🔍 Read the full analysis: What We Know—and Don’t Know—From Claude’s Formal Verification Work on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and collaborator Theorem report that Claude helped prove a no-crash property for 239 entry points across 123 open-source libraries. The Rocq-checked proofs apply to specific compiled RISC-V builds and inputs under 64 MB; they do not establish that the libraries are bug-free or that other builds are safe.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that Claude helped prove a limited security property for 239 entry points in 123 open-source libraries. Checked by the Rocq proof assistant, the proofs cover specified compiled RISC-V programs and show they do not crash on inputs under 64 MB, subject to the project’s assumptions—not that the libraries are free of bugs.
The team used existing OSS-Fuzz tests as specifications: each test defines an entry point and a behavior whose failure would cause a crash. The libraries and tests were compiled into RISC-V executables with AddressSanitizer instrumentation. Claude generated proofs in Rocq, whose checker verifies whether they follow from the formal specification. When attempts failed, the team said the failures could point to bugs; code was patched and the specification and proof process repeated.
Anthropic reported that the proof corpus contains about 180 million lines of Rocq, produced over a few weeks. A typical proof was about 600,000 lines, and the median program covered was 18,000 RISC-V instructions. The company said it is publishing proofs that did not require patching, some previously unavailable trusted components, and specifications for fuzz tests it could not prove. It also said some proofs consumed hundreds of millions of tokens, making cost a significant constraint.
The work uncovered what Anthropic described as hundreds of bugs, including issues unlikely to be reached by ordinary fuzzing. Examples in the source account include a decompressor bug requiring a roughly 20 MB input with a rare layout, an image-decoder issue involving a 64 MB input and more than 2 GB of memory, and a flaw requiring a particular sequence of calls across two file handles. The account also describes a rediscovery of CVE-2026-56132 in libexpat and a file-loading restriction that was not always enforced.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What the Proofs Could Change
The report offers a concrete test of whether AI can reduce the labor involved in formal verification, a method that uses mathematical proofs to establish specified properties of software. Conventional fuzzing can expose bugs by testing many inputs, but it cannot establish that every possible input or execution path has been covered. A valid proof can provide that guarantee for the property and system represented in its formal model.
That distinction matters for security teams deciding how much confidence to place in testing. If these methods become cheaper and more reliable, developers could use proofs to rule out certain classes of failure in selected components. But the reported token costs and narrow scope mean the work does not yet show that large software projects can be verified affordably or that general-purpose AI systems can independently certify software. The useful claim is narrower: Claude generated proofs that a separate checker could validate.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Machine-Code Proofs
Fuzzing repeatedly feeds software generated or mutated inputs and watches for crashes. Its effectiveness depends on which inputs and paths it reaches. The approach described by Anthropic and Theorem starts with the same kind of test but turns its expected behavior into a formal claim about a compiled program. Here, that claim was that the instrumented program would not crash for any input below the stated size limit.
The use of compiled RISC-V machine code is central to the report: the proof concerns the modeled executable, rather than only a higher-level description of source code. The result still depends on assumptions and trusted components, including the formal models of RISC-V instructions and Linux processes, the theorem statements, and the Rocq checker. The source also lists hardware, the operating system and the OCaml compiler used by Rocq among the supporting elements that must be trusted.
Anthropic framed the project against the difficulty of scaling verification by human effort, citing the seL4 microkernel as an example where verification required far more labor than implementation. The company’s report presents language models as a possible way to generate proofs at greater scale, while the machine-checking step supplies an independent check of the proof itself.
As an affiliate, we earn on qualifying purchases.
Where the Proofs Stop
The result applies to single-threaded, static RISC-V binaries linked against musl, according to the source account. It does not directly establish the same properties for the x86 or ARM builds linked against glibc that many users run. Nor does a proof of a no-crash test establish that all security flaws, logic errors or harmful behaviors are absent. The claim is limited to the property, entry point, inputs and modeled system covered by each proof.
The report also does not settle how often the method will scale economically. Some proofs required hundreds of millions of tokens, and the source says newer models and shared proofs can reduce the burden without providing a full cost comparison. The full details of every discovered bug, their remediation status and independent reproduction are not established in the supplied account. Anthropic’s broad claims about the number and novelty of findings should therefore be treated as company-reported results.
As an affiliate, we earn on qualifying purchases.
Publication and Independent Checking
Anthropic says it is releasing the proofs that required no patch, along with selected trusted components and specifications for tests it could not prove. Those materials give outside researchers a way to examine parts of the work, though the source account does not specify a schedule for further releases or independent audits.
The next questions are whether other researchers can reproduce the results, how many reported bugs have been fixed and disclosed, and whether the approach can be applied to the architectures and build configurations used in deployed software. More evidence on proof costs, coverage and reproducibility will show whether this is a practical addition to security testing or a method that remains limited to selected programs.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
Anthropic and Theorem say Claude helped prove that 239 fuzz-test entry points across 123 libraries do not crash on inputs under 64 MB in specified, instrumented RISC-V builds, subject to stated assumptions.
Does this mean the libraries are bug-free?
No. The proofs cover a particular no-crash property and the modeled program configurations. They do not show that every possible bug or security problem is absent.
How were the proofs checked?
Claude generated proofs in Rocq, and Rocq’s proof checker verified them against formal specifications. The checker and supporting models form part of the trusted basis for the results.
Why did the work find bugs fuzzing missed?
Fuzzers test selected inputs and execution paths. A successful proof must account for every path represented by its formal model, which can expose cases that ordinary fuzzing did not reach.
Do the findings apply to software people run?
Not automatically. The reported proofs concern single-threaded, static RISC-V binaries linked against musl, and do not directly establish equivalent results for common x86 or ARM builds linked against glibc.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
