🔍 Read the full analysis: A Question For AI Verification: What Does Claude’s Work Establish? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and Theorem say Claude proved a no-crash property for 239 fuzz-test entry points across 123 open-source libraries, using compiled RISC-V binaries and the Rocq proof checker. The effort also uncovered bugs, but the results do not establish that the libraries are bug-free or that their commonly used x86 and ARM builds have the same properties.
Anthropic’s Frontier Red Team and research collaborator Theorem reported October 22 that Claude proved a defined no-crash property for 239 fuzz-test entry points in 123 open-source libraries. The proofs were checked by Rocq against compiled RISC-V programs; the teams also said the process found hundreds of bugs, while emphasizing that the results apply only to the systems and conditions modeled.
The property was specific: for each tested entry point, the compiled program would not crash on any input under 64 megabytes, including through an AddressSanitizer memory error or a failed assertion, under the project’s stated assumptions. The work did not prove that every function or behavior in each library is correct. It used existing fuzz tests as specifications, treating a crash or failed assertion as the condition to rule out.
According to the source report, the team compiled libraries and tests into RISC-V executables, instrumented them with AddressSanitizer, and had Claude produce proofs in Rocq. The Rocq proof checker then checked the proofs against formal specifications built from models of RISC-V instructions and Linux processes. If a proof attempt failed, that could point to a possible bug; the code could be patched and the specification generated again.
The reported output was large: about 180 million lines of Rocq proof, with a typical proof around 600,000 lines and a median binary length of 18,000 RISC-V instructions. Anthropic said the effort took a few weeks and discovered hundreds of bugs, including issues it said ordinary fuzzing was unlikely to reach. It also described proof generation as expensive, with some jobs consuming hundreds of millions of tokens. Those figures and findings are reported by the source; the material does not provide an independent audit of the full results.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Add
The report matters because it presents AI as a way to help generate formal proofs for software properties, rather than only producing test cases or identifying suspicious code. Fuzzing samples inputs and can expose failures it reaches; a proof, if valid for the specification and model, rules out the specified failure across all inputs in scope. That distinction could help find rare edge cases and provide stronger evidence for narrowly defined safety properties.
However, proof coverage is not the same as general software security. The reported claim concerns selected entry points, a particular property, and compiled programs under stated assumptions. It does not establish that every bug class is absent, or that a library is safe for all uses. The source also says proving these properties can require hundreds of millions of tokens, making cost and scaling practical questions even if the approach works as described.
For developers and organizations evaluating the work, the key issue is whether the specifications match the behavior they need to protect and whether the modeled environment matches deployment. The proof checker can validate a proof relative to those inputs; it cannot make an incomplete specification cover unmodeled behaviors.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq
Fuzzing feeds programs large numbers of random or mutated inputs and records crashes or assertion failures. Its results depend on which paths the generated inputs reach. Anthropic and Theorem’s reported approach starts from existing fuzz tests, turning their crash conditions into a formal property to prove. This avoids writing a complete specification of what an entire library should do, but it also means the result is limited to the tests and properties selected.
The project’s stated setup used static RISC-V binaries linked against musl, with AddressSanitizer instrumentation. The source report says the proofs do not directly cover the x86 or ARM builds linked against glibc that most users run. The work therefore concerns a model of particular compiled programs, not an automatic guarantee that source code behaves identically across platforms.
The source describes formal verification as a long-standing but labor-intensive practice, citing the seL4 microkernel project as an example of substantial verification effort. Anthropic presents language models as a possible way to reduce the human effort needed to produce proofs. It says it is publishing proofs that did not require patches, previously unpublished trusted components, and specifications for fuzz tests it could not prove.
As an affiliate, we earn on qualifying purchases.
Limits of the Reported Guarantees
The available account does not establish that all reported bugs have been independently reproduced, fixed, or disclosed to maintainers. It also does not provide a complete breakdown of the hundreds of findings, how many were confirmed vulnerabilities, or how many remained under investigation. Those distinctions matter because a failed proof may identify a possible defect, but the account does not say every such signal became a confirmed security issue.
The proof claim is conditional on the formal models, theorem statements, compiler and other trusted components, as well as the chosen entry points and input limit. The source says roughly 180 million lines of proof did not need human review because the checker validates them, but the soundness of the overall result still depends on the correctness of the trusted base and the fit between the model and the program being discussed. The work covers single-threaded static RISC-V binaries linked against musl, not the x86 or ARM builds linked against glibc that are more commonly deployed.
It is also unclear from the supplied material how the token-cost figures were calculated across the full project, how much human work was needed to prepare and repair code, and whether the approach will be economical across larger or more complex software. The report supports a narrow claim about specified properties in a particular setup, not a general conclusion that AI-generated proofs remove the need for testing or security review.
As an affiliate, we earn on qualifying purchases.
Publication and Independent Checks
Anthropic says it is publishing the successful proofs, trusted components that were not already public, and specifications for tests it could not prove. Those materials may allow researchers and developers to inspect the formal statements, check the evidence, and compare the models with the binaries and assumptions used in the work.
The next useful milestones are clearer reporting on the bugs found, including their confirmation and remediation status, and independent examination of the proofs and trusted components. Further work will also need to show whether the method can cover more entry points, other architectures and deployment environments, while reducing the computational cost. Until then, the reported result is a substantial demonstration of a specific verification workflow, not a blanket certification of the libraries.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude generated proofs that 239 fuzz-test entry points in 123 libraries would not crash on inputs under 64 MB under the stated model and assumptions. This includes the specified AddressSanitizer memory errors and failed assertions; it does not mean the libraries have no bugs.
Who checked the proofs?
The proofs were written in Rocq and checked by the Rocq proof checker against formal specifications. That machine check validates a proof relative to the specifications and trusted components; it does not independently establish that the specification covers every security concern.
Did the project find confirmed vulnerabilities?
The source report says the process found hundreds of bugs and gives examples, including memory-safety issues and a logic flaw. The supplied material does not provide a complete breakdown of which findings were independently confirmed, fixed, or publicly disclosed.
Do the results cover software people commonly run?
Not directly, based on the reported setup. The proofs cover single-threaded static RISC-V binaries linked against musl; the source says they do not cover the x86 or ARM builds linked against glibc that most users run.
Does formal verification replace fuzzing?
No. The work used existing fuzz tests as the basis for the specifications, and its conclusions apply to the properties those tests express. Fuzzing, broader testing, code review and security analysis may address other behaviors and risks not covered by these proofs.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
