AI Brief, 11 November 2026: six and a half million lines of Lean, and the property it does not prove

Google DeepMind published AlphaProof Code at 12:00 UTC on 10 November, and the result underneath it is the most substantial thing in this window: agent teams produced machine-checked proofs that the compiled machine code of libsignal, the Signal protocol's reference implementation, satisfies key security properties. Not the protocol design, which has been verified before, but the unmodified Rust of version 0.105.4 after rustc has turned it into roughly 140,000 AArch64 instructions. A team of five did it in four weeks. The paper's own comparisons are seL4 at twenty person-years and CompCert at six, both written to be verified in a way libsignal was not.

What makes it worth leading on is the checkability. Every proof is accepted or rejected by Lean's kernel rather than on a model's say-so, the specifications and proofs are open-sourced, and the paper is candid where the announcement is not. The announcement says the work proved "key security properties". The paper lists what it does not prove, and the sharpest item is that neither of its two theorems establishes the post-quantum healing that SPQR, the new ratchet, exists to deliver: the proofs let the attacker choose SPQR's keys. The computational bound also gives no guarantee against a quantum adversary, and goes vacuous for a single session of around 25,000 messages.

That is the second day running on which a lab's launch post and its own technical document describe different experiments. Yesterday's brief led on Anthropic saying 1,000 agents formalized Fermat's Last Theorem from "no mathematical references", against an engineering write-up listing 47 lemmas handed to them. The shape repeats, the outcome does not: this paper went out the same day, it is more complete than the blog in every direction, and the claim is falsifiable by anyone who can build the repository. Elsewhere Gemini 4 Carbon became generally available at 16:00 UTC, at a rate a footnote doubles on 30 November, and two items from 9 November that went loud on the 10th are covered here late: an AWS report of a 44-fold cost cut over Sonnet 4.6 with no accuracy figure in it, and VulnCheck's seven-month audit of Project Glasswing, counting 37,966 findings against 217 fixes.

• AlphaProof Code: about 6.5 million lines of Lean proof over libsignal's binary, five people, four weeks, 40 to 80 agents per campaign on one machine for 24 to 72 hours.
• The property SPQR exists to provide, post-quantum healing, is not proved, and that caveat is in the paper rather than the announcement.
• Gemini 4 Carbon is callable by paying API customers and AI Ultra subscribers; reasoning is mandatory and bills at the output rate, on a model Google positions as using more tokens than Argon.
• Carbon's maximum output reads three ways: 65,536 tokens by default, up to 1,048,576 with long decode, 943,718 on OpenRouter.
• Strands Decider E4B cut Amazon's per-ticket labelling cost from $0.0222 to about $0.0005, and reordering the JSON keys of an identical request moves its probabilities by up to 0.19.
• VulnCheck counts 442 CVEs credited to Anthropic in seven months, two exploited in the wild; curl has marked 19 of 34 published Anthropic reports as not vulnerabilities.

Verifying the binary, and where the trust actually sits #

The properties span the PQXDH post-quantum handshake and the Triple Ratchet: forward secrecy, authentication, post-compromise security and handshake secrecy, each proved both symbolically and computationally. Verifying the binary rather than the source removes the compiler from the trusted base, which required a formal semantics of user-mode AArch64 Linux in Lean covering 467 instructions and 31 system calls in 7,532 lines, differentially tested against the Unicorn emulator and the Sail model of Armv9.4-A.

A theorem is accepted only if its statement and every transitive definition match the held-out copy, the proof uses only Lean's standard axioms, and the kernel accepts it; sorry and native_decide are rejected. The specification is the part no machine can check: roughly 26,000 trusted lines, about 18,000 of which must be read to audit the headline theorems. The announcement says the specs were written with "a mix of models"; only the paper names them, and the answer is Gemini 4 Carbon and Claude Opus 5.5, a competitor's model in the specification loop.

The machinery that stops agents cheating is the most transferable idea here, and a direct answer to the question yesterday's brief raised about undisclosed scaffolding. Agents try to falsify a goal before attempting it, and every new invariant must ship a witness that it holds on some reachable state, "so that agents cannot make progress by proving vacuous lemmas". A proposal that would weaken a property to match the code goes to a critic agent that never sees the proof attempts, and is raised to a human as a suspected bug.

A benchmark score is a number a lab asks you to believe; a Lean proof either type-checks or does not, so the interesting risk moves to whether those 26,000 trusted lines say what a security engineer would think they say.

Two further results deserve attention. To test that the system can tell correct code from broken, two previously-fixed libsignal bugs were reintroduced by reverse-applying their fix commits, cd36118 and 5293caa, and in both cases the agents produced Lean disproofs with concrete witnesses. That is a negative control, and it is what yesterday's Fermat claim lacked; it covers the symbolic theorem only, since refuting the computational one "amounts to proving the hardness assumptions themselves, an open problem." The work also found fifteen gaps or bugs in the published analysis of the Double Ratchet, including a printed ProVerif query that looks up skipped message keys at the wrong ratchet index, which the paper says "makes receiver-side forward secrecy false as printed". No new bugs were found in current libsignal.

Despite the name, this shares essentially nothing architecturally with the original AlphaProof: no newly trained prover, no reinforcement learning, no tree search, just scaffolding around general-purpose models. Nobody outside Google DeepMind has yet reported re-running the checker.

Carbon is available, and the price in the footnote is not the price in the body #

Carbon was announced two weeks earlier and released to vetted defenders through the Fairwind Program, so 10 November is the availability launch. Paying API customers, Gemini for business customers and AI Ultra subscribers can call it; the free tier cannot. The body says Carbon ships "at the same introductory price as Gemini 4 Argon ($2 per million input tokens and $10 per million output tokens)". Footnote 1, below the newsletter signup, says that once the introductory period expires on 30 November 2026, "$4 per 1M input tokens and $20 per 1M output tokens will apply".

That doubling lands twenty days after publication, and it interacts badly with the rest of the post. Reasoning on Carbon is mandatory, settable only to low, medium or high, and reasoning tokens bill at the output rate, while Google's positioning is that Carbon uses "more tokens than Argon to explore thoroughly, reason deeply, and run extended verification loops". A model built to spend more output tokens doubles its output price at the end of the month. It also undercuts the launch's most repeated claim: Carbon reportedly ranks first on CursorBench 4.0, Perplexity's WANDR and Zapier's AutomationBench "at more than 2X lower cost per task", and second on a new Multimodal Knowledge Agent benchmark at "more than 6X lower in average cost per task". No score is given for any of the five, and the ratios are necessarily computed at $2 and $10, so at $4 and $20 a two-fold cost advantage does not survive unless the unnamed comparator doubles too. MKA is itself a benchmark Google co-launched with Artificial Analysis, and Carbon places second on it.

The output cap closes a question put down here on 14 October, when Argon's million-token output budget turned out to be exposed as 65,536 tokens on the first third-party surface to carry it. Google's docs now give 65,536 as the default synchronous maximum and up to 1,048,576 with long decode, a separate documented mode, so the budget is real, reachable, and was never the default. OpenRouter reports 943,718 for both routes, exactly 90% of the context window, matching neither figure. That brief also asked what effort tiers sit above "high"; none do.

A 44-fold cost cut with no accuracy column #

Published on 9 November by Carr Onstott and Mehul Jaiswal on strandsagents.com, an AWS-owned property, and carried to 697 points on Hacker News on the 10th. Strands Decider E4B has open Apache-2.0 weights: a classification head on a LoRA-adapted google/gemma-4-E4B-it with a 4,096-token window. It cannot generate text. Given a state, a question and a set of options it returns a probability per option plus a confidence score, which is why its output is one token rather than a JSON object. Two Amazon engineers swapped it in for Sonnet 4.6 labelling tickets into 20 categories, on a single A10G at about 19 GiB and 640 ms per request. Average time per call fell from 4,215 ms to 897 ms, input tokens per ticket from 6,554 to 2,009, output tokens from 170 to 1, and cost per ticket from $0.0222 to about $0.0005. Half that arithmetic is verifiable and half is an assumption. The Sonnet figure comes straight from the token counts at list prices:

$$\mathrm{6,554}\times \frac{\mathrm{\$}3}{{10}^6}+170\times \frac{\mathrm{\$}15}{{10}^6}=\mathrm{\$}0.02221$$

where $\mathrm{\$}3$ and $\mathrm{\$}15$ are the published per-million rates. The decision-model side has no invoice behind it: at 640 ms per request one instance handles about 5,600 tickets an hour, so $1.408$ per instance-hour is $\mathrm{\$}251$ per million tickets at full use, and the reported $\mathrm{\$}500$ assumes roughly half the capacity sits idle for headroom. There is also a confound: input tokens fell partly because the team rewrote all 20 label descriptions to fit the 4,096-token window, and that rewrite was never tried on Sonnet, so the model swap and the prompt diet were measured together.

What is absent is the accuracy column. The post gives no accuracy, agreement, precision or recall figure, only that the model showed "E4B beating production Sonnet on a separate set of our tickets". It ran a mode calling both models on live traffic and says the team judged every disagreement, so an agreement rate exists and is unpublished. For a question this brief has asked for 33 consecutive days, this is the closest any vendor has come and still misses: a confidence threshold exists, because "we tuned how confident the model needed to be before applying a label", and an abstain path exists, because the 20 options were sent "plus a 'none' option", and neither the threshold nor its trip rate appears. In production there is nothing to fall through to: in decider mode Sonnet is not called.

That matters because of the one calibration-adjacent number the post does give. Sending the same content with JSON keys in a different order moved the output probabilities by up to 0.19:

# Same ticket, same 20 options, different key insertion order.
a = {"ticket": ticket, "options": labels}
b = {"options": labels, "ticket": ticket}
# Top-choice probability moves by as much as 0.19. The fix belongs client-side:
body = json.dumps(payload, sort_keys=True)

Write the rule as: apply label $\hat{y}$ when its probability $p_{\hat{y}}\ge \tau$ , for the threshold $\tau$ the team tuned but did not publish. If a semantically identical re-serialisation moves $p_{\hat{y}}$ by up to $\delta =0.19$ , every ticket whose top probability falls in $[\tau -\delta ,\tau +\delta )$ can be pushed across the line by key ordering alone. At a plausible $\tau =0.70$ that band runs from $0.51$ to $0.89$ . Sorting keys fixes the symptom; the sensitivity is the number worth publishing.

Seven months of Glasswing, counted from outside #

Patrick Garrity of VulnCheck published his seven-month assessment of Anthropic's Project Glasswing on 9 November, his fifth since April; it reached a wide audience on the 10th at 346 points. Glasswing launched on 7 April claiming to have "identified thousands of additional high- and critical-severity vulnerabilities", and has not been covered in this series before.

VulnCheck has tracked credited vulnerabilities since 17 April in a public repository built from CVE records, GHSAs, kernel commits and Anthropic's ledger, so the count is checkable rather than asserted. Seven months in it holds 442 CVEs attributable to Anthropic, about 63 a month, against 93,450 CVEs published this year: roughly 0.5% of the total. Two appear in its known-exploited catalogue.

The two months to 2 November added 11,813 findings and 15 fixes, while duplicates went from 2 to 1,670. Over that period the ledger's stated true-positive rate rose from 91.4% to 94.2%, which is the number VulnCheck disputes: a rising true-positive rate is hard to reconcile with withdrawals and duplicates both climbing far faster than fixes.

The most concrete evidence is a maintainer's. Daniel Stenberg reported that curl received 45 Anthropic reports, of which Anthropic itself rated one medium severity and the rest low. Of the 34 published so far, 19 are marked not a vulnerability, 6 are confirmed low severity and 9 await assessment: 55.9% not-a-vulnerability, 17.6% confirmed, none above low.

Three things keep this fair. VulnCheck sells vulnerability-prioritisation intelligence, so it is not a disinterested party; the curl batch is, by Anthropic's own rating, the low-severity tail rather than a random sample, with nine reports unjudged; and the two rates measure different things, 94.2% being Anthropic's triage assessing itself while curl's 55.9% is a maintainer adjudicating output that Anthropic's OSS Scanner states plainly is "fully model-generated, without human review or triage". The structural finding survives all three. Anthropic said on 8 October that it had more than 29,000 candidate vulnerabilities, had manually reviewed about 6,000, and remained "bottlenecked on our human capacity to validate these findings". The bottleneck did not go away. It moved to the maintainers.

Also notable #

• Two Baidu ERNIE endpoints appeared on OpenRouter inside the window, with no traceable announcement: ernie-5.5-flash-preview at 17:58 UTC on 10 November, a 1,024,000-token context and 921,600-token output cap at $0.28 and $1.13 per million tokens, and ernie-light-dt-1.0-intl at 17:21 UTC at $1.13 and $3.94. The flash model undercuts every frontier endpoint here by more than an order of magnitude. No weights shipped from any of the seventeen labs swept by name.
• Notion has disconnected from Fireworks AI after a security incident. Notion says fewer than 1% of its workspaces are affected and the exposed data is Notion AI chat transcript text, advising customers to treat it as exposed and rotate any credentials pasted in. It severed the connection on 3 November, deleted its data in Fireworks' systems and halted training runs. For anyone routing inference through a third party the mechanism is the lesson: the blast radius is the prompts.

What to watch #

• Whether anyone outside Google DeepMind builds the Lean artifacts and re-runs the checker. One theorem failing to type-check against the held-out specification would matter more than the six and a half million lines that pass, but the more useful audit is of the 18,000 trusted lines, which no kernel checks.

• Whether the 30 November price change lands as the footnote says, and whether the cost-per-task claims are restated at $4 and $20. This rate's failure to rise was flagged here on 14 October; it now has a date, and three first-place rankings rest on ratios computed at the old price.

• Whether Amazon publishes the agreement rate and the confidence threshold. Both exist, both were used to make a production decision, and neither is in the write-up. Day 33 of asking any decision-model vendor for a fail-open rate.

• Whether curl's remaining nine reports are assessed, and whether a second project publishes its own adjudication. One maintainer's tally is an anecdote; two make a rate.

• Still open: Inkling 2 Small's Apache-2.0 weights, callable but unreleased, flagged since the 6th, with nothing under thinkingmachines since July. Voxtral 3 weights, flagged daily since 21 October. No independent number for Tencent's DSpine drafter, Nanbeige4.3-33B or Ripple-65B Preview, and no account from Cursor of how the tampered extension reached its marketplace.