The rise of AI agents and their deployments worldwide as AI assistants on our desktops, laptops and mobile devices has pushed many to question how users’ privacy is harmed.

An AI agent that has been granted full access to other apps can, by default, read messages, take screenshots, record the screen, access previous chats and send all of this to the AI company for inference, processing and further “analysis”. One might argue that a responsible user will not grant an AI assistant access to their sensitive apps and data. But what would happen if someone is texting another person through a messaging application and the recipient has a running AI agent? One’s privacy settings don’t protect them in this case! Once the message reaches the recipient’s end device, their AI agent can read it, and the sender has no way to know it!

The core value of end-to-end encryption is challenged.

AI agents are nowadays changing the game completely. They have moved the privacy fight from the network to the endpoint. AI agents can read messages after they have been decrypted, and existing protocols, permission models and laws have not been designed with agentic AI in mind. On 28 October 2026, Meredith Whittaker, the president of Signal, one of the most trusted messaging apps, warned: “we are looking at the elimination of the possibility to provide privacy as an independent application developer, full stop.”

For more than a decade, the Internet community has been advocating for the use and the right to use encryption to protect users’ privacy. The pressure now comes from features that users turn on themselves. Indeed, encryption protects the pipe, not the endpoint, where plain data lives.

Furthermore, AI agents are introduced nowadays at the operating system level, which has the upper hand over applications. An AI agent with OS-level privileges can read the decrypted message and can also work and act across applications. Signal’s president calls for all OS developers to provide application developers with settings that allow users to opt in to or out of AI data access. End users are not always aware of their devices’ default AI settings. In July 2025, for example, Google gave Gemini access to WhatsApp on Android by default, and many users learned of it only from an email. To protect users, any AI integration in their devices must be disabled by default, requiring explicit consent before an agent can take over their digital lives.

Currently, many screen readers or recorders are widely used across all operating systems. They fall into three categories. The first is always-on recorders, which capture everything all the time. Windows Recall is one of them. It takes a screenshot of the user’s screen every few seconds, though since 2024 it has been set to “off” by default. Even if we consider that these screenshots are saved locally and nothing is shared with the OS provider, a hacker can still access this private data. Malware running on a user’s account can quietly copy every Recall screenshot and all its text, with no admin rights needed. The second is on-demand agents that read the screen through the operating system’s accessibility interfaces, the same channels that screen readers use for visually impaired users. When invoked, they can read and access any opened application, including a decrypted conversation, and act on it on the user’s behalf. Unfortunately, simply blocking these interfaces would also lock out visually impaired users. The third is AI built into the messaging apps themselves. Several major messaging apps now offer an in-app assistant that can summarise or answer chats. When this processing happens in the cloud, the conversation leaves the end-to-end encrypted channel, and users cannot verify who has accessed their data. For the moment, Signal has opted for no in-app AI.

In the current AI-imposed situation, it seems that our privacy does not depend on our settings and choices but rather on our correspondents’ privacy settings. Can we see them?

After spending nearly two decades advocating for encryption implementation and deployment to keep a stranger out of the pipe, now we are letting this stranger read our messages and calling it an assistant!