🔍 Read the full analysis: Anthropic’s Approach To Formal Verification Goes Beyond Fuzz Testing on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and Theorem report that Claude proved a no-crash property for 239 entry points across 123 open-source libraries, using formal proofs checked by Rocq. The work also found bugs that fuzzing had missed, but the proofs apply to specific compiled RISC-V programs under stated assumptions—not to every build or all possible defects.
Anthropic’s Frontier Red Team and collaborator Theorem said on October 22 that Claude had proved a defined no-crash property for 239 entry points in 123 open-source libraries, using formal verification of compiled machine code. The effort also found bugs that fuzz testing had missed, but its results apply to specific RISC-V builds and stated assumptions—not to every version of the libraries or to software as a whole.
The team’s claim is narrower than a general guarantee that the libraries are secure or bug-free. For each selected fuzz-test entry point, the proof establishes that the compiled program does not crash for any input under 64 megabytes, with no AddressSanitizer memory error or failed assertion, within the model used. The work concerns single-threaded, static RISC-V binaries linked against musl.
The process turns an existing fuzz test into a specification. The library and test are compiled into an instrumented RISC-V executable; Claude then writes a proof in Rocq, whose proof checker checks it against the specification. According to the source report, failed proof attempts can expose possible bugs, after which Claude can patch the code and attempt a new proof.
Anthropic and Theorem reported completing the work over several weeks. The resulting proofs total about 180 million lines of Rocq; a typical proof was about 600,000 lines and covered a binary with a median length of 18,000 RISC-V instructions. The source says Anthropic is publishing proofs that required no patching, previously unpublished trusted components and specifications for tests it could not prove.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Proofs Reach Beyond Fuzzing
Fuzz testing feeds many inputs to a program and looks for failures, but it cannot establish that every possible path has been tested. A formal proof instead aims to show that a specified property holds across all inputs and paths covered by its model. That difference helps explain why the project found bugs associated with large or unusually structured inputs and sequences of calls that ordinary fuzzing may not reach.
The source report describes examples including a decompressor counter underflow leading to an out-of-bounds write on a roughly 20-megabyte input with a rare layout, and an image-decoder out-of-bounds read requiring a 64-megabyte input and more than 2 gigabytes of memory. It also cites a bug involving calls across two handles to the same file and a rediscovery of CVE-2026-56132 in libexpat. These examples are attributed to the report; the supplied material does not independently document their remediation or severity.
The work matters because formal verification has traditionally required substantial specialist effort. Anthropic’s account presents AI-generated proofs, checked by a separate proof checker, as a way to attempt verification at a scale that would be difficult to achieve through manual proof-writing alone. The reported token costs remain a constraint, and a checked proof only provides assurance for the property and system that were actually specified.
formal verification software tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Existing Tests to Proofs
Fuzzing and formal verification answer related but different questions. A fuzzer explores inputs—often by mutating examples—and reports crashes it reaches. It can be effective at finding defects, but the absence of a crash during a test run does not show that no untested input can cause one. The project uses a fuzz test as the starting point for a more formal claim: that the test will not crash for inputs within its stated size limit.
According to the source, the proof pipeline relies on formal models of RISC-V instructions and Linux processes, an explicit theorem statement and the Rocq checker. The trusted base also includes components such as hardware, the operating system and the OCaml compiler used by Rocq. Anthropic says readers do not need to review every generated proof line, but the validity of the result still depends on these models, assumptions and tools.
The source frames the project against the broader difficulty of verifying software and cites the seL4 microkernel as an example of the labor involved: two person-years to build and 20 person-years to verify. It also points to recently disclosed Linux kernel vulnerabilities as motivation for seeking stronger assurance. Those examples are background supplied by the report, not evidence that this project verifies Linux or resolves software security generally.
As an affiliate, we earn on qualifying purchases.
Limits of the Verified Builds
The proofs do not cover every platform or deployment. The reported results concern single-threaded static RISC-V binaries linked against musl, while the source says most users run x86 or ARM builds linked against glibc. It is not established that the same properties hold for those versions, for different compiler settings or for other execution environments.
The no-crash claim also does not mean that a program behaves correctly in every respect or contains no vulnerabilities. It is limited to the property expressed by each test and the assumptions in the formal model. The source describes a logic bug in a file-restriction feature, illustrating that some security-relevant failures do not necessarily produce a crash. It does not give a full accounting of all bugs found, their fixes, or which remain open.
Cost and scalability are also unresolved. The source says proofs can consume hundreds of millions of tokens, while newer models and reuse of shared proofs may reduce the amount required. It does not provide a complete cost per library, an independent evaluation of the claimed bug count, or evidence that the approach is economical across software projects more broadly.
AddressSanitizer memory error detector
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Published Proofs and Further Checks
Anthropic says it is publishing the proofs that did not require code patches, the trusted components that were not already public, and specifications for fuzz tests it could not prove. Those materials may let outside researchers inspect the theorem statements, assumptions and checker setup. The source does not specify a publication schedule or describe completed independent reproductions.
The next questions are whether others can reproduce the results, how many findings are fixed and whether the method can be extended to other architectures and real-world build configurations. For now, the reported work is a substantial demonstration of AI-assisted proof generation, but its assurance remains bounded by the tested entry points, binary builds and formal specifications.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude proved that 239 selected fuzz-test entry points in 123 open-source libraries would not crash for inputs under 64 megabytes, under the project’s formal model and stated assumptions.
Does this show the libraries are bug-free?
No. The proofs cover a specific no-crash property for selected entry points and compiled programs. They do not establish that the libraries are free of all defects or secure in every use.
How did the team check Claude’s proofs?
Claude generated proofs in Rocq, and Rocq’s proof checker checked them against formal specifications derived from the fuzz tests and program model.
Why did formal verification find bugs that fuzzing missed?
Fuzzers explore inputs but may not reach rare paths, large inputs or specific call sequences. A proof attempt must account for every path covered by its model, which can expose defects that sampled testing did not reach.
Do the results apply to common x86 and ARM builds?
The reported proofs concern single-threaded, static RISC-V binaries linked against musl. The source says common x86 or ARM builds linked against glibc are not covered by those results.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
