Google DeepMind reported on November 10, 2026 that its AlphaProof Code framework used AI agents and human expertise to formally verify specified security properties of Signal’s core cryptographic implementation. The announcement describes an engineering case study of one implementation, rather than evidence that all Signal software is free of vulnerabilities.
Formal verification uses mathematical specifications and proofs to establish whether a system satisfies defined properties under stated assumptions. Researchers worked with language models to formulate Signal’s security specifications, and human experts reviewed each one. Agents powered by Gemini Carbon then generated proofs in Lean, a language and proof-checking system. DeepMind says Lean checked the proofs, while agents flagged material requiring additional human review.
The reported properties include protecting messages before and after a device is temporarily compromised. DeepMind says the work reaches beyond protocol design to the compiled implementation, addressing the gap where real code can depart from its intended design. Assessing that claim requires the exact specifications, assumptions and chain connecting the implementation to its formal representation; those details are unavailable in the supplied announcement.
The company reports completing verification in four weeks. Its comparison with historical projects taking years is not supported by a matched baseline or an accounting of human labor and computing resources. The article reports more than six million lines of generated Lean, while the accompanying excerpt says three million lines of proofs. That discrepancy is unresolved. Agents reportedly flagged one percent of the codebase for human attention, but the denominator and scope of that review are unclear.
Researchers also reintroduced two real, previously fixed vulnerabilities into an isolated version of Signal’s code. DeepMind says the system produced machine-checked proofs of insecurity in both cases: two of two selected examples. This provides limited evidence that it can distinguish secure and insecure implementations. The announcement does not explain how the bugs were selected, whether the models had encountered them before, or how the system performs on unseen vulnerabilities.
Only DeepMind’s announcement was supplied; the linked technical paper and verification artifacts were not. The exact code revision, covered components, exclusions and peer-review status therefore remain unspecified. Signal’s supportive comments are stakeholder feedback, not independent replication. Formal proofs support the properties actually specified under their assumptions, rather than protection against every threat. Claims of a first achievement, unprecedented depth and broad applicability cannot be independently established from this material.
Cover illustration generated with AI; conceptual, not research evidence.