media activity.
Proton's Response Will Matter
How Proton handles the controversy may ultimately matter more than the controversy itself. A defensive response could reinforce concerns that leadership is unwilling to listen to users or employees.
A transparent explanation of how AI is used, how security reviews are maintained and what safeguards exist could have the opposite effect.
Privacy companies depend heavily on credibility, making communication during controversies unusually important.
Users need to understand not only what happened but how the company intends to prevent legitimate concerns from being ignored.
The Broader Debate Goes Beyond Proton
The controversy reflects a much larger question facing technology companies everywhere: how aggressively should AI-generated software be adopted?
Executives see tools capable of dramatically increasing coding speed and reducing development costs. Engineers see those same tools producing useful code alongside subtle errors and questionable architectural decisions.
Both perspectives can be true simultaneously.
The challenge is introducing AI without allowing productivity metrics to overwhelm security and software-quality considerations.
AI Is Changing What Software Engineers Do
As coding models become more capable, engineers may increasingly spend less time typing every implementation manually and more time reviewing generated code, designing architectures and validating behaviour.
That transition could produce enormous productivity improvements.
However, reviewing code properly requires deep understanding. Replacing experienced engineers too aggressively could therefore undermine the very oversight needed to make AI-generated development safe.
The future may involve fewer manually written lines without necessarily requiring fewer skilled engineers.
Security Companies May Need A Higher Standard
Companies working directly in cybersecurity and privacy arguably face an even higher bar than ordinary software businesses.
Users depend on their applications precisely because the software is supposed to reduce risk.
An experimental feature in a casual consumer application can occasionally fail without catastrophic consequences. A mistake affecting encrypted communications, authentication or stored credentials can be far more serious.
That makes cautious engineering practices part of the product itself.
Quality Cannot Be Separated From Trust
Ultimately, Proton's challenge is not simply whether AI-generated code can be made secure.
It is whether customers continue believing the organisation has the culture necessary to protect them.
Technical security and perceived trust reinforce each other. A company can have excellent security architecture but still lose customers if its public behaviour creates doubts about how seriously those protections are taken.
For Proton, maintaining trust may therefore require demonstrating that faster AI-assisted development does not weaken the principles behind its products.
Final Thoughts
The controversy surrounding Proton and CEO Andy Yen demonstrates how sensitive AI adoption becomes when it reaches a company whose entire reputation rests on privacy and security. Reports alleging that Yen called additional security testing "loser thinking" and encouraged engineers to stop "lovingly handcrafting" code have triggered a strong reaction among some Proton customers, with several publicly announcing subscription cancellations.
The allegations go beyond one colourful remark. Current and former employees reportedly described pressure to increase AI usage, concerns about speaking openly about security and internal efforts to measure how much code employees generate using AI. Reports also suggest Proton may reduce conventional engineering hiring as AI takes a larger role in development.
None of this automatically means AI-generated code will make Proton's products insecure. AI can improve productivity, generate tests and even help identify vulnerabilities when used responsibly. The real issue is whether the surrounding engineering culture maintains strong review, penetration testing and quality controls as development accelerates.
For Proton, that distinction is particularly important because users do not choose its products only for features. They choose Proton because they trust the company to behave differently from the technology giants it positions itself against.
The backlash therefore represents more than resistance to another company adopting AI. It is a warning from some of Proton's most committed customers that speed and automation are welcome only as long as the privacy, security and engineering discipline that made them trust Proton in the first place remain non-negotiable.
Comments 0