🔍 Read the full analysis: Anthropic Turned Fuzz Tests Into Proofs. What Claude’s Formal Verification Work Shows, And What It Doesn’t on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic and collaborator Theorem report that Claude produced Rocq-checked proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs cover specific compiled RISC-V binaries and inputs under 64 MB, not every build or every possible software defect; the work also found hundreds of bugs, according to Anthropic.
Anthropic’s Frontier Red Team and collaborator Theorem say they used Claude to produce machine-checked proofs that 239 entry points in 123 open-source libraries do not crash on any input under 64 MB in specified compiled versions. The work applies formal verification to software at the machine-code level and, Anthropic says, found hundreds of bugs that existing fuzzing had not caught.
The team used existing fuzz tests as the properties to prove. Each test was compiled with its library into an instrumented RISC-V executable; AddressSanitizer was used so certain memory errors trigger a crash. Claude then generated proofs in Rocq, whose proof checker verifies them against formal models of RISC-V instructions and Linux processes. The stated result is limited: for the modeled program and assumptions, the test does not crash for inputs smaller than 64 MB.
Anthropic says the work was completed over a few weeks and generated about 180 million lines of Rocq proof. A typical proof was about 600,000 lines, and the median binary contained 18,000 RISC-V instructions. The company says roughly 180 million lines did not need human review: trust rests instead on the proof checker, formal models, theorem statements and other components in the verification setup.
Anthropic reports that the process found bugs including an out-of-bounds write triggered by a rare input layout at around 20 MB, and an image-decoder out-of-bounds read requiring a 64 MB input and more than 2 GB of memory. Other examples depended on a particular sequence of calls or deeply nested input. The source also describes a logic flaw involving a file-loading restriction, which illustrates that bugs are not limited to memory errors that cause crashes.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Can Cover
The result matters because testing samples inputs, while a successful proof can establish a property for every input within the specification’s limits. Fuzzers are useful at finding failures, but they cannot guarantee that every reachable path has been tested. A formal proof can provide that guarantee for the particular program, property and assumptions it models.
That distinction does not make the libraries bug-free. The reported property is that a given fuzz-test entry point will not crash under specified conditions; it is not a proof that the whole library behaves correctly, is secure against every attack, or has no defects. The file-restriction logic flaw cited by Anthropic also shows that correctness properties must be stated and encoded to be proved.
The approach may lower the labor barrier to formal verification, which has historically required substantial specialist effort. But Anthropic’s own account identifies a serious practical constraint: some proofs consumed hundreds of millions of tokens. The scale is notable; whether the method is economical and repeatable across more software remains an open question.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq Proofs
Fuzzing runs software with many generated or mutated inputs and records crashes or other failures. Its effectiveness depends on reaching the relevant code paths and supplying inputs capable of triggering a defect. The approach described by Anthropic and Theorem starts with a developer’s existing fuzz-test entry point, rather than attempting to specify an entire application’s intended behavior from scratch.
The team compiled the test and library to a static RISC-V binary linked against musl, then generated a formal specification for the no-crash property. Claude wrote a proof, and the Rocq checker tested whether that proof followed from the specification and formal models. When an attempt failed, the failure could point to a possible bug; the team says Claude could patch the code, regenerate the specification and attempt a new proof.
Anthropic frames this as a response to the difficulty of checking software too large for conventional manual verification. It cites the seL4 microkernel as an example of the historical cost, saying its construction took two person-years and its verification 20. The new work is a research report, not evidence that the same method has already been applied to every release or deployment of the libraries.
“The process “discovered hundreds of bugs.””
— Anthropic
Limits of the Verified Builds
The proofs apply to single-threaded, static RISC-V binaries linked against musl, according to the source material. Most users will encounter other builds, including x86 or ARM systems linked against glibc. The report does not establish that those versions share the proved property.
The result also depends on the exact theorem statements, formal models, proof checker and supporting system. A proof only establishes what its specification says. The source does not give a full independent assessment of every assumption or explain the extent to which each discovered bug has been fixed, disclosed or reproduced in other builds. Nor does it provide a complete cost accounting for the token use and human work across the project.
Publication and Broader Testing
Anthropic says it is publishing proofs that did not require code patches, trusted components that were not already public, and specifications for fuzz tests it could not prove. Those materials should allow others to inspect the formal setup and evaluate which properties were covered. The source does not state a timeline for broader verification work or identify a next set of libraries.
The next practical questions are whether the proofs can be reproduced, whether fixes for reported bugs reach affected versions, and whether the method can cover other architectures and build configurations at a manageable cost. Until those points are established, the reported results should be read as proofs about the modeled binaries and entry points—not as a general security certification of the libraries.
Key Questions
What did Claude prove?
Anthropic says Claude produced Rocq-checked proofs that 239 fuzz-test entry points do not crash for inputs under 64 MB in the specified compiled programs and under the project’s assumptions.
Does this mean the libraries are bug-free?
No. The proofs establish a defined property for particular binaries and entry points. They do not show that the entire libraries are free of defects or that every security or correctness property has been proved.
How is this different from fuzzing?
Fuzzing tests many generated inputs but may miss rare paths or input patterns. A successful formal proof can cover all inputs within the stated specification, though only for the modeled program and property.
Does the result cover software people commonly run?
Not necessarily. The reported proofs cover single-threaded, static RISC-V binaries linked against musl. The source says they do not establish the same result for common x86 or ARM builds linked against glibc.
What remains to be checked?
Independent reproduction, the status of fixes, applicability to other builds, and the project’s full cost remain unclear from the source material. Anthropic says it is publishing proofs and related verification materials for review.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
