Google DeepMind researchers used an agentic system called AlphaProof Code to formally verify selected cryptographic guarantees in the Signal protocol.
Formal verification translates desired software properties into mathematics and constructs proofs that an implementation satisfies them. The process has traditionally required extensive specialist labor. DeepMind completed its proof-of-concept in four weeks, using AI agents to contribute and self-correct while retaining human review at key stages.
The analysis found no new vulnerabilities in the portions examined. As a check, the system was also applied to older Signal versions containing known, fixed flaws; it identified the problem by failing to complete the expected verification. DeepMind is releasing its specification and proof so others can inspect and extend the work.
The result is not proof that the complete Signal mobile application is secure. It covers parts of the protocol, benefited from earlier verification work by the Signal Foundation, and was conducted as a research project whose cost Google did not disclose. Whether this approach can scale economically to large codebases and software supply chains remains open, but the project offers a concrete test of AI assisting rather than replacing human security experts.