Google DeepMind's AlphaProof Code formally verifies Signal's libsignal at the machine-code level: ~6.5M lines of Lean written by Gemini Carbon agents in four weeks

Why it matters

【Key points】

· Nov 10, 2026: Google DeepMind introduces AlphaProof Code, a multi-agent formal-verification framework.

· It proves key security properties of libsignal (PQXDH handshake and Triple Ratchet: forward secrecy, authentication, post-compromise security) at the AArch64 machine-code level.

• · ~6.5M lines of Lean proofs, kernel-checked, on a ~26K-line trusted base.
• Humans vet the specs; Gemini Carbon-powered agents write the proofs.
• About 1% of the work was flagged for human review.

• · Done in ~4 weeks.
• Two re-injected historical bugs were both proven insecure.
• The Lean development is open-sourced.

【Our read】

· Background: seL4 took ~20 person-years to verify. This targets unmodified production code as compiled.

· Comparison: Anthropic × Theorem (e/1045) covered breadth (123 libraries, crash-freedom). AlphaProof Code covers depth (cryptographic security properties).

· Impact: a rare public result for Gemini Carbon, which is still gated to cyber defenders. Watch third-party proof checking and external access to the framework.

【Verifiable】

• ·
• ·
• ·