🔍 Read the full analysis: What Fuzz Tests Can Teach Us About Claude’s Verification Work on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Anthropic’s Frontier Red Team and Theorem report that Claude proved a no-crash property for 239 fuzz-test entry points across 123 open-source libraries, using compiled RISC-V programs and the Rocq proof checker. The work also surfaced hundreds of bugs, but the proofs cover specific builds and assumptions—not every version, platform or behavior of the libraries.
Anthropic’s Frontier Red Team and collaborator Theorem reported October 22 that Claude proved a specific security property for 239 fuzz-test entry points in 123 open-source libraries: under stated assumptions, the compiled programs did not crash on inputs up to 64 MB. The effort also found hundreds of bugs, including cases the teams said conventional fuzzing was unlikely to reach, offering a large-scale test of whether AI can help make formal verification less costly.
The team used each library’s existing fuzz test as a specification. A fuzz test feeds inputs to a small program entry point and treats a crash or failed assertion as a defect. Here, the libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer, which makes certain memory errors cause a crash. Claude generated proofs in Rocq, whose checker then verified them against formal models of the processor instructions and Linux processes.
The proved property was bounded and specific: for every input under 64 MB, the tested program did not trigger an AddressSanitizer memory error or failed assertion, subject to the models and assumptions used. Anthropic says the proofs total about 180 million lines of Rocq, produced over a few weeks. The company said its claim that this is the first large-scale AI use of formal verification on production software at assembly level is, to its knowledge, accurate.
The proof process also exposed defects. Anthropic said it discovered hundreds of bugs, including a decompressor counter underflow associated with an out-of-bounds write on a roughly 20 MB input with a rare layout, and an image-decoder out-of-bounds read requiring a 64 MB input and more than 2 GB of memory. Other reported cases depended on a particular sequence of calls or deeply nested input. One logic defect involved a file-loading restriction that was not always enforced, though the source notes that such a bug does not necessarily cause a crash.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Formal Proofs Beyond Fuzzing
Fuzzing tests many inputs, but it cannot establish that every possible input or reachable code path has been checked. Formal verification aims to prove a property across all inputs within a defined model. In this project, that distinction matters because some reported defects required unusually large inputs, rare data layouts or sequences of operations that a fuzzer might not readily generate.
The work’s practical significance is both its reach and its limits. Producing and checking proofs at this scale suggests AI could help automate work that has traditionally demanded extensive specialist time. Yet the result is not a blanket guarantee that the libraries are secure or bug-free. It is evidence for a bounded claim about particular compiled programs, entry points, input sizes and modeled execution conditions.
For developers, the reported bugs may provide actionable leads for fixes and further testing. For security teams, the approach points to a possible complement to fuzzing rather than a replacement: fuzzers can find failures quickly, while proof attempts can expose cases outside ordinary test coverage. Whether that combination is affordable and useful across everyday development remains an open question.
formal verification software tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Existing Tests to Machine-Code Proofs
Formal verification has often been expensive because engineers must define precisely what a system is supposed to do and then prove that it does so. Anthropic’s account describes the seL4 microkernel as requiring two person-years to build and 20 person-years to verify, illustrating the labor involved in a highly rigorous effort. The new project reduces one specification hurdle by taking existing fuzz tests as the property to prove.
That choice makes the claim narrower than a proof of overall correctness. A fuzz test defines what counts as failure for its particular entry point: in this setup, a crash, an AddressSanitizer error or a failed assertion. The team’s pipeline compiles and instruments the test, generates a specification, has Claude attempt a proof, and uses Rocq to check it. If an attempted proof fails, the failure can point to a possible bug; the team may patch the code, regenerate the specification and try again.
Anthropic says about 180 million lines of proof did not need human review line by line. The claim instead relies on a smaller trusted base: the formal models, theorem statements and Rocq checker, alongside other supporting components such as hardware, the operating system and the OCaml compiler used by Rocq. Anthropic said it is publishing proofs that required no patching, some previously unavailable trusted components and specifications for tests it could not prove.
“To its knowledge, this is the first large-scale use of AI to apply formal verification to production software at the assembly code level.”
— Anthropic, describing the project’s novelty
As an affiliate, we earn on qualifying purchases.
Where These Proofs Stop
The reported proofs apply to single-threaded, static RISC-V binaries linked against musl. Anthropic says they do not directly establish the same property for the x86 or ARM builds linked against glibc that many users run. The result also depends on the accuracy and scope of the formal models, the theorem statements and the surrounding trusted software and hardware.
A no-crash proof for a fuzz-test entry point does not show that every library function, configuration or application behavior is correct. It may not cover defects that do not trigger the test’s asserted conditions, and the 64 MB input bound is part of the stated property. The reported logic flaw is a reminder that an issue can matter even when it does not produce a crash.
The source material does not give a full breakdown of the hundreds of bugs, how many were newly confirmed by maintainers, how many were fixed, or the total financial cost of the project. It says proof runs can consume hundreds of millions of tokens, while newer models and shared proofs can reduce the burden. The precise cost and reproducibility across other codebases remain unclear.
AddressSanitizer memory error detector
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Publication and Follow-Up Testing
Anthropic says it is publishing the proofs that did not require code patching, trusted components that were not already public, and specifications for fuzz tests that the system could not prove. Those materials could let other researchers inspect the claims and attempt to reproduce or extend the work.
The next practical steps are to review reported defects, determine which have been confirmed and fixed, and test whether the approach can be adapted to other architectures and common build configurations. Further work would also need to clarify the computational cost, how often proof attempts succeed, and how well the method handles properties beyond crash avoidance.
Until those details and broader builds are assessed, the finding is best understood as a large experiment in AI-assisted verification: a machine-checked result for selected programs under stated conditions, alongside bug reports that still require validation and follow-up.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude produced proofs that 239 fuzz-test entry points in 123 libraries did not crash on inputs under 64 MB, under the project’s models and assumptions. The proofs were checked by Rocq.
Does this mean the libraries are bug-free?
No. The result covers a defined no-crash property for selected entry points and compiled programs. It does not establish that every function, platform, configuration or behavior is free of defects.
How is formal verification different from fuzzing?
Fuzzing tries many generated or mutated inputs and looks for failures. A proof aims to establish a specified property across all inputs within its modeled scope, rather than only the inputs a test happens to exercise.
What kinds of bugs did the effort report?
Anthropic said it found hundreds, including memory-safety issues involving large or unusual inputs and a logic defect in enforcement of a file-loading restriction. The supplied report does not give a complete independently verified bug tally.
Do the results apply to software people use on other systems?
Not directly. The reported proofs concern single-threaded static RISC-V binaries linked against musl. Anthropic said they do not automatically apply to common x86 or ARM builds linked against glibc.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
