Artificial intelligence became popular for writing: text, images, code and answers. A Google DeepMind announcement points to a deeper change. AI is beginning to help not only produce software, but prove that it satisfies specific properties.
Google DeepMind introduced AlphaProof Code, an agent system that worked with human specialists to create mathematical proofs about the code implementing Signal's cryptographic protocol. According to the team, the work verified key properties of production code and directed human review toward the areas requiring closer attention.
The statement that AI verified Signal code does not mean every part of the application was proven perfect or that no bug can exist. It means that defined properties were checked using a formal system. That precision is exactly what makes the story valuable.
What does formal software verification mean?
Traditional testing runs examples: it provides inputs and checks whether outputs match expectations. Testing is essential, but it cannot cover every possible combination in a complex system.
Formal verification translates expected behavior into mathematical specifications and uses tools to determine whether code satisfies them. In this work, Lean, a proof assistant, rigorously checked each logical step.
The distinction can be summarized simply:
- A conventional test asks: “Does it work in these cases?”
- Formal verification asks: “Can we prove this property under the defined conditions?”
What did AlphaProof Code do?
The system organized the work like a team. Human experts helped decide what should be proved and reviewed specifications; multiple agents generated proofs; and an independent tool checked their validity.
Google DeepMind reported that the process produced millions of lines of Lean and focused human attention on a small portion of the work. Researchers also reintroduced two previously fixed bugs into an isolated code version, and the system proved those versions insecure.
The point is not that AI worked alone. The result came from combining human objectives, specialized agents and a verifier that does not accept a conclusion merely because it sounds convincing.
Why was Signal an important test?
Cryptographic protocols protect communications, banking and sensitive data. Yet there is a gap between designing a correct protocol and ensuring that the code running on devices preserves those properties.
Signal provided a meaningful case because its protocol protects conversations in widely used services. Verifying aspects of the real implementation moves mathematical assurance closer to the software people actually run.
The lesson for a company that does not build cryptography
Most businesses do not need to prove every line of their platform mathematically. They can still adopt the central principle: an important automation should have verifiable criteria.
For example, a scheduling agent should provide evidence that it:
- offers only genuinely available times;
- does not create two bookings for the same slot;
- requests approval for an exception;
- does not access information outside its function;
- stops reminders when a person cancels;
- records every state change.
This does not necessarily require formal verification. It requires moving from “it seems to work” to “we can show under which rules it works.”
A common story: the workflow that worked in the demo
A company tests an agent with ten controlled conversations. Everything works, so it connects the agent to real customers. Duplicate names, different time zones, ambiguous messages and situations omitted from the demonstration begin to appear.
The initial test was not useless. It simply evaluated happy examples rather than process properties: what must always happen, what must never happen and when the system must stop.
A stronger design converts those conditions into testable rules. Every change is checked against them and every action leaves evidence. The team can improve the agent without relying solely on random conversation reviews.
Generation will become inexpensive; proof will become valuable
When many tools can create code, pages, messages or automations in minutes, speed is no longer enough. The questions change:
- Who defined the expected behavior?
- Which edge cases were tested?
- What data may the system access?
- How do we know permissions were respected?
- What happens when an integration fails?
- Can a person reconstruct the decision?
Companies that answer those questions will have a more durable advantage than companies that only generate faster.
The human role does not disappear
In AlphaProof Code, people defined security goals, reviewed specifications and handled areas highlighted by the system. Automation expanded the team's capacity, but did not independently decide what “secure” meant.
The same applies in business. AI can execute rules, watch processes and flag anomalies. People remain responsible for defining priorities, resolving exceptions and deciding which risks are acceptable.
How to apply this approach to an automation
- Describe the expected result in observable terms.
- Define prohibited actions and access boundaries.
- Collect normal cases, exceptions and incomplete data.
- Test the process before granting autonomy.
- Record inputs, decisions, actions and outcomes.
- Retest whenever an integration changes.
- Maintain a clear way to stop and review the system.
How Ainoa can help
Ainoa designs Custom Intelligent Agents around specific processes, with rules, integrations and escalation paths defined for the operation.
Custom Administrators make status, history, permissions, metrics and exceptions visible. That visibility helps confirm that automation produces the intended outcome and makes correction easier when the process changes.
Frequently asked questions
Did Google prove Signal can never have a vulnerability?
No. The work verified specific properties within a defined scope. The conclusion should not be extended to elements outside that scope.
Does every company need formal verification?
No. Its cost and complexity are especially justified for critical systems. Every company can still use verifiable rules, structured tests and logs.
Can AI review its own work?
It can assist, but review based only on a similar model may repeat errors. A stronger process combines agents, deterministic tools and human review.
The next standard will be the ability to explain and prove
The news that AI verified Signal code opens a different paradigm. The future of development will not consist only of producing faster. It will involve systems whose behavior can be observed, tested and justified.
If you are planning to automate an important process, do not begin with the model. Begin with the rules that must always hold. Ainoa can help turn those rules into a custom agent and administrator with testing, traceability and human control.