Cloud-Based AI Features Undermine End-to-End Encryption

As messaging platforms integrate AI features that summarize conversations or answer queries, they're creating a fundamental conflict with end-to-end encryption. The solution tech companies have embraced—trusted execution environments (TEEs)—offers weaker protection than the encryption users expect, according to security researchers at the Electronic Frontier Foundation.

The issue stems from computing power. Consumer devices can't handle the processing requirements for many AI features, so companies send data to cloud servers. To preserve privacy during this transfer, Apple's Private Cloud Compute, Google's Private AI Compute, and WhatsApp's Private Processing all rely on TEEs—hardened sections of servers designed to process data without exposing it to the company operating the server.

The engineering versus mathematics divide

TEEs and encryption represent fundamentally different security models. End-to-end encryption relies on mathematical proofs developed through years of collaborative research. Breaking standard encryption algorithms would require overturning established mathematical principles—a barrier no shortcut can overcome.

TEEs, by contrast, depend on engineering. Each implementation is built by a specific team and contains unique vulnerabilities that emerge only after deployment. Researchers have documented successful attacks on TEEs every year, many exploiting "side channels" that measure electrical impulses or timing to extract encryption keys physically present on the server.

"The collective understanding of every mathematician in the world is that standard encryption algorithms are not breakable to the best of the world's collective knowledge," EFF researchers Erica Portnoy and Thorin Klosowski wrote. "No one has yet built a [TEE] system that is unbreakable."

The challenge intensifies when running large language models. While homomorphic encryption could theoretically process AI queries without exposing inputs or outputs, it remains too computationally expensive for practical use. TEEs offer a compromise—reasonable privacy protection against most threats, but vulnerable to sophisticated attacks, especially those with physical server access.

Why it matters

The distinction between "privacy-preserving" and "encrypted" has real consequences for users who believe their messages remain protected end-to-end. When AI features automatically send conversation data to cloud-based TEEs, the entire messaging system loses its encryption guarantee. This erosion comes precisely as major platforms have achieved encryption victories, including encrypted RCS messaging and improved backup security. Users conducting sensitive conversations—journalists protecting sources, activists coordinating, or anyone discussing private medical or legal matters—face expanded risk if they're unaware their data is leaving their device.

Practical guidance

The researchers recommend that developers never build systems that automatically send data from encrypted apps to TEEs. Users should disable any automatic data-sending features and consciously evaluate the sensitivity of information before choosing to send it for cloud processing.

TEEs serve legitimate purposes, including securing biometric data and enabling encrypted backups. But when companies market cloud-based AI features as maintaining the same privacy as end-to-end encryption, they create dangerous confusion about what protection users actually receive.

These findings were first reported by the Electronic Frontier Foundation in a detailed technical analysis published September 18, 2026.