![Gemini 4 Carbon: 6.5M Lean Proof Lines Verify Signal [2026]](https://shattered.io/wp-content/uploads/2026/11/gemini-4-carbon-access-signal-libsignal-alphaproof-code-6-5m-lean-proofs-2026-gen.webp)
Google opened Gemini 4 Carbon to developers, enterprises, scientists and consumers on November 10, 2026, and the release landed alongside a result that may matter more to security teams than the model itself. According to SecurityWeek, agents running on the new model helped Google DeepMind verify core security properties of Signal’s reference code, and the agents wrote roughly 6.5 million lines of Lean proofs doing it.
Two stories arrived in one day. The first is a pricing and access story: who can call Carbon, through which door, and at what rate. The second is a research story: DeepMind’s new AlphaProof Code framework turned a language model into a proof engine and pointed it at one of the most scrutinized codebases in consumer cryptography. This analysis covers both, with numbers, caveats and a view on what comes next.
One framing note before the details. The phrase “widens access” is a headline description, not an official product name, and no named individual gave an on-record quotation in the available coverage. So this piece paraphrases the announcement and the reporting, and it flags every place where the public record runs out. Readers who followed our earlier piece on the Gemini 4 Carbon intro price will find the access picture has now broadened.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
Gemini 4 Carbon Access: What Google Announced on Nov. 10 #
Google announced Carbon availability for four audiences at once: developers, enterprises, scientists and consumers. That grouping is deliberate. A frontier model that only sits behind a waitlist builds buzz, but a model that reaches a paying API customer, a corporate admin and a consumer subscriber on the same day builds usage data across every tier.
Carbon reaches paying developers and enterprises through the Gemini API in Google AI Studio and through Gemini for business. Consumers on the Google AI Ultra plan get it through three surfaces: Google Antigravity, the Gemini app and AI Mode in Search. The Ultra route matters because it puts a frontier model inside a search product that Google already runs at enormous scale.
The coverage differs in emphasis. 9to5Google framed the Gemini app change as a rollout to AI Ultra subscribers while Argon remains available. Engadget’s headline described Carbon as widely available around the world. The announcement’s own list of channels is narrower and more specific, and this article sticks to that list because it is the only version backed by the vendor’s text.
Where Gemini 4 Carbon Is Available Right Now #
The table below maps each audience to its access route, using only the channels named in Google’s announcement. Anything not listed there, such as free-tier limits or regional rollout dates, stays out of the table because the public record does not confirm it.
| Audience | Access route | Requirement |
|---|---|---|
| Developers | Gemini API in Google AI Studio | Paying account |
| Enterprises | Gemini for business | Paying account |
| Power consumers | Gemini app | Google AI Ultra subscription |
| Power consumers | AI Mode in Search | Google AI Ultra subscription |
| Agentic coders | Google Antigravity | Google AI Ultra subscription |
Two details stand out. First, the API and business routes are limited to paying users, which keeps casual experimentation on older models. Second, Antigravity appears in the Ultra list, which signals that Google wants Carbon tied to its agentic coding tool, not only to chat. That fits the other half of the news, because AlphaProof Code is an agentic workflow at heart.
Gemini 4 Carbon Pricing: $2 Intro Rate vs $4 List #
Google’s announcement post sets an introductory API price of $2 per 1 million input tokens and $10 per 1 million output tokens, valid through November 30, 2026. After that date, the listed price doubles to $4 per 1 million input tokens and $20 per 1 million output tokens. The intro window is therefore just 20 days long from launch.
The table applies those published rates to three sample workloads. The workload sizes are illustrative figures chosen for this analysis, not Google data, and the dollar totals are simple arithmetic on the published rates.
| Sample workload | Intro cost (through Nov. 30) | List cost (after Nov. 30) | Increase |
|---|---|---|---|
| 1M input + 1M output tokens | $12 | $24 | +$12 |
| 10M input + 2M output tokens | $40 | $80 | +$40 |
| 100M input + 20M output tokens | $400 | $800 | +$400 |
| 500M input + 100M output tokens | $2,000 | $4,000 | +$2,000 |
| Rate per 1M input tokens | $2 | $4 | 2x |
| Rate per 1M output tokens | $10 | $20 | 2x |
What the November 30 cutoff means for budgets
A flat 2x step is easy to model. Any team that benchmarks Carbon this month at intro rates and then budgets a production rollout on those numbers will overshoot by half or more once list pricing starts. The safer approach is to run pilots on the $2 and $10 rates, then multiply every projection by two before it reaches a finance review.
Agentic workloads make the gap worse. A proof-search loop or a long-horizon coding agent reads far more than it writes, and it calls the model again and again. Input-heavy traffic benefits most from the intro rate, and it also suffers most when the rate doubles. Cost per accepted result, not cost per token, is the number to track.
AlphaProof Code: DeepMind’s Agentic Verification Framework #
Google DeepMind introduced AlphaProof Code as an agentic framework for formal software verification. The idea is straightforward to state and hard to execute. A human or an agent writes a precise specification of what a piece of code must do, other agents write machine-checkable proofs that the code meets the spec, and a proof checker accepts or rejects each proof without any appeal to model confidence.
The checker in this case is Lean, a proof assistant. Lean rejected the invalid proofs the agents produced. That detail carries the whole credibility of the project. A language model can hallucinate a plausible argument, but it cannot fool the Lean kernel into accepting a false one. The model’s job is to propose, and Lean’s job is to refuse.
This split also explains why the work arrived with Carbon rather than before it. Proof search eats tokens, rewards long attention spans and punishes shallow guesses. The same traits that Google markets for agentic engineering turn out to be what formal verification demands. Developers who track tool choices can compare agent economics in our OpenCode vs Claude Code pricing breakdown.
Why Signal’s libsignal Became the Test Case #
The team applied AlphaProof Code to libsignal, the reference implementation of the Signal protocol. The choice makes sense on three counts. The protocol protects messages for a very large user base, the code is open for inspection, and the security claims are precise enough to state formally. A vague product goal such as “be secure” cannot become a Lean theorem, but “past messages stay secret after a key leaks” can.
Picking a respected target also raises the stakes for the framework. If agents had choked on a toy parser, nobody would have noticed. Aiming at code that cryptographers already trust invites a hard question: does machine-written proof work add anything beyond what human review and earlier analysis delivered? Axios headlined its report on the effort as DeepMind using AI to prove Signal’s encryption works, which is a stronger framing than the scope of the verified work supports, as the later section on limits shows.
Cryptographic libraries are also a natural fit for formal methods because their interfaces are small and their failure modes are severe. A subtle state-handling bug in a ratchet can quietly break a promise that users never see being broken. That asymmetry, small code and huge consequences, is exactly where proof effort pays off.
6.5 Million Lines of Lean: Reading the Number #
The agents generated approximately 6.5 million lines of Lean proofs. That figure is large, and size alone proves nothing. Proof volume often reflects how verbose a formal system is, how much boilerplate machines emit and how many dead ends the search explored. A million lines of proof can certify a short, clean statement.
What the number does show is feasibility at scale. No human team writes 6.5 million lines of proof by hand in a reasonable schedule, and few teams would even try. Treat the figure as a measure of agent throughput, not as a measure of assurance. Assurance comes from the specifications, which humans must still review, and from the Lean check, which is binary.
Why Lean rejection matters more than proof volume
Every proof the agents proposed went to Lean, and Lean threw out the invalid ones. That filter converts an unreliable generator into a trustworthy pipeline, because wrong output costs compute but never corrupts the result. The pattern generalizes well beyond Signal. Any domain with a cheap, exact verifier, such as compilers, type systems and unit-test suites with strong oracles, can take the same generate-then-check shape.
The weak link moves upstream. If a specification says the wrong thing, a perfect proof of it still protects nobody. Reviewers should spend their scarce attention on the spec files, not on the millions of lines beneath them. Our report on 48 AI agents flagging a Maya site showed the same lesson in a different field: agents find candidates fast, and humans still decide what counts.
Forward Secrecy, Post-Compromise Security and Authentication #
Reported verified properties include forward secrecy, post-compromise security and authentication. Each one answers a different attacker question. Forward secrecy asks whether an attacker who steals today’s keys can read yesterday’s messages. Post-compromise security asks whether a conversation heals itself after a key leak, so that tomorrow’s messages become safe again. Authentication asks whether you are really talking to the party you think you are.
These are the headline guarantees that make Signal’s design famous among cryptographers. Seeing them stated and machine-checked against real code is a different kind of evidence from reading a protocol paper. Papers prove ideas, while code verification checks that the shipped logic actually implements those ideas.
The post-quantum angle is worth watching from a distance. Messaging protocols are adding quantum-resistant key exchange, and verification work will need to track those additions. Our explainer on post-quantum signature candidates covers the standards side. This article does not claim the DeepMind work covers any post-quantum component, because the fact sheet does not say so.
What the Signal Verification Did Not Cover #
The reported verification covered Google’s own build of the code, wrapped in a small command-line program. It did not cover Signal’s own applications. That is the single most important caveat in the story, and headlines that skip it overstate the result. A verified library inside a test harness is not the same object as the app on a phone.
| Question | Status in the public record |
|---|---|
| Did agents verify properties of libsignal? | Yes, per the reporting and DeepMind’s framework |
| Did the work cover forward secrecy? | Yes, reported |
| Did it cover post-compromise security? | Yes, reported |
| Did it cover authentication? | Yes, reported |
| Did it verify Signal’s own apps? | No, it covered Google’s build with a small wrapper |
| Did Lean reject invalid proofs? | Yes |
| Did a named person give an on-record quote? | None appears in the available results |
Verification also never covers everything. Proofs hold relative to a model of the hardware, the compiler, the operating system and the attacker. Side channels, implementation choices outside the proved code and user behavior all sit beyond the boundary. None of that makes the work less useful. It means readers should translate “verified” as “verified against these specific statements, in this specific build.”
Gemini 4 Carbon and Claude Opus 5.5 in One Proof Pipeline #
The researchers used agents running on both Gemini 4 Carbon and Claude Opus 5.5 to develop formal specifications and proofs. A Google research project leaning on a rival lab’s model is unusual, and it carries a message. For hard, checkable work, the team treated models as interchangeable workers and let the verifier decide which output survived.
That has market meaning. Vendors compete on benchmarks, but a proof checker gives a neutral scoreboard: a proof either passes or fails. Teams that adopt this style can route tasks to whichever model produces accepted proofs at the lowest cost. Our earlier note on Anthropic’s Fable 5.2 and Mythos 5.2 pricing shows how quickly rival rates are moving, and cost-per-accepted-proof will push that comparison further.
The public record does not say how the work split between the two models. It does not say which model wrote which proofs, or how many dead ends each one hit. Any claim that Carbon beat Opus 5.5 on this task, or the reverse, would be invention. The fair reading is narrow: both were in the loop, and Lean checked the output.
Historical Context: From seL4 to AI-Written Proofs #
Formal verification of real software has a long, slow history. The seL4 microkernel earned its reputation for a machine-checked proof of functional correctness, and the CompCert compiler showed that a compiler could carry a proof of semantic preservation. Verified cryptographic code from academic projects later reached mainstream browsers. Each effort took skilled specialists years, and each stayed a niche practice.
The bottleneck was always human proof labor. Writing a specification is hard, but writing the proof that code meets it usually costs even more effort. AlphaProof Code attacks that second cost directly by handing proof writing to agents and keeping the checker as a safety net. If the approach holds up, the economics of verification change from a research luxury to an engineering line item.
Security teams have lived with a cousin of this problem for years. Static analyzers and fuzzers find bugs, but they never prove absence of bugs. Formal proofs do, within their scope. The step from “we found nothing” to “we checked that this property holds” is the step this research tries to make routine. The risks of the opposite approach, sloppy AI-assisted code, appear in our report on Claude Code settings files exposing 1,379 secrets on GitHub.
What Developers Report About AI Agents Today #
Carbon’s launch lands in a developer market that already leans on AI tools. The 2025 Stack Overflow Developer Survey reported that, in its words, “84% of developers said they were using or planning to use AI tools in their development process in 2025, up from 76% in 2024.” That is a baseline of near-universal curiosity, which helps any vendor pitching a new frontier model.
Agents are a narrower story. The same Stack Overflow survey, according to its press release, found that “31% of developers reported using AI agents at work, while 17% planned to use them and 38% did not plan to use them.” So agent adoption sat well below general AI-tool adoption when the survey ran, and a large bloc said no.
The productivity data cuts the other way. Stack Overflow said that “Among developers who had used AI agents at work, 69% agreed that the agents had increased their productivity.” Those who try agents tend to like them, which suggests the adoption gap is about trust and trial rather than results. Verified outputs such as Lean proofs speak directly to the trust half of that gap.
The survey predates Carbon by more than a year, so treat these figures as background, not as a reaction to this launch. Still, they frame what the DeepMind result is selling: agents whose work a machine can check. A skeptic who refuses agents because they hallucinate gets a different answer when the pipeline discards hallucinations by construction. Open-weight model security is the other side of this debate, and the Hugging Face warning on two attacks against open AI shows the tension.
Market Impact: Competition for Agentic Coding Budgets #
Google now has a headline use case for Carbon that is neither a chatbot demo nor a benchmark chart. Verifying a famous cryptographic library gives sales teams a story that security buyers understand. Expect enterprise pitches to lean on the Signal result when Carbon competes against rival frontier models for long-running engineering agents.
The pricing move supports that push. Carbon’s introductory rates of $2 and $10 per million tokens expire on November 30, which gives buyers a short window to run proof-style pilots cheaply. After that, the $4 and $20 list price applies. Google bets that teams who see accepted results during the cheap weeks will keep paying the higher rate, because switching an agent pipeline mid-project costs real engineering time.
Rivals face a clear choice. They can match Google with their own verification showcase, they can compete on price, or they can argue that proofs are a niche and that everyday coding agents matter more. The involvement of Claude Opus 5.5 in the Signal work complicates the last argument for one rival in particular, since its model helped produce Google’s showcase. The public record does not say whether the arrangement was a formal partnership or simply a research tool choice.
Investors should resist reading too much into a single research result. The fact sheet gives no revenue figure, no usage count and no customer name for Carbon. What it gives is a product that shipped across four audiences on one day, a priced API and a credible technical demonstration. Those are inputs to a business case and not the case itself.
Competitive Comparison: Carbon vs Argon and Claude Opus 5.5 #
Carbon is not Google’s only current frontier model. According to 9to5Google’s headline, Argon remains available in the Gemini app while Carbon rolls out to AI Ultra subscribers. This analysis does not compare prices across the two models, because the verified figures cover Carbon only.
Claude Opus 5.5 appears in the story as a collaborator, not as a competitor on a leaderboard. No head-to-head benchmark between the models appears in the available results, so any table of scores would be fabricated. The comparison that matters for buyers is practical: which model produces accepted output at the lowest cost per task, on your codebase, under your latency limits.
A fair evaluation plan has four parts. Pick a task with an exact checker, such as a test suite or a type checker. Run each candidate model through the same agent harness. Record accepted results, not raw output. Then divide total spend by accepted results. Our ChatGPT vs Claude README accuracy test walks through a small version of that method.
What Security Teams Should Do With This Result #
Most teams will never write Lean proofs, and they do not need to. The practical takeaway is that agent-generated verification is moving from lab demonstration toward something a well-funded team can try. Start by listing the small, high-consequence components in your own stack: token validation, key derivation, state machines for session handling and parsers for untrusted input.
Next, write down the properties each component must keep, in plain language. That exercise alone exposes ambiguity that reviews miss. Only after the properties read clearly should anyone ask whether a proof tool can state them formally. The Signal effort suggests that specification work remains the human part, so budget senior time for it.
Finally, keep the boundary in view. The Signal work verified Google’s build with a small wrapper, not the shipped apps, and the same gap will exist in any internal project. Document what the proof covers and what it leaves out, and publish that boundary next to the claim. Honest scoping is what separates a useful assurance artifact from marketing.
Five Predictions for Verified AI Code #
These predictions are this publication’s analysis, not statements from Google, DeepMind or any named expert.
- Verification demos multiply. Expect rival labs to announce their own proof showcases on well-known open-source libraries within the coming months, since Google has set the template.
- Intro pricing becomes a pattern. Short promotional windows like the November 30 cutoff will recur, because they pull pilots forward and lock in pipelines before list rates apply.
- Specifications become the scarce skill. As proof writing gets cheaper, demand for people who can state precise security properties will rise faster than demand for proof engineers.
- Scope disputes follow. Critics will challenge “verified” labels that skip shipped apps, and vendors will respond with clearer scope statements.
- Multi-model routing grows. The Carbon and Opus 5.5 pairing hints at pipelines that choose models per task, with a checker as the referee.
None of these outcomes is guaranteed. Each depends on whether the Signal result holds up under outside review and whether agents can repeat it on codebases that are messier than a well-maintained cryptographic library.
Bottom Line on Gemini 4 Carbon and the Signal Proofs #
The takeaway: Google shipped a frontier model to four audiences on November 10, priced it at $2 and $10 per million tokens through November 30, and paired the launch with a credible demonstration of agent-driven verification. The demonstration has a clear scope, a clear checker and a clear limit, since it covered Google’s build and not Signal’s apps.
For engineers, the useful move is to separate the two stories. Judge Carbon on cost per accepted result in your own workflow. Judge AlphaProof Code on whether its specifications say what you actually need. Neither judgment requires taking a headline at face value. For more AI coverage, see our AI and machine learning section.
FAQ: Gemini 4 Carbon and the Signal Verification #
What is Gemini 4 Carbon?
Gemini 4 Carbon is a Google model that became available on November 10, 2026 to developers, enterprises, scientists and consumers. Developers reach it through the Gemini API in Google AI Studio, and businesses reach it through Gemini for business.
How much does Gemini 4 Carbon cost?
The introductory API price is $2 per 1 million input tokens and $10 per 1 million output tokens through November 30, 2026. After that, the listed price is $4 per 1 million input tokens and $20 per 1 million output tokens.
Who gets Carbon through consumer products?
Google AI Ultra subscribers receive access through Google Antigravity, the Gemini app and AI Mode in Search. The announcement does not list other consumer plans in the information reviewed for this article.
What is AlphaProof Code?
AlphaProof Code is an agentic framework from Google DeepMind for formal software verification. Agents develop specifications and proofs, and the Lean proof checker accepts or rejects each proof.
What did the agents verify in Signal’s code?
Reported verified properties include forward secrecy, post-compromise security and authentication, applied to libsignal, the reference implementation of the Signal protocol. The agents generated approximately 6.5 million lines of Lean proofs.
Does this mean the Signal app is proven secure?
No. The reported verification covered Google’s own build of the code with a small command-line wrapper, not Signal’s own applications. Proofs also hold only for the statements and models they encode.
Which AI models did the researchers use?
Researchers used agents running on Gemini 4 Carbon and Claude Opus 5.5 to develop formal specifications and proofs. The available coverage does not say how the work divided between the two models.