The test was a trap — and the system knew it. DeepMind's researchers took Signal's code, quietly reintroduced two real bugs that had been fixed years ago, and asked their new AI framework to prove the code secure. It refused: in both cases, AlphaProof Code produced a machine-checked proof that the tampered code was insecure.

That trap is the reason DeepMind is talking about AlphaProof Code today. The framework didn't just check Signal's cryptography on paper — it proved the compiled code itself, down to the machine instructions, in four weeks.

What happened#

Google DeepMind announced AlphaProof Code this morning in a blog post by Pushmeet Kohli and Swarat Chaudhuri. The framework is a multi-LLM agentic system that splits formal verification the way a research team would: human experts decide what to prove, and groups of AI agents do the proving.

Agents powered by Gemini Carbon did the proof work, generating more than six million lines of Lean — the computer language used to write machine-checked mathematical proofs. The technical paper puts the total at about 6.5 million lines, resting on roughly 26,000 lines of trusted specifications, with Claude Opus 5.5 helping draft and cross-check those specifications. Typical campaigns ran 40 to 80 agents on a single machine for 24 to 72 hours, and none of the authors wrote proof code by hand.

AI agents working in parallel across a wall of mathematical proof code while a human reviews one highlighted section
AI agents did the proving while humans kept the specifications. Illustration: AI Frontier Post.

The target was the compiled code of Signal's core cryptography: the PQXDH handshake and Triple Ratchet messaging for one-to-one sessions. The agents proved the properties cryptographers actually care about — and flagged only about 1% of the codebase for a second human look. Lean's kernel checked the rest.

GuaranteeWhat it means
Forward secrecyEarlier messages stay safe even if the current state is stolen
AuthenticationMessages provably come from who they claim to
Post-compromise securityThe conversation recovers after a compromise
Handshake secrecySession keys stay secret, even after a later key break

DeepMind says the result is a double first: the first time AI has formally verified a widely deployed cryptographic protocol at this depth, and the first time the implementation of such a protocol has been formally verified by any method, with or without AI.

Why it matters#

The Signal protocol protects billions of private conversations — in Signal itself, in Google Messages and in WhatsApp. A flaw in it would expose millions of people at once, which is why experts have spent decades analyzing the design. But most verification stops at the design level. Real bugs hide in the gap between the design and the code that actually ships, and AlphaProof Code is the first system to close that gap at this scale.

The division of labor is the point. Agents did the grinding — millions of lines of proof — while humans owned the specifications and the final call, and Lean's kernel checked every step. That matters because a proof is only as strong as its specification: agents could propose small fixes when a proof exposed a problem, but changes to trusted assumptions needed human approval and were logged. Formal verification is having a week: just yesterday, Axiom Math turned 7,654 pages of algebraic geometry into 16 million lines of checked Lean. The two projects point the same way — proof-writing is becoming a job for agent teams, with humans as editors.

Signal's chief technology officer, Ehren Kret, said the work "gives us even greater confidence in our code's privacy guarantees." WIRED, which also reported the research, notes DeepMind ran the Signal analysis free as a research project, and Google declined to say what it cost — or whether it plans to sell formal verification as a product.

What’s next#

DeepMind is open-sourcing the formal verification artifacts and the technical paper, so outside reviewers can rebuild and independently check the proofs. The researchers' stated goal is to verify new libsignal releases before they ship — a research goal, not an announced deployment — and then to carry the method to group messaging, sealed sender and server-side protocols.

A padlock built from interlocking proof blocks dissolving into a checkmark
A proof is only as strong as its specification. Illustration: AI Frontier Post.

The limits are explicit. The guarantees cover the researchers' libsignal build running as a fresh process; key generation wasn't verified, side channels and multi-device state fall outside the scenario, and the paper says neither argument proves the post-quantum healing that SPQR is designed to add. Scaling the method is the open question: DeepMind says the same techniques could eventually secure medical device firmware and power-grid software, but the cost of a four-week, agent-heavy verification run is undisclosed. Security teams are already adapting: Cisco's AI Defense added Claude Mythos red teaming this week to stress-test enterprise agents — the same instinct, applied to a different layer of the stack.

For now, the milestone stands on its own terms: a widely used protocol's real code, proven by machines, checked by machines, with humans holding the pen on what "secure" means.

AFP take: The headline number — four weeks instead of years — is real, but the scope is deliberately narrow: one-to-one sessions, not the Signal app, and the proof is only as strong as the human-written specification behind it. What matters most is the division of labor: agents did the grinding, humans kept the judgment, and Lean checked everything. Watch whether DeepMind turns this into a service — Google won't say what the Signal job cost — and whether the open-sourced artifacts survive outside review.

Sources: Google DeepMind, "Formal Verification of Signal's Protocol with Gemini," published November 10, 2026; WIRED's report of the same research; the technical paper's figures as reported by Unite.AI. Illustrations: AI Frontier Post.