Google DeepMind used a new agentic AI framework called AlphaProof Code to mathematically prove several key cryptographic guarantees of the Signal protocol, the encryption underpinning chats on the Signal app, Google Messages, and WhatsApp3. The four-week proof-of-concept found no new vulnerabilities in the portions of the protocol it examined, and Google DeepMind is releasing the specification and proofs it developed2.
What AlphaProof Code checked
Formal verification uses mathematics to demonstrate that software functions as intended, rather than relying on testing alone. Security researchers have long considered it a holy grail, but the process has historically required people to describe the properties they want to prove, translate them into formulas, and then build the proof by hand. AlphaProof Code's agentic AI takes on much of that final step, cutting the timeline from what would otherwise be a far longer manual effort.
The work covered selected cryptographic guarantees of the Signal protocol, not the entire Signal app. As a validation check, the researchers ran AlphaProof Code against older versions of the protocol that contained known, long-fixed vulnerabilities; the system correctly flagged them and showed those versions could not be formally verified.
The Google DeepMind researchers said they got a head start because of prior formal verification work by the Signal Foundation. Ehren Kret said Google DeepMind's approach enables significant expansion beyond earlier formal verification efforts that focused on smaller portions of the code.
Commercialization unclear
Google DeepMind conducted the analysis free of charge as a research project. Google declined to disclose the cost of the work or say whether it plans to offer formal verification as a commercial product or service.
ANALYSIS The result is notable on two axes: it independently validates cryptography that protects a large share of global messaging traffic, and it demonstrates that agentic AI can compress a task that previously demanded extensive manual labor into a matter of weeks. Whether that capability scales to larger, more complex codebases remains untested by this project.
Wired reported that AI-aided formal verification is gaining traction more broadly, though how practical it will be for widespread use and how effective it can be at securing large amounts of code remains unclear.