Google AI Proves Signal’s Encryption Really Works

Plus: Fireworks Cyberattack Exposes Customer Data And AI Models As Fallout Widens

Download the App • Newsletters • MyForbes

Google DeepMind researchers say their AI agents helped mathematically prove the encryption protecting messages sent over massively popular apps like Signal and WhatsApp is secure.

In what they claim is a first, the researchers say the agents were able to verify that the Signal protocol, which is also used to protect Google Messages, was running correctly and without flaws, meaning there are no known exploits of its encryption.

In the current environment of fear surrounding AI’s use of offensive cyber operations, Google’s research shows how artificial intelligence can be used for benevolent reasons. In this case, Signal’s cryptography had already been validated by humans, but the AI allowed the researchers to go deeper than ever before in proving it worked.

The agents wrote three million lines of Lean, a computer language that is designed to mathematically prove the accuracy of code. After the Lean program checked the maths that encrypted Signal messages, the agents highlighted what areas needed human validation. The project was done within four weeks; a comparable human-only verification project like this can take years, Google’s researchers said.

They believe the research has positive implications for cybersecurity in general, writing: “Achieving this long-standing challenge demonstrates how AI can bring elite security assurance to businesses, governments, and critical infrastructure, helping defend against agent-driven cyber threats.”

While the researchers didn’t set out to find any new vulnerabilities in Signal, they did test their AI on historical versions of the protocol and demonstrated that it successfully flagged previously patched bug classes. That shows the AI can flag flaws in future projects where it’s trying to improve a given piece of software’s security.

Signal’s chief technology officer Ehren Kret said the Signal Foundation, the nonprofit that maintains the encrypted messaging app, added, “As AI-driven security threats grow, rigorously verifying the Signal protocol implementation gives us even greater confidence in our code's privacy guarantees.”

Got a tip on surveillance or cybercrime? Get me on Signal at +1 929-512-7964.

Thomas Brewster Associate Editor, Cybersecurity

Follow me on Forbes.com

CREDIT: Cody Pickens for Forbes and Getty Images

The Big Story

Fireworks Cyberattack Exposes Customer Data And AI Models As Fallout Widens

Read Article

Hackers have repeatedly broken into Fireworks, a $17.5 billion-valued infrastructure provider that helps large enterprises and startups build and run their own AI models.

The company said Monday some of its customers’ datasets and models were accessed by hackers over the last month, while multiple clients tell Forbes they’re leaving the platform due to concerns about their data security.

The Stories You Have To Read Today

France has blamed Iranian hackers for a string of cyberattacks on supermarkets that led to their freezers overheating and food stocks ruined. French bloodbanks were also hit during the cybercrime spree.

Earlier this year, Binance fired a number of internal investigators following their calls for an investigation into illegal Iranian activity on the crypto exchange. While Binance says it let the employees go over data privacy policy concerns, at least one of the ex-staffers has provided what they claim is evidence of the company’s wilful blindness to suspected Iranian money laundering, Forbes reports.

Bitcoin tracking company Chainalysis is bringing its services back online for its law enforcement and private customers, following a cyberattack that it claimed contained traces of AI agentic behavior. The hackers made off with a range of customer data, including hashed passwords.

Winner Of The Week

Cyera, an Israeli cybersecurity company that identifies and protects sensitive customer data, is planning to raise another $300 million to take its valuation to $20 billion, Calcalist reports. That’s up from a $12 billion valuation earlier this year, as the Cyberstarts investment vehicle pumps more money into the business.

Loser Of The Week

Claude Code has been leaking sensitive developer information on Github, including database passwords, because of a bug in the way it handled user settings, Ars Technica reports.

More From Forbes