🔍 Read the full analysis: What Claude’s Formal Verification Work Means For AI-Assisted Coding on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and Theorem reported that Claude produced machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs cover specific compiled RISC-V programs and a defined no-crash property, not every build or all possible bugs; the teams also reported finding hundreds of bugs.
Anthropic’s Frontier Red Team and its collaborator Theorem said on October 22 that Claude had produced machine-checked proofs for 239 fuzz-test entry points in 123 open-source libraries. The work, checked with the Rocq proof assistant, establishes a specific result for each tested program: under stated assumptions, its compiled RISC-V version does not crash on any input under 64 MB. The teams also said the effort found hundreds of bugs, including cases prior fuzzing had not reached.
The project uses existing fuzz tests as specifications rather than asking developers to define correctness from scratch. Each library and test was compiled into an instrumented RISC-V executable. AddressSanitizer made specified memory errors cause a crash, while formal models described the processor instructions and Linux process behavior. Claude then generated proofs in Rocq, whose checker verified whether each proof followed from its specification.
The result is narrower than a general declaration that a library is safe. The proved property is that a particular fuzz-test entry point does not crash for inputs under 64 MB, for the modelled binary and under the stated assumptions. It covers issues such as AddressSanitizer-detected memory errors and failed assertions. It does not establish that the software has no logic errors or that every possible use of the library is correct.
Anthropic and Theorem report that the proofs total about 180 million lines of Rocq, produced over a few weeks. A typical proof was about 600,000 lines, for a binary with a median length of 18,000 RISC-V instructions. The teams say the checker, rather than human readers, verified the proofs. They identify the theorem statements, formal models and Rocq checker among the components that must be trusted.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Add
Fuzzing tests software by supplying many inputs and looking for crashes. It can uncover serious flaws, but the fact that a test has not found a bug does not show that every relevant input or execution path has been covered. A proof of the stated property offers a different kind of assurance: for the modelled program, it accounts for all inputs in scope rather than a sample chosen by a fuzzer.
The reported bugs illustrate why that distinction may matter. Anthropic says some flaws required large inputs, rare layouts or particular sequences of calls. One reported out-of-bounds read involved a 64 MB image input and more than 2 GB of memory; another required calls across two handles to the same file. The teams also reported rediscovering CVE-2026-56132 in libexpat and finding a file-loading restriction that was not always enforced, a logic flaw that did not necessarily cause a crash.
For developers, the work suggests that AI could help produce formal proofs at a scale that would be difficult to achieve through manual proof-writing alone. Rocq’s checker provides a mechanical check of the generated proof, but it does not remove the need to trust the specification, models and surrounding toolchain. The findings are a research result, not evidence that software broadly has become safe or that AI-generated proofs can replace testing and review.
formal verification software tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq Proofs
Formal verification aims to show mathematically that software meets a stated specification. The hard part is often defining that specification. In this project, Anthropic and Theorem used fuzz tests already written for OSS-Fuzz libraries as the starting point. Those tests provide an entry point and a property whose failure can be represented as a crash.
The approach differs from ordinary fuzzing in what it can establish. A fuzzer explores inputs and execution paths, often guided by code coverage; it cannot guarantee that every path has been tried. The proof process instead seeks to show that the specified crash condition cannot occur for any input in the defined range. When Claude’s proof attempt failed, the failure could point to a possible bug; the team says Claude could patch the code, regenerate the specification and attempt a new proof.
Anthropic describes the project as, to its knowledge, the first large-scale use of AI to apply formal verification to production software at the assembly-code level. That is the company’s characterization, not an independently established ranking. The source also notes that formal verification has historically required substantial human effort, citing seL4 as an example in which verification took far more person-time than building the microkernel.
“The project is, “to our knowledge,” the first large-scale use of AI to apply formal verification to production software at the assembly-code level.”
— Anthropic
As an affiliate, we earn on qualifying purchases.
Where the Proofs Stop
The results apply to single-threaded, static RISC-V binaries linked against musl, according to the source account. Most users and production systems may run different builds, including x86 or ARM binaries linked against glibc. The report does not establish that the same proofs apply to those versions, or that compiling the same source for another platform preserves the result.
The proof scope also has limits beyond the platform. The specified property concerns crashes detected through the instrumentation and assertions used in the fuzz test, for inputs below the stated size limit. A program can produce an incorrect result without crashing, and a property not captured by the test may remain unproved. The teams’ reported file-loading logic flaw is an example of why no-crash proofs and overall correctness are distinct questions.
The source material says proof generation can consume hundreds of millions of tokens, making cost a constraint, and that newer models and shared proofs can reduce the burden. It does not provide a complete cost per library or a quantified comparison with human verification. The degree to which the approach can be made economical across different codebases remains unclear.
AddressSanitizer memory error detector
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Publication and Broader Testing
Anthropic says it is publishing proofs that did not require code patching, previously unavailable trusted components, and specifications for fuzz tests it could not prove. Those materials could let researchers inspect the claims and test the method, though the source account does not set out a timetable for wider adoption or independent replication.
The next practical question is whether the workflow can extend beyond these particular RISC-V builds and fuzz-test properties without making proof costs prohibitive. Further evaluation would need to examine other architectures, operating-system and library configurations, as well as properties that go beyond whether a test crashes. Until that work is reported, the result should be read as a large demonstration of bounded formal verification, not a general certification of the 123 libraries.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
For 239 fuzz-test entry points in 123 libraries, Claude produced Rocq proofs that the specified compiled RISC-V program does not crash on any input under 64 MB, under the project’s stated assumptions. The property includes defined crash conditions such as AddressSanitizer memory errors and failed assertions.
Does this mean the libraries are bug-free?
No. The proofs cover a specific property, binary configuration and input range. They do not establish that the libraries have no logic flaws, that every behavior is correct, or that other platform builds have the same guarantees.
How is this different from fuzzing?
Fuzzing tries many inputs and searches for failures, but it cannot generally show that all relevant inputs were tested. A formal proof aims to show that the defined failure cannot occur across the entire input range in scope.
What bugs did the teams report finding?
Anthropic and Theorem say they found hundreds of bugs. Examples in the source account include out-of-bounds reads or writes requiring unusual input sizes or call sequences, a rediscovery of CVE-2026-56132 in libexpat, and a file-loading restriction that was not always enforced.
Can the results be applied to software people already run?
Not directly on the evidence described. The proofs cover single-threaded, static RISC-V binaries linked against musl; the source notes that common x86 and ARM builds linked against glibc are outside that scope.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
