🔍 Read the full analysis: The Evidence And Limits In Anthropic’s Claude Verification Work on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and collaborator Theorem reported that Claude produced machine-checked proofs of a no-crash property for 239 entry points in 123 open-source libraries. The work also found bugs, but the proofs apply to specific compiled RISC-V builds and inputs under 64 MB; they do not establish that the libraries are bug-free across platforms.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that Claude helped produce machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs address a specific property: under stated assumptions, the compiled RISC-V program does not crash on inputs under 64 MB, including through AddressSanitizer-detected memory errors or failed assertions. The result is a large-scale test of whether AI can help make software verification more practical, not evidence that the libraries are free of bugs.
The project starts with an existing fuzz test for each library entry point. Rather than trying to specify every aspect of a library’s intended behavior, the team treated each test as a specification: for any input within the stated size limit, the test should not crash. The library and test were compiled into a RISC-V executable and instrumented with AddressSanitizer, which turns certain memory errors into crashes.
Claude then generated proofs in Rocq, a proof assistant whose checker verifies whether a proof follows from its formal specification. Anthropic and Theorem describe a cycle in which failed proof attempts can point to possible bugs; Claude can patch code, after which the specification is regenerated and the proof attempted again. Anthropic says the work ran over a few weeks and produced about 180 million lines of proof. A typical proof was about 600,000 lines, for a binary with a median length of 18,000 RISC-V instructions.
Anthropic says the effort found hundreds of bugs, including cases it says were unlikely to be reached by ordinary fuzzing. Examples in the source account include a decompressor bug requiring an input of around 20 MB with a particular layout, and an image-decoder issue involving a 64 MB input and more than 2 GB of memory. It also describes a bug requiring a particular sequence of calls across two file handles, and a rediscovery of CVE-2026-56132 in libexpat. These are examples reported by the project, not independent confirmation of every finding or its severity.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What These Proofs Can Establish
The result matters because conventional fuzzing tests many inputs but cannot establish that every possible input follows a safe path. A valid formal proof can establish a property for all inputs covered by its specification and assumptions. If those conditions hold, additional fuzzing of that exact entry point is not needed to find a crash covered by the proof. That could make verification useful in areas where software failures carry significant costs.
The project also highlights a potential change in the economics of formal methods. Anthropic’s account says proof generation can require hundreds of millions of tokens, a substantial computational cost. The team points to newer models and reuse of shared proofs as ways to reduce that burden, but the report does not establish that the method is already economical for routine use across software projects. The work shows a demonstrated application at scale within this experiment; it does not show that AI has removed the labor or cost barriers to verification.
For developers and users, the most useful distinction is between a proven property and a generally secure product. A no-crash proof for a particular entry point can provide a stronger assurance than testing alone for the behavior it covers. It cannot by itself rule out other kinds of defects, flaws outside the entry point, or issues in different builds and environments.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Machine Proofs
Fuzzing supplies software with large numbers of generated or mutated inputs and looks for failures. Its strength is that it can find real bugs without a complete description of how every part of a program should behave. Its limitation is that testing only samples inputs and execution paths. The method reported by Anthropic and Theorem takes an existing fuzz test and asks a narrower formal question: does this test crash for any input within the specified size limit?
That narrower question is intended to avoid writing a full specification of what a complex library should do. It also sets firm boundaries on what the result means. The project models single-threaded, static RISC-V binaries linked against musl, according to the source account. Most users encounter other builds, including x86 or ARM programs linked against glibc. Proofs of the modeled binaries do not automatically carry over to those versions.
Formal verification has often required substantial specialist effort. The source article cites the seL4 microkernel as an example, saying its construction took two person-years and its verification took 20. In the reported experiment, Claude generated proofs and the Rocq checker assessed them. The trusted base remains important: the formal models of RISC-V and Linux processes, the theorem statements, and Rocq’s checker must be sound for the result to hold. Anthropic says it is publishing proofs that did not require patches, some previously unavailable trusted components, and specifications for fuzz tests it could not prove.
Where the Verification Stops
The proofs cover a defined set of fuzz-test entry points and a particular model of compiled code. They do not show that every function or behavior in the 123 libraries is safe, nor that the corresponding software is bug-free. The source describes a 64 MB input limit, single-threaded execution, static RISC-V binaries and musl; how the results translate to common x86 or ARM builds using glibc is not established.
Other limits concern the property itself. A proof that a test does not crash is not a proof that the program always returns the correct result or enforces every security policy. The source gives a logic bug involving a file-loading restriction as an example of a finding, while noting that the bug did not crash. It also says some tests could not be proved. The report does not provide, in the supplied material, a complete independent evaluation of the bugs, false positives, total compute expenditure or the verification rate across all attempted targets.
Finally, a machine-checked proof is only as reliable as its formal statement and trusted components. The Rocq checker verifies a proof against a specification; it does not establish that the specification captures every property users care about. Anthropic says the trusted components include the formal machine and process models and the theorem statements, with hardware, operating system and compiler assumptions also relevant.
Publication and Broader Testing
Anthropic says it is publishing proofs that required no code patching, trusted components that were not already public, and specifications for fuzz tests it could not prove. Those materials will allow outside researchers and maintainers to inspect the claims and potentially reproduce or extend parts of the work. The source does not give a schedule for broader deployment or a timetable for verifying additional libraries.
The next tests for the approach are whether it can cover more software, reduce the token and computing costs, and produce results that apply to the architectures and operating systems people actually use. Independent review of the published proofs, specifications and discovered bugs will help clarify how well the method works beyond the reported experiment. Until then, the reported proofs should be read as evidence for specific properties of specific modeled binaries, rather than a general security guarantee.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude generated Rocq proofs for a no-crash property covering 239 fuzz-test entry points in 123 open-source libraries. The property applies to inputs under 64 MB within the specified model and assumptions.
Does this mean the libraries are bug-free?
No. The proofs address defined entry points and properties in particular compiled programs. They do not establish that all library behavior is correct or that all builds are safe. The project also reported bugs and tests it could not prove.
How is this different from fuzzing?
Fuzzing tries many generated inputs but samples execution paths. A formal proof, if valid and based on an accurate specification, can establish the stated property for every input in its scope. The reported method uses existing fuzz tests as the starting point for that specification.
Do the results apply to software running on common computers?
Not automatically. The source describes proofs for single-threaded static RISC-V binaries linked with musl. It says the results do not directly cover common x86 or ARM builds linked with glibc.
What remains to be checked?
Independent reviewers can examine the published proofs, specifications and trusted components. Further work is also needed to determine how the method scales, how much it costs in practice and whether proofs can be produced for other architectures and software configurations.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
