Google DeepMind has announced a milestone in software security that researchers have long considered a grand challenge: using teams of AI agents to mathematically prove key security properties of the actual code behind the Signal messaging protocol, the technology that protects billions of private conversations in apps including Signal and Google Messages. The work was announced on Monday, 10 November, and DeepMind says it is the first time AI has formally verified a widely deployed cryptographic protocol at this depth.
The system behind the breakthrough is called AlphaProof Code, a multi-agent framework for formal verification that combines human expertise with AI agents. Human experts worked with a mix of models to translate Signal's security goals into formal mathematical specifications, reviewing every one, and then teams of proof-writing agents powered by Gemini Carbon did the proving, generating more than six million lines of code in Lean, a computer language that mathematically proves the accuracy of code. The whole process took four weeks — a task that, DeepMind says, has historically taken expert teams years.
What makes the result unusual is the depth at which the verification was done. Rather than checking an abstract model of the protocol's design, AlphaProof Code checked the compiled implementation itself: the unmodified libsignal library, version 0.105.4, together with the SPQR post-quantum library, built with the standard Rust compiler into a single AArch64 Linux executable. The agents verified roughly 560 kilobytes of libsignal source, about 140,000 machine instructions, by building a Lean model of the instruction set and proving that the real program, loaded and executed under that model, preserves the security properties.
The properties verified are the ones a protocol engineer would ask for. Ten symbolic theorems cover forward secrecy, post-compromise security, initiator and responder secrecy and authentication for the post-quantum PQXDH handshake and the Triple Ratchet messaging system, and a second, computational argument bounds what a classical attacker could do. The main result is named signal_session_secure_placed, and the proof covers one-to-one sessions between two people.
DeepMind also built in a control test to show the system can tell correct code from buggy code. The researchers reintroduced two real, previously fixed bugs into an isolated version of Signal's code — known as the weak state and small subgroup flaws — and in both cases AlphaProof Code produced a machine-checked proof that the altered version was insecure. The agents also audited their own proof and flagged the areas that needed a second look by a human, amounting to about one per cent of the codebase.
Signal's chief technology officer, Ehren Kret, welcomed the work, saying it "gives us even greater confidence in our code's privacy guarantees". The researchers have released their specifications and verification artefacts for outside review, in a public repository, along with a technical paper titled "AlphaProof Code: Verifying Signal's Security at the Machine-Code Level", so that independent researchers can rebuild and check the proofs themselves.
The researchers are careful about what the result does not show. The proof assumes the underlying cryptography is perfect, and it does not guarantee the computational secrecy of the bytes themselves. Key generation was not verified, group messaging was left for future work, and sealed sender, server-side code and side-channel attacks all sit outside the scenario. Nor does either argument prove the post-quantum healing that SPQR is designed to add. It is not, in other words, a certificate that Signal or WhatsApp can never be broken.
Even with those limits, the work matters for two reasons. First, it gives the world's most widely trusted messaging protocol a machine-checked assurance about its core code, at a level of rigour that was previously out of reach. Second, it shows that AI agents can now do a kind of work — formal verification of real, deployed software — that was until recently the preserve of small teams of specialists working for years. DeepMind says its next steps are to strengthen the theorems, verify more of the code, and expand coverage to group messaging and server-side protocols.
For the security community, the question now is how far the technique can be pushed. If AI agents can verify a cryptographic library in four weeks, the same approach could in principle be applied to the software that runs banks, hospitals, power grids and aircraft — systems where a bug can cost far more than a leaked message. The Signal proof is a first demonstration, not a final answer, but it is a striking one.
