🔍 Read the full analysis: Anthropic’s Claude Verification Effort, Explained In Two Parts on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Anthropic’s Frontier Red Team and Theorem say Claude generated Rocq proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs cover specified no-crash properties in compiled RISC-V programs, not all bugs or the x86 and ARM builds most users run; the teams also report finding hundreds of bugs.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that Claude produced formal proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs establish a limited property for compiled RISC-V programs: under the teams’ stated assumptions, the programs do not crash on inputs up to 64 MB, including through specified AddressSanitizer errors or failed assertions.
The method turns existing fuzz tests into specifications. A fuzz test supplies an entry point and a behavior that can be treated as a failure if it crashes or triggers an assertion. The teams compiled libraries and tests into RISC-V executables, instrumented them with AddressSanitizer, and used formal models of RISC-V instructions and Linux processes to define what the proof must show. Claude then generated proofs in Rocq, a proof-assistant system whose checker verifies whether a proof follows from its specification.
Anthropic says the work took place over several weeks and produced roughly 180 million lines of Rocq proof. A typical proof was about 600,000 lines and covered a binary with a median length of 18,000 RISC-V instructions. The company says the proof files do not need to be reviewed line by line: confidence rests on the specifications, formal models and Rocq checker, along with other components including hardware, the operating system and the OCaml compiler used by Rocq.
The teams report that attempts to prove the properties exposed hundreds of bugs, including issues they say years of fuzzing had not found. Examples in the source account include memory errors requiring unusually large or structured inputs, a bug triggered by a particular sequence of calls involving two handles to one file, and a file-loading restriction that was not consistently enforced. The account also cites a rediscovery of CVE-2026-56132 in libexpat. These are reported findings; the material does not provide a complete independent assessment of each bug or its remediation status.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Could Change
The experiment matters because it tests whether AI can help with a part of software security that is more demanding than generating code or running more tests: proving that a defined class of failure cannot occur within a model. Fuzzing samples inputs and can find defects it reaches. A successful proof, by contrast, must account for every execution path covered by the specification. That distinction could make formal verification useful for more software if the cost and engineering effort fall.
Anthropic frames the work against the possibility that AI systems can find and combine software vulnerabilities. Its argument is that testing alone may be insufficient where attackers can exploit small weaknesses, and that formal verification could establish stronger guarantees about selected properties. That is a motivation, not a result demonstrated by this project: the reported proofs concern specific fuzz-test entry points and crash-related behavior, not the absence of exploitable vulnerabilities throughout each library.
Cost remains a major constraint. The source account says some proofs consumed hundreds of millions of tokens, even as newer models and reuse of shared proofs may reduce the burden. If those costs remain high, the approach may be practical only for selected libraries and properties. If they fall, machine-checked verification could become more accessible, while still requiring clear specifications and trustworthy verification tools.
formal verification software tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq Proofs
Fuzzing is widely used to test software by sending large numbers of random or modified inputs to a program and watching for crashes or other failures. It is valuable for finding bugs, but a successful fuzzing campaign cannot establish that every possible input or execution path has been tested. The Anthropic-Theorem approach takes a fuzz test already written by developers and treats its entry point and failure conditions as the scope of a formal claim.
That choice narrows the specification problem. Rather than defining all correct behavior for a complex library, the teams ask whether a particular compiled test program can crash under the modeled conditions. The pipeline produces a RISC-V binary, models its execution, and asks Claude to construct a Rocq proof. If proof work reveals a possible defect, the source account says Claude may patch the code, regenerate the specification and attempt a new proof.
Anthropic describes the effort as, to its knowledge, the first large-scale use of AI for formal verification of production software at assembly-code level. The phrase is the company’s characterization. The work also builds on formal verification’s established but costly history: the source account cites the seL4 microkernel, for which it says development took two person-years and verification took 20. The reported experiment is an attempt to reduce that labor, not evidence that verification has become inexpensive or broadly routine.
The Proofs’ Scope and Open Limits
The result does not mean the libraries are bug-free. It covers single-threaded, static RISC-V binaries linked against musl, and the no-crash claims apply only to the entry points, input limits and assumptions represented in each specification. Most users encounter builds for other architectures and environments, including x86 or ARM systems linked against glibc; the source account says those configurations were not covered by these proofs.
The available account also leaves open how many reported bugs were confirmed by maintainers, patched, or assigned security advisories, and whether the proof results will transfer reliably to other compiler settings and production configurations. A proof can only establish what its specification states, and the reliability of the result depends on the correctness of the models and trusted components. Anthropic says it is publishing certain proofs and specifications, but the account does not provide enough detail to assess every artifact or reproduce the full process.
Proof Releases and Follow-Up Work
Anthropic says it is publishing proofs that did not require code patches, previously unavailable trusted components, and specifications for fuzz tests that the system could not prove. Those materials may let researchers and maintainers inspect the assumptions, repeat parts of the work and assess which findings apply to their software. The source account does not give a release schedule or report a specific next milestone.
The next questions are whether maintainers validate and address the reported bugs, whether the proofs can be extended to common x86 and ARM builds, and whether model and token costs decline enough for broader use. Until those points are clearer, the project is best understood as a substantial demonstration of AI-assisted proof generation for narrowly defined properties—not a general guarantee of software security.
Key Questions
What did Claude prove?
Anthropic and Theorem say Claude generated Rocq proofs that specified compiled RISC-V programs for 239 fuzz-test entry points do not crash on inputs up to 64 MB under stated assumptions. The claims include defined AddressSanitizer memory errors and failed assertions; they do not establish that the libraries have no bugs.
What role did Rocq play?
Claude generated proofs in Rocq, and the Rocq proof checker checked them against formal specifications. The checker helps verify the proof mechanically, but the result still depends on the specification, formal models and other trusted components being appropriate and correct.
Did the project find security bugs?
The teams report finding hundreds of bugs, including memory errors and a logic issue. The available account does not establish the confirmation, repair or disclosure status of every reported finding.
Do the proofs cover software people run on ordinary computers?
Not directly across all common builds. The reported proofs cover single-threaded, static RISC-V binaries linked against musl. The source account says x86 and ARM builds linked against glibc—the configurations many users encounter—were outside the work described.
Does formal verification mean these libraries are bug-free?
No. The proofs apply only to particular entry points, properties, input limits and modeled execution conditions. They do not rule out defects outside that scope or guarantee the behavior of every build and deployment.
Source: ThorstenMeyerAI.com
Evergreen bestsellers Picks
bestsellers
As an affiliate, we earn on qualifying purchases.
