Security

Google DeepMind announced "AlphaProof Code," a new framework for formal verification, on Nov. 10 (Nov. 10 Japan time). Under human guidance, AI agents mathematically proved key security properties, including forward secrecy and authentication, of "libsignal," the reference implementation of the cryptographic protocol of the messaging app Signal, at the level of compiled machine code. According to the paper, the proofs generated by the agents run to about 6.5 million lines, and the work took a team of five four weeks. The target is an executable run from a CLI, and low-level cryptographic operations are treated as assumptions.

Cursor, the U.S. maker of an AI coding tool, said on Oct. 29 that a tampered version of Anthropic's "Claude Code" extension had been distributed on its extension store for about 11 hours. Up to about 5,000 users installed it. The tampered version collected device information and tried to change settings so that attackers could get in through SSH. Cursor shut down and rebuilt the store and urged users to update to version 2.1.314 or later. Versions distributed through other stores were not affected.