A four-week research project used Google's AlphaProof Code framework to verify key security properties of the Signal encryption protocol, highlighting AI's potential role in cybersecurity testing.
Google DeepMind has used artificial intelligence to examine the encryption technology behind messaging platform Signal, with researchers reporting no previously unknown vulnerabilities in the portions of the protocol they analysed. The findings emerged from a four-week proof-of-concept project that explored whether AI agents could help verify the security of widely used cryptographic systems.
The research involved AlphaProof Code, an AI framework developed by Google DeepMind to support formal verification, a mathematical process used to establish whether software meets specific security requirements.
Rather than relying solely on conventional vulnerability scanning, the researchers used AI-assisted methods to examine cryptographic guarantees within Signal's encryption protocol.
The analysis found no new vulnerabilities in the examined portions of the current protocol. However, the researchers emphasised that the findings do not represent a complete security assessment of the Signal application.
Signal's encryption protocol is used to protect private communications and has also been adopted by messaging services including WhatsApp, Facebook Messenger and Google Messages. Its open-source design allows researchers to examine the underlying technology and assess its security properties.
During the experiment, DeepMind researchers also tested older versions of Signal's protocol. The AI framework identified previously documented security weaknesses that had already been addressed through earlier updates.
The researchers said they would make the specifications and mathematical proofs developed during the project available to support further work on cryptographic verification.
Ehren Kret, Chief Technology Officer at Signal, said the research could extend existing verification efforts and provide additional confidence in the protocol's privacy protections.
The development comes as organisations increasingly examine how artificial intelligence can support software security assessments, particularly as AI-assisted cyber threats create additional challenges for developers and security teams.
Formal verification traditionally requires researchers to define software properties, translate them into mathematical statements and develop proofs demonstrating whether those properties hold. This process can be resource-intensive, particularly for complex software systems.
AI-assisted verification could help reduce the manual effort involved in these activities, although researchers have not established whether the approach can be deployed economically across large software environments.
DeepMind also acknowledged several limitations. The analysis covered selected cryptographic components rather than Signal's entire mobile application and built upon earlier verification work conducted by the Signal Foundation.
Researchers further indicated that human oversight would remain important when defining verification objectives and reviewing AI-generated proofs.
The project was conducted as a research initiative without financial cost to Signal. Google DeepMind has not announced plans to commercialise AlphaProof Code as a security verification product.
The findings demonstrate a potential application of AI agents in cybersecurity research while leaving questions about scalability, implementation costs and broader software verification unresolved.
Disclaimer: This article may include information derived from interviews, press releases, public statements, research, company communications and other publicly available or third-party sources. Such material may be summarised, paraphrased or contextualised for journalistic and editorial purposes. All rights in third-party content remain with their respective owners.