🔍 Read the full analysis: What Claude’s Formal Verification Work Shows About AI—and Its Limits on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic and Theorem report that Claude produced machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs cover a defined set of compiled RISC-V programs and no-crash properties under stated assumptions; they do not establish that the libraries are bug-free or that other builds are safe.
Anthropic’s Frontier Red Team and collaborator Theorem said on October 22 that Claude proved a defined no-crash property for 239 fuzz-test entry points across 123 open-source libraries. The proofs were checked by the Rocq proof assistant against compiled RISC-V programs, and the team says the work also exposed bugs missed by years of fuzzing. The result demonstrates a way AI can help produce machine-checkable software proofs, but it does not show that the libraries are bug-free or that their commonly used builds are safe.
The reported property is specific: for each covered entry point, the compiled program must not crash on any input under 64 megabytes, including through an AddressSanitizer memory error or failed assertion, subject to the project’s assumptions and model. The work starts with fuzz tests that developers had already written. Those tests are converted into specifications for the compiled program, rather than asking researchers to define correctness from scratch.
The process compiles a library and its fuzz test into a RISC-V executable, with AddressSanitizer instrumentation. Claude generates a proof in Rocq; the Rocq checker then verifies it against the specification. When a proof attempt fails, that failure can point to a possible bug. The team says Claude patched some code and repeated the process against a regenerated specification.
Anthropic reports that the proofs amount to about 180 million lines of Rocq, produced over a few weeks. A typical proof was about 600,000 lines, while the median program covered was 18,000 RISC-V instructions. Anthropic says the project found hundreds of bugs, including cases involving large or unusually structured inputs and particular sequences of calls. It also reports rediscovering CVE-2026-56132 in libexpat. These are claims from the project report; the source material does not provide an independent audit of every finding.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Where Machine-Checked Proofs Could Help
The work matters because it points to a possible way to scale a form of software assurance that has traditionally required substantial specialist effort. Fuzzing tests many inputs, but cannot guarantee that every possible path is covered. A successful proof can establish a property for all inputs within its model and limits, rather than only for the cases a test happened to reach.
Anthropic frames the method as a response to the difficulty of securing complex software, where vulnerabilities can remain even in heavily tested projects. Formal verification has been costly: the source cites the seL4 microkernel effort as taking two person-years to build and 20 person-years to verify. If AI can reduce the labor needed to construct proofs, more projects may be able to check specific security properties. That is a possibility suggested by this project, not a demonstrated cost reduction across software development as a whole.
The distinction between generating a proof and trusting its result is central. The project says roughly 180 million lines of proof did not need human review because the Rocq checker validates them. Confidence still depends on the specification, the formal models, and the checker and supporting systems being correct. The method makes checking machine-verifiable; it does not remove the need to decide what is being proved or which assumptions are acceptable.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to RISC-V Proofs
A fuzz test gives a program many automatically generated or mutated inputs and treats a crash as evidence of a defect. It is a practical way to find bugs, but it samples inputs and execution paths; a test run cannot establish that no untested path will fail. The reported approach takes an existing fuzz-test entry point and treats its behavior as a specification for a proof about a compiled binary.
This sidesteps one difficult part of formal verification: writing a complete, independent description of what a complex library is supposed to do. Instead, the team proves a narrower claim tied to an existing test, such as the absence of crashes or, in one example described in the source, a compression round-trip assertion. A proof about that assertion does not automatically establish every desired behavior of the library.
The source says the project’s models cover RISC-V instructions and Linux processes. Anthropic describes the work, to its knowledge, as the first large-scale use of AI to apply formal verification to production software at assembly-code level. It says it is publishing proofs that did not require patches, some previously unpublished trusted components, and specifications for fuzz tests it could not prove.
As an affiliate, we earn on qualifying purchases.
What the Proofs Do Not Cover
The proofs apply to single-threaded, static RISC-V binaries linked against musl, according to the source. Most users encounter different builds, commonly for x86 or ARM and linked against glibc. The report therefore does not establish that those versions have the same properties. It also does not prove that a library has no logic errors, vulnerabilities outside the specified entry points, or failures beyond the modeled conditions.
The 64-megabyte input limit and the specific fuzz-test entry points define the scope of each claim. A no-crash proof can be valuable, but it is not equivalent to a proof that a program behaves correctly for every purpose. The source itself describes a logic flaw in a file-loading restriction that did not necessarily crash, illustrating how a security-relevant defect can fall outside a crash-focused property.
It is also unclear from the supplied material how many bugs were independently reproduced, how many patches have been merged or released, and what the total computational cost was. The source says proofs can consume hundreds of millions of tokens and that newer models and shared proofs may reduce the burden, but it gives no complete cost accounting or comparative benchmark. The trusted base includes the formal models, theorem statements, Rocq checker, and supporting hardware and software components.
As an affiliate, we earn on qualifying purchases.
Publication and Broader Testing
Anthropic says it is publishing the proofs that required no code patch, the trusted components that were not already public, and specifications for tests it could not prove. Those materials should allow other researchers to inspect the proof scope, reproduce parts of the work, and assess its assumptions. The source does not give a schedule for publication or say how the reported code fixes will be distributed.
The next practical test is whether the approach can be applied to other architectures, build configurations, and properties that go beyond crashes. Independent review of the proof models and reported bugs will also help clarify how much confidence the results support. Until then, the report establishes a substantial proof-generation exercise with defined boundaries, not a general certification of the affected libraries.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
Anthropic says Claude produced Rocq proofs that 239 fuzz-test entry points in 123 libraries do not crash for inputs under 64 MB, under stated modeling assumptions. The claim applies to the specified compiled programs and properties, not every behavior of each library.
Does this mean the libraries are bug-free?
No. The proofs cover particular entry points and a defined no-crash property. They do not rule out every logic error, security flaw, or issue in code paths and builds outside the model.
How did the team check Claude’s proofs?
Claude generated proofs in Rocq, and the Rocq proof checker checked them against formal specifications. Trust also depends on the specifications, models of the processor and operating system, and supporting components.
Why could the method find bugs fuzzers missed?
Fuzzers test selected inputs and paths, while a successful proof must account for all paths reachable within its modeled scope. The project reports bugs that required unusually large inputs, rare layouts, or specific sequences of calls.
Do the results apply to software people use on their computers?
Not necessarily. The reported proofs cover single-threaded static RISC-V binaries linked against musl. The source says commonly used builds may target x86 or ARM and use glibc, which were not established by these proofs.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
