Most security news about AI is about finding bugs. Google DeepMind's AlphaProof Code is about proving their absence, at least for specific properties, in code that billions of people use. DeepMind says its agents proved key security properties of the compiled code behind the Signal protocol, which also underpins encryption in WhatsApp, Messenger and Google Messages. It calls this the first time the implementation of such a protocol has been formally verified by any method.
The working method matters as much as the result. A specification-writing agent worked with the researchers to turn security goals from the research literature into Lean, reviewer agents critiqued the drafts, and humans approved every specification. Prover agents running on Gemini 4 Carbon then wrote the proofs. They flagged about one percent of the codebase for a second human look, and Lean's kernel checked everything else. According to the accompanying paper, a team of five did the work over four weeks, each running agents nonstop on their own machine, against libsignal version 0.105.4.
The test that should persuade sceptics is the bug check. The team put two real, already-fixed bugs back into an isolated copy of the code. In both cases the system produced a machine-checked proof that the buggy version was insecure. One involved libsignal storing a new session's state, including a secret key, after a message that should only have decrypted under an older session. Signal's chief technology officer, Ehren Kret, said earlier verification had covered smaller parts of the code and that translating live code into valid Lean theorems was a major advance.
For developers, the broader point is that formal proof is becoming affordable. The paper contrasts this with seL4 and CompCert, verified over years of expert effort on code written for the purpose. Tools such as Lean LSP MCP, which we review, already let a coding agent work against Lean's checker, and DeepMind is releasing its own verification artefacts publicly.
The limits are spelled out. The verified scope is the one-to-one session code, not every part of Signal. The symbolic guarantees assume perfect cryptography, and the results trust Lean's kernel and the contracts of some routines the code calls. DeepMind itself says scaling the method needs more research. And a proof is only as strong as the specification it proves, which is why the human-approved specifications are the part most worth outside review.