[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f795OqRYZLlCERdjkTwH5XQ0jY4rVruDQ19hezLuooCM":3},{"article":4,"iocs":55,"watch_terms":60,"solutions":61,"lesson":125},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"a4ccb297-cca0-4143-aab5-8a2ff7c391e4","Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code","google-widens-gemini-4-carbon-access-after-ai-agents-verify-signal-code-cb2901","Google opened Carbon to paying developers and businesses as DeepMind used agents built on it to prove libsignal security guarantees. The post Google Widens Gemini 4 Carbon Access After AI Agents Verify Signal Code appeared first on SecurityWeek.","Google has expanded access to its Gemini 4 Carbon AI model, making it available to paying developers and businesses via the Gemini API and Gemini for business. Agents built on Carbon were used by Google DeepMind to formally verify security guarantees in the Signal protocol's libsignal implementation, a process that traditionally takes years but was completed in weeks. The AI agents generated millions of lines of formal proofs, confirming security properties like forward secrecy and post-compromise security for the compiled machine code.","Google expands Gemini 4 Carbon access; AI agents verify Signal code security.","https:\u002F\u002Fwww.securityweek.com\u002Fgoogle-widens-gemini-4-carbon-access-after-ai-agents-verify-signal-code\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FSignal-telegram-messaging.jpeg","2026-11-10T16:42:02+00:00","2026-11-10T17:00:04.83317+00:00",7,[17,20,23,25,28,30],{"name":18,"type":19},"Gemini 4 Carbon","product",{"name":21,"type":22},"Google","vendor",{"name":24,"type":19},"Signal",{"name":26,"type":27},"Signal protocol","technology",{"name":29,"type":19},"Claude Opus 5.5",{"name":31,"type":19},"AlphaProof Code","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":32,"icon":34,"name":35,"slug":36},null,"AI Security","ai-security",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56],{"type":57,"value":58,"context":59},"malware","PHP2Shell","Severity comparable to PHP2Shell, a pair of PHP flaws that attackers have already exploited.",[21,18,24],{"controls":62,"vendors":119},[63,92],{"slug":64,"name":65,"problem":66,"products":67},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":93,"name":94,"problem":95,"products":96},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[97,103,111],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":98,"product_name":99,"url":101,"description":102},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",[120],{"slug":121,"name":21,"logo_path":122,"roles":123},"google","\u002Fvendor-logos\u002Fgoogle.png",[124],"reported_by",{"slug":126,"title":127,"body":128,"framework_refs":129,"framework_notes":134},"ai-accelerated-formal-verification-strengthens-cryptographic-protocol-security","AI-Accelerated Formal Verification Strengthens Cryptographic Protocol Security","Google DeepMind used AI agents built on Gemini 4 Carbon to formally verify security properties of the Signal protocol's libsignal implementation in weeks rather than years, confirming guarantees like forward secrecy and post-compromise security at the compiled machine code level. This matters because cryptographic libraries underpin the security of billions of communications, yet formal verification has historically been too resource-intensive for routine use. Unverified implementations can harbor subtle flaws that invalidate theoretical security guarantees even when the protocol design itself is sound. AI-assisted formal verification represents a step-change in the ability to rigorously audit critical security dependencies at scale.",[130,131,132,133],"NIST SP 800-53 SA-11: Developer Testing and Evaluation","NIS2 Article 21(2)(e)","NIS2 Article 21(2)(d)","NIST CSF 2.0 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded",{"NIS2 Article 21(2)(d)":135,"NIS2 Article 21(2)(e)":136,"NIST SP 800-53 SA-11: Developer Testing and Evaluation":137,"NIST CSF 2.0 ID.RA-01: Vulnerabilities in assets are identified, validated, and recorded":138},"This point addresses supply chain security, relevant because organisations consuming libsignal inherit its security properties and need assurance that the implementation matches the protocol's theoretical guarantees.","This point covers security in acquisition, development, and maintenance including vulnerability handling, directly applicable to formally verifying the security properties of a cryptographic library dependency.","SA-11 requires developers to perform security testing and evaluation—including formal analysis—of software, which is precisely what AI-assisted formal verification of libsignal's compiled code achieves.","Formal verification is a rigorous method for identifying whether vulnerabilities or property violations exist in assets, directly fulfilling the identification and validation requirement for security-critical cryptographic code."]