What's going on at Proton? The October 2026 report

In late October 2026, 404 Media reported that Proton CEO Andy Yen has been pushing staff hard to build with AI, including dismissing an employee's call for pentesting in a security channel as "loser thinking." Based on interviews with eight current and one former employee, 404 Media described a culture of fear inside the company. Proton did not dispute the reporting and said it would explain itself better to staff.

This post sets out what was reported, what Proton said, and what it does and does not tell you about the safety of a Proton account.

What was reported

The main piece is "Manifestos, Fear, and 'Loser Thinking': Inside Proton's AI Reckoning" by Joseph Cox, published by 404 Media on October 29, 2026. Most of it is for paid subscribers. Everything below comes from the part that anyone can read.

According to the report, an employee in Proton's security Slack channel urged the company to take at least a few days to pentest newly written code before pushing it live. Yen replied, at the end of August: "That's bullshit and loser thinking. Of course it's possible to be fast and secure." He added: "Stop thinking always of how to be slower, and focus more on how to be faster." In a follow-up message he wrote "only losers think like that," and his message to the team was to "stop lovingly handcrafting all our code and use AI more."

404 Media reported several other steps from the last few months:

Yen set up an email address for employees to report anything blocking AI adoption, so leadership can "ruthlessly smash everything that stands in the way of AI velocity."
Proton installed software on workers' computers that tracks how much AI code the company generates.
Yen said this is the last year Proton will hire engineers at all, and that it will instead hire only people to build things with AI.

Three days earlier, on October 26, 404 Media reported that Proton had told staff it would "re-interview" people across the company about how they use AI, with the implication, according to an internal email the outlet obtained, that the interviews may decide whether staff have "continued employment." The email reads: "These re-interviews are consequential."

For the October 29 piece, 404 Media said it spoke to eight current and one former Proton employees and reviewed Slack chats, meeting recordings and an AI manifesto written by Proton's CTO. The outlet wrote that its reporting reveals a culture of fear, in which employees with concerns about security, or about building security products with AI, feel unable to raise them.

The report also links the push to revenue. One internal document obtained by 404 Media says that "Due to insufficient velocity," Proton is not on track to reach its annual recurring revenue target by the end of the year.

What Proton said

404 Media wrote that a Proton spokesperson, responding to detailed questions, did not dispute any of its reporting or its characterization of what is happening inside the company. The spokesperson said:

"It's clear that some people at Proton are unhappy with our direction, or misunderstand it, and many people are anxious. In our determination to move fast, we have sometimes been too blunt or too slow in explaining ourselves to our people. We will work on that, as their questions are the ones we most need to answer."

Is Proton still safe to use?

Nothing in the public reporting describes a breach, a change to Proton's encryption design, or any user data being exposed. The articles are about how Proton's leadership wants software to be built and how fast, and about how staff feel raising concerns. They do not claim that any Proton product is less secure today than it was before.

What the report raises is a process question: how much review and testing new code gets before it ships. That is something users cannot see from outside, in Proton's case or anyone else's. Using AI to write code is now common across the industry. What matters for security is the review, testing and auditing around the code, however it was written.

If you use Proton and want to keep an eye on this, these are the public signals worth watching:

Security announcements and incident reports on the Proton blog. If something goes wrong, this is where a disclosure would normally appear.
Service status at status.proton.me, which shows outages and incidents.
Open-source code. Proton says its apps are open source and independently audited, and links the repositories and audits from its open source page. The code itself is on GitHub.
New audits. Whether Proton keeps publishing independent audits of new releases, and what they find.
The bug bounty. Proton runs a bug bounty program for outside researchers.

If those stay as they have been, there is no reported reason to think your account is at risk. If you would rather not wait and see, the next section covers the practical steps.

If you decide to move

Leaving any email provider works best in a set order: export first, set up the new inbox, forward new mail, update your logins over a few weeks, and only then close the old account. Our provider-neutral guide to switching email providers covers the full order.

For Proton specifically:

Export your mail. Proton offers a free Mail Export Tool that decrypts your mail and saves it to your device. Our walkthrough on how to export Proton Mail emails goes step by step.
Cancel a paid plan. See how to cancel a Proton subscription so you are not billed for another term.
Delete the account last. Once nobody writes to the old address any more, how to delete a Proton account covers what is removed and what to check first.

There is no rush. Nothing in the reporting says your account works any differently than it did before.

FAQ

Was there a Proton data breach?

No breach was reported. The 404 Media articles are about internal culture and engineering process, not about user data being exposed or accounts being compromised.

Did Proton deny the report?

No. According to 404 Media, Proton's spokesperson did not dispute any of the reporting. The spokesperson said some staff are unhappy or anxious and that Proton would work on explaining itself better.

What did Andy Yen say?

In a security Slack channel, responding to an employee who urged a few days of pentesting before new code went live, he wrote: "That's bullshit and loser thinking. Of course it's possible to be fast and secure." Later he wrote "only losers think like that," according to 404 Media.

Did Proton's encryption change?

Nothing in the reporting says so. The public portion of the articles makes no claim about changes to how Proton encrypts mail or files.

Is it worth leaving Proton over this?

That is your call. If you stay, watch Proton's security announcements, audits and incident reports. If you leave, export your mail first and keep the old account open until nothing important arrives there.

Where Secria fits

If you do move, Secria Mail has a guided "Import from Proton." You save your mail as EML files with Proton's free Mail Export Tool, then bring it in under Settings > Import & export > Bring mail in. The mail is encrypted in your browser before upload, original dates are kept, and import is available on every plan, including free. Every plan also has post-quantum encryption (ML-KEM-1024 with X25519) on by default. The free plan has 1 GB, and sign-up needs no phone number and no card. There is more on the Proton Mail alternative page, or you can create an account.