DeepMind agents write 3 million lines of Lean proofs for Signal's crypto code

DeepMind announced AlphaProof Code on November 10, 2026. <cite index="4-1">Its post opens by saying agents wrote over three million lines of machine-checked Lean proof</cite>, but the same post later cites <cite index="4-3">over six million lines of Lean</cite>, and the accompanying paper reports <cite index="7-13">about 6.5 million lines of machine-checked Lean proof</cite>. <cite index="7-8">The target is libsignal, the Signal protocol reference implementation.</cite> The proofs cover <cite index="11-11">forward secrecy, authentication, post-compromise security and handshake secrecy</cite>, checked against <cite index="7-11">compiled AArch64 code, not a model of the design.</cite>

The effort ran for four weeks with five researchers who kept agents working <cite index="1-4">continuously on their workstations, pursuing symbolic and computational proofs in parallel.</cite> <cite index="1-6">Gemini Carbon agent teams generated all the proof code, and none of the authors wrote proof code.</cite> <cite index="1-7">A gatekeeper accepted a proof only after Lean's kernel checked it and a comparator confirmed it matched the held-out, human-approved specification.</cite> <cite index="14-7">Human experts reviewed every specification before any proof ran</cite>, and <cite index="11-5">agents flagged about 1% of the codebase for a second human look.</cite>

To test whether the system could separate correct code from buggy code, the team reintroduced two previously fixed bugs into an isolated copy. <cite index="10-2">The system caught both.</cite> Signal's CTO, Ehren Kret, said the approach expands on earlier formal checks that covered <cite index="4-7">smaller portions of the code.</cite> <cite index="11-7">The proofs assume perfect cryptography and leave the full Signal app unverified, according to DeepMind's paper, The Register and WIRED.</cite>