Google DeepMind's AI agents prove key Signal protocol guarantees in four weeks

Google DeepMind says a team of AI agents has mathematically proved that key cryptographic guarantees in the Signal protocol's code hold up, and that the work took four weeks. Formal verification of this kind has traditionally been slow, manual work that only a few specialists can do.

The result matters well beyond Signal's own user base. The same protocol encrypts conversations in WhatsApp and Google Messages, so the code DeepMind examined underpins a large share of the world's private messaging. For years, the Signal protocol's reputation as the strongest option for end-to-end encryption has rested on expert review and real-world use. A machine-checked proof is a much harder kind of evidence.

The analysis found no new vulnerabilities in the parts of the protocol it covered. The researchers also ran a control test: they pointed their tool, called AlphaProof Code, at older versions of Signal that contained known flaws that have long since been fixed. The tool flagged those versions and showed that their protocol code could not be formally verified.

That control test is the most persuasive detail in the announcement. A verification system that approves everything is useless. One that rejects code with known bugs and approves code without them is doing the job it claims to do.

How the agents and humans split the work

Formal verification is different from ordinary security testing. Testing hunts for bugs and can only report the ones it finds. A formal proof shows mathematically that the code meets a stated set of properties in every possible situation, which is why security researchers have long treated it as the highest standard of assurance. The catch has always been the labor. People have to describe precisely what the software should do, turn that description into formal logic, and then build the proof step by step.

DeepMind describes AlphaProof Code as an agentic framework that pairs human experts with AI agents. Humans worked alongside the agents to decide which properties needed to be proved. Multiple agents running Gemini Carbon, Google's latest model, then produced the proofs. The agents also audited their own output and sent only about 1% of the codebase back for a human to review, which the researchers called "a massive time savings."

The project did not begin from zero. DeepMind built on formal verification work that the Signal Foundation had already done without AI, and the researchers acknowledge that this gave them a head start.

Swarat Chaudhuri, a DeepMind research scientist, told WIRED that the team deliberately avoided a fully automated loop in which AI both sets the goals and writes the proofs. "There's a middle ground," he said. That design choice deserves more attention than the speed. A proof only guarantees the properties it was asked to prove. If an AI writes the specification and then proves its own specification, the result can look rigorous while answering the wrong question. Keeping humans in charge of what counts as correct is what makes the output trustworthy.

Signal's chief technology officer, Ehren Kret, said in a statement that the new approach goes beyond what earlier efforts covered.

"While prior formal verification focused on smaller portions of the code, Google DeepMind's approach enables significant expansion," Kret said.

He added that the verification gives Signal greater confidence in its code's privacy guarantees as AI-driven security threats grow.

What the proof doesn't cover, and what it cost

The scope has limits. DeepMind verified the protocol's core cryptographic guarantees, not the entire Signal mobile app. Bugs in the app's interface, its handling of files or the phone it runs on fall outside the proof. The proof also covers Signal's own code. WhatsApp and Google Messages use the same protocol, but the result does not directly certify how those companies built it into their apps.

DeepMind is making large claims all the same. The researchers called it the first time AI has formally verified a widely deployed cryptographic protocol at this depth. They also said it is the first time the implementation of a widely deployed protocol like this has been formally verified by any method. Those claims are carefully qualified. Verified cryptographic code is not new, and phrases such as "at this depth" and "like this" carry much of the weight. The more defensible claim is narrower: a major lab has shown that AI agents can do much of the hardest part of this work on real, heavily used code.

The biggest unknown is cost. DeepMind did the Signal analysis for free as a research project, and Google declined to tell WIRED how much it cost. Google also told WIRED it is not yet clear how practical the method will be for broader use. The company declined to say whether it plans to sell formal verification as a product or service.

Chaudhuri was open about the gap between this project and the ambition behind it. There is still "a long distance to go," he told WIRED, before the technique can scale to all the world's software, which the team says it wants to do.

Pushmeet Kohli, chief scientist at Google Cloud and DeepMind's vice president of research, described the goal in commercial terms. He pointed to banks and other companies that rely on assurances about their code.

"If you can now verify the correctness of these implementations, then you can rest easy," Kohli told WIRED.

DeepMind also said the work could help secure other critical systems, including medical device firmware and power grid software.

That pitch is believable, but the Signal project was close to a best case. The protocol is compact, well documented and already partly verified. Its expected behavior is unusually well defined, because cryptographers have studied it for years. Most corporate software has none of those advantages. Its specifications are often vague, outdated or missing entirely, and writing them down is the part that still needs people. Four weeks on Signal does not mean four weeks on a bank's core systems.

The timing helps explain why DeepMind is pushing this now. AI tools have recently proved good at finding vulnerabilities in software, and 2026 has brought a run of AI-related security incidents, many involving agents. Anthropic, Google and OpenAI are all building security-focused models, including Anthropic's Claude Mythos. Finding bugs faster helps attackers as much as defenders. Proving that code has no bugs of a given kind is the one approach that doesn't help attackers in the same way.

DeepMind is releasing the specification and proof it developed for Signal so other researchers can build on them. That is the most concrete outcome so far. Outside experts can check the work, and other teams have a template to follow. Whether AI-assisted verification becomes routine depends on the figure Google has not shared: what it costs to repeat this on code that has not already been studied for years.