Signal: AI agents proved its code keeps its promises, what does that change for your messages?

Six and a half million lines. That's the size of the mathematical proof that Google DeepMind's AI agents wrote to prove that the code behind Signal, the encrypted messaging app, really delivers on its promises. Not the plan on paper: the code as it runs on the processor. In four weeks, whereas, according to DeepMind, work like this used to take teams of experts years. And not one of the researchers wrote a single line of proof: the agents did everything. Announced Tuesday, November 10. After the two flaws in the old RSA encryption that the same lab found a few days ago, here's the other side of the coin: AI that doesn't break things, but guarantees them.

DeepMind checked Signal's code piece by piece, like taking apart a lock

What does Signal actually protect?

When you send a message on Signal, it's encrypted on your phone and only decrypted on your correspondent's phone. Nobody in between, not your carrier, not even Signal itself, can read it. The recipe is called the Signal Protocol, and it's also what protects Google Messages conversations. WhatsApp uses it too, but with its own code, which isn't the one verified here.

DeepMind proved three promises of this protocol. One: you're really talking to the right person, not someone pretending to be them. Two: if a hacker steals your phone's keys one day, they still can't read your old messages. Three, and this is the most impressive part: if your phone has been hacked for a while, the conversation becomes secret again once the hacker is gone. The protocol changes its keys with every exchange, like a lock that replaced itself after every time someone passed through.

The house plan, or the house that was built

What makes the work unique is where the proof was done. Proving that a protocol is solid on paper, researchers have known how to do that for a long time. But between the plan and what really runs on the phone, there's the code, then the translation of that code into instructions for the processor. And that's where most of the real flaws hide: the architect planned an armored door, and the mason put in a cardboard door.

Flaws often hide between the plan and what was actually built

DeepMind went to check the house that was built. The agents, powered by Gemini 4 Carbon, worked directly on machine code, the code the processor executes. And every step of their reasoning was checked by Lean, the software that checks a proof line by line and rejects anything that isn't justified all the way through. According to DeepMind, this is the first time the code of an encryption protocol used on a large scale has been checked this deeply, AI or not.

The figures, taken from the technical report published with the announcement: about 6.5 million lines of proof, based on about 26,000 lines of “specification” written and reviewed by humans. The agents reviewed their own work and flagged only about one line in a hundred for a second human look. The experts therefore focused on the most important things: choosing what to prove, deciding ambiguous cases, and validating the result.

And to check that all this wasn't saying “yes” to just anything, the team put two real Signal bugs, fixed long ago, back into an isolated copy of the code. Both times, the system produced proof that this version was vulnerable. A smoke detector that goes off when you light a match, that's still reassuring.

Two old Signal bugs put back into the code: both times, the system detected them

Ehren Kret, Signal's technical director, didn't hide his delight: “Using AI agents to translate real code into valid Lean theorems is a major breakthrough.” He adds that it gives him “even more confidence” in the privacy guarantees of his code.

Meanwhile, on the other side

The same week, we got the opposite demonstration. On November 8, the security lab Malbear Labs told how an AI agent based on DeepSeek Flash, unrestricted so it would never refuse anything, stayed for more than fourteen days inside the network of a European telecom operator. Its human operator only gave it instructions like “continue”, and the agent chose its attacks on its own, writing its own tools when its way through was blocked. The most infuriating part: it got in through known vulnerabilities, some more than ten years old. The operator was not named and the exact scale was not verified by others, but the story clearly shows the situation.

Attackers now have patient agents that try every door, day and night. The answer can no longer be to patch the holes one by one. We need to be able to say: that door there, we have proved it cannot open.

The fine print, because there is some

The technical paper is much more honest than the announcement, and that's to its credit. What was verified is the core of Signal, the code component shared by all its apps (libsignal, version 0.105.4), wrapped in a small program with no interface, on the type of processor found in phones (ARM), under Linux. Not your entire phone app. The researchers specify that the result applies to Android and iPhone provided you trust the system, which runs this same code.

Other parts remain outside the scope of the proof. Group conversations are not covered, only one-to-one conversations. The encryption components themselves are assumed to be solid, not proved. Key generation is not verified. And attacks that spy on the phone by indirect means, by measuring computation time for example, are explicitly outside the subject. Finally, everything rests on the specifications written by humans: if it forgets a promise, the proof will not cover it.

None of this takes away from the value of the work. But “proved” does not mean “invulnerable”: it means that what was promised in black and white is upheld, no more and no less.

So, what does this change for you?

If you use Signal, there's nothing to do, nothing to update. Your messages were already encrypted yesterday. The difference is that today, part of what protects them is mathematically proved, and not just tested. A bit like a bridge whose calculations for every bolt had been checked instead of merely driving trucks over it.

Testing a bridge with trucks, or checking every bolt: the two do not provide the same guarantee

The real change is for later, and it concerns you even if you have never installed Signal. DeepMind wants to apply the method to medical device software, such as an insulin pump or a pacemaker, and to software that controls the power grid. These are exactly the places where “it seems to work” is not enough.

This kind of guarantee already exists, but it costs a fortune. Since the beginning of the 2000s, Airbus has had a mathematical tool, Astrée, check that the flight control software of its planes does not contain certain errors that could make it crash in mid-flight. Years of work by specialists, reserved for things that can kill hundreds of people at once. If AI agents do this work in a few weeks, the same guarantee could reach much more ordinary devices.

The timeline? For Signal, it's done, and the proofs are public on GitHub. For the rest, DeepMind says itself that it will take “more research” to scale up. I would say a few years for the first medical devices, and probably much longer for it to become the norm.

For me, this is one of the best pieces of news of the year in security. We spend our days reading stories about AI breaking things, and for once, we have one that proves something holds up. And if someone in your family is still hesitating to install Signal, you now have one more argument!

Sources

• Google DeepMind, November 10, 2026: Formal Verification of Signal's Protocol with Gemini (in English)
• The technical write-up: AlphaProof Code, Verifying Signal's Security at the Machine-Code Level (in English)
• Infosecurity Magazine: an unrestrained AI agent attacked a European telecom operator for two weeks (in English)

Article written with the help of Claude Code, proofread and corrected by me.