Google's AI proved that Signal's encryption code keeps its promises. Here is what that does and does not mean

On Tuesday 10 November Google DeepMind, Google's AI research lab, announced that its AI agents had mathematically proved that the code behind Signal's encryption does what it promises. Signal is the messaging app that security people trust most, and the same protocol (the agreed set of rules for scrambling messages) is used, in variants, by WhatsApp, Facebook Messenger and Google Messages. So this is the lock on a large share of the world's private conversations.

The headline numbers come from Google's own paper. The AI produced about 6.5 million lines of proof. A team of five people ran the agents for four weeks. Google says nobody has proved security properties like these for the actual, unmodified code of a protocol this widely used before, with or without AI. Signal's chief technology officer, Ehren Kret, called using AI agents to turn live code into checkable theorems "a major breakthrough".

What normally happens. Most software is made safe by testing: you try lots of attacks and fix what breaks. Testing can show a bug exists, but it can never show that none are left. The alternative is formal verification: you write down, in precise maths, exactly what the software must guarantee, then prove that the code meets it in every possible situation. It is the gold standard, and it is brutally expensive. The paper notes that verifying seL4, a small operating-system core, took about twenty person-years, and the CompCert compiler took about six.

What Google did. Its system, called AlphaProof Code, splits the job. First, humans work with an AI 'specification writer' to state Signal's security goals in Lean (a programming language for maths proofs that a computer checks line by line). Humans approve every specification. Then a team of autonomous AI prover agents tries to prove the code meets it. A final 'gatekeeper' accepts a proof only if Lean's checker confirms it, so the AI cannot simply claim success. Google's announcement says the provers ran on its Gemini models.

What was proved. The proofs cover Signal's post-quantum handshake (how two phones agree on secret keys, designed to resist future quantum computers) and its Triple Ratchet (how keys keep changing during a chat). They establish forward secrecy (if a key leaks today, yesterday's messages stay safe), authentication (you are really talking to who you think) and post-compromise security (the conversation heals after a phone is briefly hacked). Crucially, the proofs are about the compiled machine code, the actual instructions a phone's processor runs, about 140,000 of them. Bugs often hide in the gap between a clean design and the real program, and this closes that gap for the properties checked.

The bug test. To check the system was not just rubber-stamping, the team put back two real bugs that researchers had found in Signal's code and that were already fixed. In both cases the system produced a checked proof that the buggy version was insecure.

Think of a new bridge. Testing is driving heavy lorries over it and watching for cracks: useful, but you only learn about the lorries you tried. Formal verification is an engineer's calculation showing that every beam holds under every load up to the stated limit. Most such calculations are done on the drawings. What Google did is closer to measuring the bridge as actually built, bolt by bolt, and proving the calculation still holds for that bridge.

The catch is the phrase 'up to the stated limit'. The proof is only as good as the specification. If nobody wrote down a danger, the proof says nothing about it. That is why the 26,000 lines of human-approved specification matter more than the 6.5 million lines of proof: the computer checks the proof, but people have to check that the question was the right one.

Parts of it are not. Computer-checked proofs of software go back decades (seL4 in 2009, CompCert before it), and researchers have analysed Signal's design formally many times; one such study found the two bugs Google reinserted. Google's AlphaProof reached silver-medal level at the International Mathematical Olympiad in 2024. And AI is already very good at finding bugs, as we wrote recently.

What is new is the combination: proofs about the real, unmodified code of software used by billions, at the level of machine instructions, in weeks instead of years. Finding bugs is a race you never finish. Proving their absence, if it becomes cheap, changes the game for defenders.

What it does not mean. This is not a stamp saying 'Signal cannot be hacked'. The paper is clear about its limits. It proves specific properties, not everything. It assumes the underlying cryptographic maths is sound. It checked Signal's core library running in a test harness, not the full Signal app on your phone, and not WhatsApp's own implementation. One of the post-quantum guarantees is not yet proved. And this is Google's own paper, published this week, not yet independently reviewed, although the proofs are public and anyone with a big enough computer can re-check them.

What it does mean. The most expensive kind of software assurance just got dramatically cheaper. Google suggests the next targets could be things like medical-device firmware and power-grid software. As attackers use AI to find holes faster, defenders being able to prove whole classes of holes do not exist is a hopeful twist.

For builders in our community the lesson is practical: when you ask an AI to write code, the hard part is moving from 'write it' to 'state precisely what it must guarantee'. That is the human skill in this story, and it is the one worth learning.