On November 10, 2026, Google DeepMind unveiled AlphaProof Code, a multi-model agent framework that formally verified the real code of the Signal encryption protocol. It is the first time anyone — with or without AI — has formally verified the implementation of a widely deployed cryptographic protocol down to the machine-code level. Powered by Gemini Carbon, the agents generated more than six million lines of Lean proof code and finished in four weeks a job that would historically have taken expert teams years; humans only needed to review about 1% of the code.
The target was the core of the Signal protocol: the PQXDH handshake and the Triple Ratchet, covering the initialization, sending, and receiving of one-to-one sessions, proving properties such as forward secrecy, post-compromise security, and authentication. The word that matters is 'implementation': most verification stops at the level of protocol design, while the gap between design and code is exactly where vulnerabilities hide. This time the agents proved the compiled AArch64 machine code itself. DeepMind also ran the check in reverse: it reintroduced two real, previously fixed bugs into an isolated copy of the code, and twice the system produced a machine-checked proof that the buggy version was insecure. The verification artifacts and the technical paper are now open source.
What was proved — and what was not
The boundaries of this proof need stating plainly: it covers the libsignal implementation and one-to-one sessions, not group chats, key generation, or multi-device state; roughly 26,000 lines of trusted specifications and semantics still need human review, and the cryptographic primitives themselves are taken as secure assumptions. Signal users do not need to do anything — this was not a vulnerability fix, and there is no patch to install. Signal's side called it a major breakthrough: using agents to automatically turn live code into valid Lean theorems.
Formal verification is moving from papers to engineering. Microsoft is pushing on AI-agent security research too — Microsoft Found the Lazarus Backdoor: Fewer Than 10 Neurons Can Hijack an Agent is a reminder that the more capable agents become, the more important it is to verify that they only do what they should.
Where it goes from Signal
DeepMind's next step is to take this method from Signal to other critical systems, from medical device firmware to power-grid software. Writing the proof is only the start; whether it can be reproduced on more systems will decide whether it becomes new infrastructure for the security industry.
