The assistant has to read it

An assistant that summarises your unread messages has to read your unread messages. That sentence contains the entire problem, and no amount of product design removes it. The only decision available is where the reading happens — and it is a decision most messengers have now made on their users' behalf.

Before the assistant, though, the attacker. Generative models arrived first as a way of writing convincing messages at scale, and the public-sector warnings are specific about it. The FBI's Internet Crime Complaint Center issued alert I-051525-PSA in May 2025 on a campaign impersonating senior US officials, noting that actors are “exploiting AI-generated audio to impersonate well-known, public figures or personal relations.” Its December 2025 follow-up warns that “AI-generated content has advanced to the point that it is often difficult to identify”, and records the operators steering victims onto encrypted apps — the encryption working exactly as designed, for them.

Does it actually work better?

Worth being careful here, because this is where the marketing lives. A 2023 study by Heiding, Schneier and colleagues found GPT-4-written phishing (30–44 % click-through) beat a generic control but lost badly to a hand-built expert method (69–79 %). Their 2024 follow-up is the one that matters: a control group at 12 %, human experts at 54 %, and “fully AI-automated emails 54%”, concluding the automated attacks “performed on par with human experts and 350% better than the control group.” The change is not that AI writes better lures than the best humans. It is that it writes as well as they do, for everyone, at no cost.

The deepfake numbers deserve the same discipline. ENISA's 2025 threat landscape reports that AI-supported phishing is more than 80 % of observed social engineering — but writes “reportedly” and footnotes vendor blogs, while its own dataset puts phishing at “about 60% of observed cases”. The concrete case beats any percentage: in 2024 a finance employee in Hong Kong transferred HK$200 million — about US$25.6 million — after a video call in which, as the police put it, “everyone [he saw] was fake.” He had correctly suspected a phishing email; the video call talked him out of it.

Nothing in that story is a cryptographic failure. The channel was authentic. The person was not.

Which is why the defence is not detection. The IC3's advice is a secret word agreed with your family out of band; in a messenger the equivalent already exists — verify the safety number over a channel the attacker does not control. The UK's NCSC judged in 2024 that AI “will primarily offer threat actors capability uplift in social engineering”, removing the “translation, spelling and grammatical mistakes that often reveal phishing.” Those were never authentication. They were just free.

The assistant is another end

Two of the largest companies in the industry have published the honest version of this. Apple, introducing Private Cloud Compute: a server model “requires unencrypted access to the user's request and accompanying personal data. That precludes the use of end-to-end encryption.” Meta, introducing Private Processing for WhatsApp: “the current state of AI processing — which relies on large language models often running on servers, rather than mobile hardware — requires that users' requests are visible to the provider.”

Both built the same mitigation: a hardened enclave you are asked to trust rather than verify yourself. Genuinely better than a plain API call, and not end-to-end encryption. The shift is visible in WhatsApp's own grammar: end-to-end encryption is asserted for “your personal messages and calls”, while for AI features the claim becomes that Private Processing lets Meta AI respond “without Meta or WhatsApp being able to read your messages.” Different promise, different mechanism, same paragraph.

What local inference costs

Running the model on the device removes the question rather than answering it: there is no request, so there is nothing to log, retain, subpoena or leak. The bill arrives in three parts, and none of them is small.

Size. llama.cpp's own perplexity tables put Llama 3 8B at 14.97 GiB in 16-bit and 4.58 GiB at q4_K_M. Quality. That 4-bit step costs about 0.15 perplexity — nearly free — but the same table shows 2-bit post-training quantization adding 3.52, and a 2.24 GiB variant adding 7.86, which is not a smaller model but a worse one. Apple ships its on-device model at “approximately 3-billion-parameter” scale compressed “to 2 bits per weight” — and gets away with it only by quantizing during training rather than after. Energy. Instrumented measurements on a Raspberry Pi 4 with a hardware power meter report 2.61 J per token for a 0.5B model and 8.40 J for a 1B one; a phone is not a Pi, but the shape of the cost is real, and it is charged to the battery of the person being helped.

Where OSHI is

OSHI's assistant runs entirely on the device, via llama.cpp. We grepped the whole codebase this week: there is no call to any remote AI API, on any platform. That is the checkable answer to “how do you use an assistant without handing your plaintext to somebody's server” — not a policy, not a data-processing agreement, an absent network call.

The cost is exactly the one above: a multi-gigabyte model file on your device, and a model materially weaker than anything running in a datacentre. If you want a state-of-the-art assistant, we do not have one and cannot have one. That is the trade, stated plainly rather than sold.

Signal's warning about the layer below is the right place to end. When an OS-level assistant screenshots or indexes what is on screen, the app's encryption is irrelevant; hence its request that “operating system vendors, especially those who are shipping AI agents, need to ensure that the developers of apps like Signal always have the necessary tools and options at their disposal to reject granting OS-level AI systems access to any sensitive information within their apps.” The next argument about encrypted messaging will not be about ciphers. It will be about which processes on your own device are allowed to read the screen.