AI Governance Institute
← News
Research2026-11-10

AI Agents Formally Verified Signal's Cryptography in Four Weeks

What happened

Google DeepMind published Introducing AlphaProof Code: a breakthrough in verifying complex software at depth on November 10, 2026. It described a multi-agent AI system that formally verified Signal's end-to-end encryption protocol implementation. The system used a network of AI models working together. It was guided by the Lean proof language, a tool that allows software correctness to be checked by machine rather than by human inspection alone. It produced more than six million lines of verified proof in four weeks, work that Google DeepMind estimates would have required years of expert effort. Notably, when researchers reintroduced two previously identified and fixed security bugs into the codebase, AlphaProof Code detected both. No prior coverage of this specific development appears in recent news, though Anthropic's Formal Verification Research Raises the Software Assurance Bar addressed a related capability trend earlier this year.

Why it matters

  • ·Regulated sectors that depend on cryptographic protocols now face a rising standard of care. If AI can verify implementations at this speed and scale, auditors and regulators may begin asking why high-risk cryptographic code has not been formally verified.
  • ·The system independently found two real security bugs when they were reintroduced to the codebase. This sets a concrete benchmark for AI-assisted code review: compliance teams procuring software assurance services should ask vendors whether their review processes can match or exceed this detection capability.
  • ·When an AI agent produces a verification result, the question of accountability becomes concrete. Governance programs need documented answers to who owns the output and how it is validated before reliance. They must also document how output is retained for audit purposes under frameworks such as the NIST AI Risk Management Framework (AI RMF 1.0) and Playbook.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

SAF-004AI Reliability TestingMGV-008AI-Generated Deliverable Disclosure and Citation StandardsALC-004AI Explainability DocumentationPRC-003Third-Party AI Model EvaluationHOC-002Human Approval Gate for Consequential AI Decisions

What to do now

  • ☐Identify which of your organization's critical systems rely on cryptographic protocol implementations that have never been subject to formal verification, and document that gap in your risk register.
  • ☐Ask your engineering or security team whether any AI-assisted code review or verification tools are already in use, and confirm that their outputs are subject to human review before the organization relies on them.
  • ☐Update your software assurance procurement criteria to ask vendors whether they use AI-assisted formal verification, what the accountability chain is for verification results, and how findings are disclosed.
  • ☐Review your AI-generated deliverable disclosure and citation standards to confirm they cover outputs produced by AI verification agents, not just AI-generated text or code.
  • ☐Brief your audit committee on this development as evidence that the software assurance baseline in regulated sectors is shifting, and note that formal verification capacity may become an audit criterion within the next two to three years.

What to watch next

Compliance teams should monitor whether financial regulators and software auditors begin citing AI-assisted formal verification as a component of adequate assurance for cryptographic or other high-risk code. The EU AI Act (Regulation (EU) 2024/1689) and emerging sectoral guidance may eventually address the accountability chain for AI-generated verification outputs. Watch also for Google DeepMind to announce commercial or partner availability of AlphaProof Code, which would move this from a research benchmark to a procurement decision for assurance teams.

Related Coverage

Research2026-11-10

Two-Thirds of Agent Failures Look Like Successes on Transcript Review

Microsoft research published November 7, 2026 introduces ThinkingBox. The framework evaluates AI agent tasks by checking the actual database state rather than trusting what the agent reported. Across 121,680 trials, roughly two in three failed runs appeared complete based on conversation logs alone. The same verification method was then used as a training signal, nearly tripling consistent task success for one model.

Research2026-11-09

Google DeepMind AI Agents Cut RSA-1024 Attack Cost 3.5x, Forcing Cryptographic Inventory Action

Google DeepMind, with researchers from UC San Diego and Inria, used AI agents to reduce the computing cost of attacking legacy 1024-bit RSA encryption by 3.5 times. The agents completed the work in under four days with minimal human oversight. Modern key lengths of 2048 bits or larger are unaffected, but organizations still using legacy RSA-1024 in any system face elevated risk.

Research2026-11-08

Coding Agents Expand the Security Boundary Beyond What Traditional Tools Cover

A Forrester analyst commentary published November 5, 2026 argues that AI coding agents introduce a security perimeter that traditional tools cannot assess. The expanded boundary includes AI models, MCP servers, skills, hooks, extensions, and plugins. Compliance teams are advised to maintain inventories of agentic dependencies, require workflow-specific vendor testing, validate AI-generated code, and strengthen access and monitoring controls.