DeepMind's AI checked Signal's encryption code in four weeks and found no new flaws

What DeepMind says it did

As The SOFX Report reported, Google DeepMind researchers used a new framework called AlphaProof Code to check key security protections in Signal, the encrypted messaging app. An agentic framework is a setup where AI programs work through a task in multiple steps with some independence. Here the agents were powered by Gemini, Google's AI model family.

According to Google's blog post, those agents produced millions of lines of mathematical proofs. The goal was to confirm that the software actually delivers the protections it promises, rather than just appearing to.

DeepMind says this is the first time the real code of a widely used encryption protocol has been formally verified, by AI or by any other method. That is the company's own claim, and the report does not describe any independent check of it.

Proving is not the same as testing

Formal verification means using math to prove that software behaves as intended. Ordinary testing shows a program works on the cases someone tried. A proof aims to show a property holds in every case. That is why it is considered one of the highest standards of software security.

The catch is labor. Writing these proofs has traditionally demanded long, careful work from teams of experts. That cost is why the method has been reserved for a small number of high-stakes systems.

A common pattern in AI-assisted proving, which is general background rather than a detail from this report, is to let the AI propose proofs while a separate, simple checker accepts only the valid ones. A wrong guess gets rejected instead of trusted. The report does not spell out DeepMind's exact setup, so treat that as an explanation of the idea, not a description of this project.

What the check found, and what it did not

The headline result is quiet. AlphaProof Code did not find any new vulnerabilities in the portions of the Signal Protocol it examined. That is the outcome a messaging app's users would hope for, though it applies only to the parts that were checked.

The tool did detect security flaws that researchers had already found and fixed in older versions of the software. That detail matters because it shows the method can spot real problems and is not simply approving everything it is shown.

The speed is the other notable claim. The project took four weeks. Swarat Chaudhuri, a research scientist at Google DeepMind, said the same work would likely have taken humans several years without AI help.

Signal's chief technology officer, Ehren Kret, said the work gives more confidence that the app's encryption provides the privacy it promises.

Limits and what comes next

The report flags open questions about cost, scalability and how much human oversight is still needed. Those are the practical hurdles. A four-week result on one well-studied protocol does not show that the same approach will work cheaply on messier software.

It also helps to remember what a proof covers. A verified property holds only for what was examined and only for the properties chosen. It says nothing about a stolen phone or a careless user. 'Verified' is not the same as 'unhackable'.

DeepMind says the technology could make advanced security checks faster and cheaper, and could extend them to critical systems such as medical devices and power grids. It is not alone: Anthropic and the startups Theorem, &Truth and Harmonic are also exploring AI-powered mathematical verification. That points to growing interest in using AI to find and prevent software vulnerabilities before release.

• Signal users do not need to change anything because of this report.
• The report comes from a single outlet, summarizing Google's blog post.