🔍 Read the full analysis: What AI Readers Should Know About Anthropic’s Claude Verification Work on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Anthropic’s Frontier Red Team and collaborator Theorem report that Claude produced Rocq proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs cover specific compiled RISC-V programs and a no-crash property for inputs under 64 MB; they do not establish that the libraries are bug-free or that other builds are safe.
Anthropic’s Frontier Red Team and its collaborator Theorem say Claude has proved a defined security property for 239 fuzz-test entry points in 123 open-source libraries. The machine-checked Rocq proofs apply to compiled RISC-V programs and establish that, under stated assumptions, each entry point does not crash on inputs under 64 MB; the work also surfaced bugs that testing had not found.
The project takes existing fuzz tests as specifications. Fuzz tests send many generated or modified inputs through a library and treat a crash as a failure, but they cannot guarantee that every possible path has been exercised. Anthropic and Theorem instead compiled the libraries and tests into RISC-V executables, with AddressSanitizer instrumentation, then formulated a property covering every input below the stated 64 MB limit.
Claude generated proofs in Rocq, a proof assistant whose checker verifies whether a proof follows from its specification and formal models. Anthropic says the effort ran over several weeks and produced about 180 million lines of proof. A typical proof was around 600,000 lines and covered a binary with a median of 18,000 RISC-V instructions. The researchers say the volume of proof text did not require human review line by line; confidence rests instead on the checker, models, theorem statements and other trusted components.
Anthropic reports that the process found hundreds of bugs, including memory-safety issues and a logic flaw involving a feature intended to restrict which files an application could load. Examples in the source account include issues requiring unusually large or specially structured inputs, and a bug dependent on a particular sequence of calls. The source also says the work rediscovered CVE-2026-56132 in libexpat. These are reported findings from this project, not evidence that every identified issue has been fixed or that every library defect has been found.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Proofs Reach Beyond Fuzz Testing
The result matters because it demonstrates a way to use AI for more than generating code or searching for suspicious patterns: Claude helped construct proofs that a separate, mechanical checker could validate. If the approach can be made less costly and applied to more software, developers could gain stronger guarantees about specific properties than repeated testing alone can provide.
The distinction is important for security work. A fuzzer can find a crash in a tested path, but failure to find one does not prove that none exists. A proof of the stated property covers the modeled program and all inputs within the specification. Anthropic’s examples suggest that this can expose bugs in paths that are difficult for fuzzers to reach, including cases involving large inputs, unusual layouts or sequences of operations.
There are practical limits to the immediate impact. The source says proofs can consume hundreds of millions of tokens, making cost a bottleneck, though newer models and reuse of shared proofs may reduce the burden. This is a report of a research effort, not evidence that formal verification is now routine or affordable across production software.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Formal Claims
Formal verification checks whether a program meets a stated specification. Its difficulty often begins with defining what “correct” means. This project narrows the task by reusing fuzz-test entry points and their crash conditions rather than attempting to prove that an entire library behaves correctly in every respect.
In the described pipeline, a crash under AddressSanitizer signals a failure of the no-crash property. The compiled binary is modeled alongside RISC-V instructions and Linux processes; Claude attempts a Rocq proof, and a failed attempt can point to a possible bug. The code may then be patched, the specification regenerated and the proof attempted again. Anthropic says the work is, to its knowledge, the first large-scale AI use of formal verification on production software at the assembly-code level.
The source contrasts the approach with the long human effort traditionally associated with verification, citing seL4 as an example where verification took substantially more effort than building the microkernel. The project’s method does not remove the need for trusted foundations: the formal models, specification, proof checker and supporting software and hardware all affect what the result can establish.
As an affiliate, we earn on qualifying purchases.
What the Proofs Do Not Cover
The proof claim is narrower than saying the libraries are secure or bug-free. It applies to single-threaded, static RISC-V binaries linked against musl, with the specified fuzz-test entry points and input limit. The source says the results do not directly cover the x86 or ARM builds linked against glibc that many users run.
The result also depends on the exact property being proved: that the instrumented program does not crash under the modeled conditions. It does not establish that every intended behavior is correct, that every security weakness has been found, or that unmodeled components are safe. Anthropic says it will publish proofs that did not require patching, certain trusted components that were not already public, and specifications for fuzz tests it could not prove; the source does not spell out the status of every issue or every proof attempt.
Costs and reproducibility remain open questions. The reported proof volume is large, and it is not clear from the source how much compute and money the complete effort required, how performance changes across model versions, or whether independent teams have reproduced the results.
As an affiliate, we earn on qualifying purchases.
Publication and Cost Reduction
Anthropic says it plans to publish the proofs that required no code patch, previously unavailable trusted components and specifications for tests it could not prove. Those materials should let other researchers examine the claims and understand where the verification pipeline stopped short.
The next practical test is whether the method can be repeated across more libraries at lower cost, while keeping the specification and trusted computing base clear. The source points to newer models and shared proofs as possible ways to reduce token use, but does not provide a timetable or measured cost comparison. Until further results are available, the reported achievement is a large, bounded proof effort—not a general guarantee about the safety of the libraries or the versions most users install.
fuzz testing tools for open-source libraries
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude produced Rocq proofs that 239 specified fuzz-test entry points do not crash on inputs under 64 MB, under the models and assumptions used for compiled RISC-V programs.
Does this mean the libraries are bug-free?
No. The proofs cover a defined no-crash property for selected entry points and specific builds. They do not establish that a whole library is free of bugs or that every behavior is correct.
Why did the team use existing fuzz tests?
Existing fuzz tests provided a concrete starting specification: the tested program should not crash. This avoids having to define correctness for every function in an entire library, while still allowing the team to prove a property across the modeled inputs.
Do the results apply to software people run?
Not automatically. The reported proofs concern single-threaded, static RISC-V binaries linked against musl. The source says they do not directly cover common x86 or ARM builds linked against glibc.
What remains uncertain about the project?
The total compute and financial cost, the degree to which others can reproduce the results, and how well the method scales to more software remain unclear from the source. The proofs also depend on the accuracy of their specifications, formal models and trusted components.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
