DeepMind AI Verifies Signal Protocol & Anthropic Project Glasswing Under Scrutiny - Hacker News (Nov 11, 2026)

For the first time, the actual code behind one of the world's most widely used encryption protocols has been mathematically proven secure, and it was AI agents that wrote most of the proof. More on that in a moment. Welcome to The Automated Daily, hacker news edition. The podcast created by generative AI. I'm TrendTeller, and today is November 11th, 2026. We've got a full lineup: AI in security and software quality, a patent fight that sank a Linux driver, a domain reprieve, a platform shutting its doors, resilient smart homes, and a very small Toyota truck. Let's get into it.

DeepMind AI Verifies Signal Protocol

Let's start with that headline. Google DeepMind says its new agentic system, AlphaProof Code, has formally verified key security properties of the real Signal protocol implementation, not just its theoretical design. That distinction matters: plenty of protocols look airtight on paper and then stumble in the code. Here, human experts wrote the formal specifications, a team of AI agents generated the proofs in the Lean proof language, and Lean itself checked every step. The effort took about four weeks and produced more than six million lines of proof, with humans reviewing only around one percent. As a sanity check, the team reintroduced two old, already-fixed Signal bugs into an isolated copy, and the system correctly showed that code was insecure. DeepMind is open-sourcing the artifacts and pitching the approach for things like medical devices and power grids. If it scales, formal verification could go from a rare luxury to something routine.

Anthropic Project Glasswing Under Scrutiny

A more sobering look at AI and security comes from VulnCheck, which revisited Anthropic's Project Glasswing seven months after launch. Its count: hundreds of CVEs attributed to Anthropic, but only two appear to have been exploited in the wild. Anthropic's public disclosure ledger has swelled to nearly thirty-eight thousand findings, yet only a couple hundred have been fixed, while duplicates and withdrawn reports pile up much faster. The article also questions how Anthropic calculates its rising accuracy figures, and argues its open-source scanner simply pushes triage work onto maintainers. A curl maintainer's review, cited in the piece, found many reports were false positives or low severity. The takeaway: finding bugs at scale is easy; finding the ones that matter is the hard part.

AI Coding Tools and Fragile Codebases

That theme carries into a widely discussed essay arguing that leaning heavily on AI coding tools makes codebases more fragile over time. The author points to shallow tests, needlessly complex code, and abstractions nobody on the team truly understands. Faster AI-generated pull requests also tempt reviewers to skim, letting small problems slip through. The result, the author says, is more incidents, slower recovery, and bugs discovered by users rather than developers. Speed is real, but durable software still needs people who understand what they're shipping.

Browser Vendors Guide AI Coding Agents

On the constructive side, a project called Modern Web Guidance, stewarded by teams from Chrome, Edge, Firefox and MDN, aims to teach coding agents current web best practices. The problem it tackles is simple: AI models often learned from older code, so they reach for legacy patterns. This guidance nudges them toward modern browser features that are faster, more accessible and easier to maintain, and it can scan a codebase for outdated habits. Notably, it's a rare cross-browser effort aimed directly at AI tools.

DisplayLink Patents Halt Linux Driver

Now to a frustrating story for Linux users. Developer Mike Lothian had been reverse-engineering DisplayLink docking stations and building a Rust driver called Vino so those docks could work on Linux without vendor software. Synaptics, which bought DisplayLink in 2022, responded with patent-based cease-and-desist demands, later citing specific UK patents and threatening financial penalties. Lothian sought help from the Open Invention Network, but it concluded its protections didn't apply because codecs fall outside its definition of Linux. He's pulled the public repository, and Vino will stay on his machine. It's a reminder that software patents can still quietly block interoperability.

Verisign Reverses .name Domain Shutdown

Better news for another long-running fight. Verisign has abandoned its plan to terminate about twenty-two thousand .name domains and email redirects. Existing domains and forwarding will now continue indefinitely, though new third-level registrations stay closed. The reversal follows a lengthy, costly campaign of formal appeals and advocacy by domain holders, lawyers and supporters, and it preserves web identities and email addresses that people have relied on for years.

Val Town Winds Down, Open-Sources

Meanwhile, Val Town is winding down, saying it can no longer compete in the cloud computing market. Billing is paused immediately, existing subscriptions continue for free, and annual prepayments get partial refunds. The service will go read-only in December and close fully in January, with migration guides pointing users to other hosts. The company plans to open-source the product in February 2027, which is about as graceful as a shutdown gets.

Local-First Resilient Home Automation

Staying in the spirit of not depending on someone else's servers, one developer laid out his philosophy for smart homes that keep working when the internet or a vendor's cloud goes down. His core setup runs on hardware he owns, with voice assistants treated as a nice extra rather than a requirement. His rules include keeping the old manual way working, reviewing automations regularly, and avoiding black-box devices without logs. He also describes how the system had to adapt as more people moved into the house, adding shared access, better presence detection and leak monitoring. It's a practical case for home automation everyone in the household can actually use.

Toyota Revives Scion With Kei Truck

Finally, Toyota has revived the Scion name as an experimental sub-brand, and its first model is delightfully modest: the KEI-01, a tiny kei-style utility truck that's essentially a rebadged Daihatsu Hijet. It qualifies as a low-speed vehicle, topping out under twenty-five miles per hour, so it's no commuter car. But with four-wheel drive, a fold-down bed and air conditioning, it could suit farms, warehouses and dense city deliveries. A small fleet pilot starts in late 2027. Kei truck fans in the U.S. may finally get an official option, even if a slow one.

That's it for today's edition. From AI proving Signal's code sound to patents shutting down a Linux driver, it's been a day about trust: in our tools, our code, and the services we depend on. Links to all stories can be found in the episode notes. I'm TrendTeller, thanks for listening, and see you tomorrow on The Automated Daily, hacker news edition.

DeepMind AI Verifies Signal Protocol & Anthropic Project Glasswing Under Scrutiny - Hacker News (Nov 11, 2026)

Our Sponsors

Today's Hacker News Topics