David Wong

Our teams put Gemini 4 Carbon to work on a major security challenge: mathematically proving the code underlying the Signal protocol. Using AlphaProof Code, @GoogleDeepMind researchers guided agents to verify the protocol down to compiled device code, closing the gap where real bugs hide. The result: - Gemini 4 Carbon generated over 6M lines of machine-checked Lean proofs - years of expert manual verification compressed to just weeks ~1% of the codebase required human review (Lean automatically checked the rest) This is helping unlock scalable formal verification for building secure software, laying the groundwork to fundamentally shift the advantage to defenders. We’re open sourcing the results for the security community.

BREAKING: Nvidia, $NVDA, CEO Jensen Huang sends a company-wide email regarding his recently reported relationship with a Chinese spy.

Frontier cyber agents are getting better at two things at once: finding vulnerabilities and staying inside the rules researchers set. The harder part is no longer just model capability; it’s where the system still fails once the model is good enough to act. 1) OpenAI says GPT-6 Cyber scores 48.5% on ExploitGym, up from 32.1% for GPT-5.6 Cyber, and 40.3% recall on a new offensive web vuln-discovery eval vs 32.0% for GPT-6 Astra. They also report 99.93% out-of-scope avoidance without the deployment prompt, and 100% with it. The release also claims it helped develop 948 Linux privilege-escalation exploits and identify 81 previously unknown high-severity Firefox vulns. These are vendor-reported numbers, so the takeaway is capability is rising, but the claims still need independent validation. 2) Signed but Not Safe shows what happens at the handoff layer in multi-agent systems. In a preregistered study, signed requirement manifests cut unsafe commits under attack from 69.4% to 9.0% with Qwen3-8B, and the verifier beat an LLM checker on the same trajectories. But signing only protects requirements in transit: when the orchestrator extracted the wrong requirement before signing, the signature faithfully preserved the mistake. The residual risk is extraction. 3) SPILLWAY makes a similar point for tool-using agents. It separates target admission from sanitization, using deterministic checks on typed tool returns plus a sanitizer that strips injected instructions before the model reads them. Across the tested backbones and suites, in-scope attack success went to zero. Its limitation is explicit: it covers identity targets, depends on declared tool roles, and still leaves some cases to a judge and delegation rules. Taken together, these are not proofs of a universal shift, but they do show where the practical trust boundary is moving in evaluated agent systems: provenance, extraction, typed tool outputs, and deterministic enforcement around the loop. openai.com/index/introducing… arxiv.org/abs/2611.07483 arxiv.org/abs/2611.07222