NewsPublished 10 Nov 2026

Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code

Source SecurityWeek

Description

Google has expanded access to its Gemini 4 Carbon AI model, which was used by DeepMind to formally verify the security guarantees of the Signal protocol's reference implementation (libsignal). This verification includes guarantees such as forward secrecy, post-compromise security, and authentication at the compiled machine code level. The AI-driven formal verification process significantly reduced the time required for proof generation and helped reclassify and patch critical bugs in open source projects. The verification excludes side channels and applies to Google's build of the code, not Signal's own applications. This advancement suggests AI can make formal verification more practical for real-world security-critical software.

Impact

The formal verification of libsignal's implementation by AI agents provides strong mathematical guarantees for key security properties, increasing confidence in the privacy and security of applications using this code, including WhatsApp and Google Messages. The verification helped identify and confirm critical vulnerabilities comparable in severity to known exploited PHP flaws, enabling timely patching. However, the verification excludes side channel attacks and applies only to Google's build of the code, not the official Signal applications. This advancement reduces the risk of undetected implementation flaws in the verified codebase but does not eliminate all potential attack vectors.

Defensive guidance

No direct mitigation actions are required by end users or developers as this is a verification and assurance effort rather than a vulnerability report. The verified codebase has been patched for critical bugs identified during the process. Developers and organizations using libsignal or related implementations should ensure they use updated, patched versions. The verification results and specifications have been publicly released to support transparency and further security assurance efforts.

Summary

Google's Gemini 4 Carbon AI model, now accessible to paying developers and businesses, was employed by DeepMind to assist in formally verifying the libsignal implementation of the Signal protocol. Human experts collaborated with AI agents running on Carbon and Claude Opus 5.5 to write formal specifications and generate approximately 6.5 million lines of Lean proofs, which were validated to ensure correctness. The verification covers critical security properties such as forward secrecy, post-compromise security, and authentication at the machine code level, surpassing typical protocol design-level verification. The process enabled rapid identification and reclassification of critical bugs, leading to swift patching. While the verification excludes side channels and applies only to Google's build, it demonstrates AI's potential to make formal verification feasible and scalable for complex, security-sensitive software systems.

References

securityweek.com/google-widens-gemini-4-carbon-access-after-ai-agents-verify-signal-code/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Nov 2026, 16:48 UTC

References

Community reviews