🔍 Read the full analysis: Anthropic Turned Fuzz Tests Into Proofs. What Claude’s Formal Verification Work Shows, And What It Doesn’t on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic and collaborator Theorem report that Claude produced Rocq-checked proofs for 239 fuzz-test entry points across 123 open-source libraries, covering compiled RISC-V programs and inputs under 64 MB. The effort also found hundreds of bugs, but the results apply only to the specified tests and build conditions, not to every version or deployment of the libraries.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that they used Claude to produce machine-checked safety proofs for 239 fuzz-test entry points in 123 open-source libraries. The proofs cover compiled RISC-V programs and establish that the specified tests do not crash on inputs under 64 MB, subject to the project’s assumptions; the team also says its work found hundreds of bugs, including some earlier fuzzing had not reached.
The project starts with existing fuzz tests, which supply a limited, concrete specification: for a given entry point, the test should not crash. The libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer, so certain memory errors cause a failure. Claude generated proofs in Rocq, and the Rocq proof checker checked them against specifications built from formal models of RISC-V instructions and Linux processes.
Anthropic says the work was completed over a few weeks and produced about 180 million lines of Rocq proof. A typical proof was about 600,000 lines, for a binary with a median length of 18,000 RISC-V instructions. Those figures describe the proof artifacts, not code that people must read line by line: the claim relies on the specification, formal models and proof checker being correct, along with other trusted components such as hardware and the software environment.
When a proof attempt exposed a failure, the team used it to investigate possible bugs. Anthropic says Claude patched some code, after which the specification was regenerated and the revised program had to be proved again. The report describes examples involving an out-of-bounds write on a roughly 20 MB input with a rare layout, and an image-decoder read requiring a 64 MB input and more than 2 GB of memory. It also cites a bug dependent on a particular sequence of calls involving two handles to the same file, and a rediscovery of CVE-2026-56132 in libexpat.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What the Proofs Can Establish
The reported result matters because it applies a mechanical checker to a class of behavior that conventional fuzzing can only sample. Fuzzers try many generated or mutated inputs and can expose failures, but they cannot establish that every relevant path has been tried. A successful proof, by contrast, covers all inputs within the formal specification and stated model. For developers, that could provide stronger evidence about a narrow safety property than a large number of successful test runs.
That distinction is also the boundary of the claim. The work does not show that the libraries are bug-free, nor does it prove every behavior correct. It establishes the no-crash property of specified fuzz-test entry points for particular compiled programs under the project’s assumptions. Some higher-level checks can also encode useful behavior: Anthropic gives an LZO test that checks whether decompression restores the original input. Proving that test does not crash can establish that round-trip property within the model, but it does not certify the whole library for every use.
The approach may matter if the cost of producing and checking formal proofs falls. Anthropic’s report describes proof generation that can consume hundreds of millions of tokens, making compute and expense a practical constraint. The company says newer models and reuse of shared proofs can reduce the burden, but the source material does not provide a general cost per library or show that the workflow is ready for routine use across software projects.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq Proofs
Fuzzing and formal verification answer different questions. Fuzzing searches for failures by running a program with many inputs; a crash can reveal a bug, while the absence of a crash does not show that all inputs are safe. The Anthropic-Theorem method uses a fuzz test as the property to prove, avoiding the need to define correctness for an entire complex library from scratch.
The work also addresses a long-standing cost issue. Formal verification has often required substantial specialist effort; the source cites seL4 as an example, saying its microkernel took two person-years to build and 20 person-years to verify. Anthropic’s report argues that language models can help generate proofs at a larger scale, while a small proof checker provides a separate mechanical check. The report characterizes this as, to the team’s knowledge, the first large-scale use of AI to verify production software at the compiled assembly-code level.
The scope is narrower than the software most users run. The reported proofs concern single-threaded, static RISC-V binaries linked against musl. They do not directly establish the same properties for commonly deployed x86 or ARM builds linked against glibc. Anthropic says it is publishing proofs that did not require patches, certain trusted components that were not already public, and specifications for fuzz tests the system could not prove.
“The existing fuzz test becomes the specification.”
— Anthropic and Theorem, as described in the report
As an affiliate, we earn on qualifying purchases.
Where These Proofs Stop
The proofs establish only the properties encoded in their specifications and only for the modeled binaries and execution conditions. They do not show that every library function is correct, that every type of vulnerability is absent, or that a different build has the same properties. In particular, the reported RISC-V and musl results cannot be assumed to apply unchanged to the x86 or ARM and glibc builds used by many deployments.
The source material does not give an independently audited count or full classification of the bugs, nor does it specify the final patch status for every example. It also does not quantify the project’s total computing cost, explain how often proof generation failed, or establish whether other researchers have reproduced the results. Proofs depend on the accuracy of their formal models and theorem statements as well as the Rocq checker and other trusted components.
As an affiliate, we earn on qualifying purchases.
Publication and Wider Testing
Anthropic says it is releasing selected unpatched proofs, previously unpublished trusted components, and specifications for fuzz tests it could not prove. Those materials will allow technical readers to inspect the project’s formal assumptions and artifacts. The source does not give a schedule for further releases or say when the same process might cover other architectures.
The next important test is whether independent researchers and software maintainers can reproduce the proofs, review the reported bugs and assess the workflow’s cost on other codebases. Until results extend beyond the specified RISC-V builds and narrow no-crash properties, the work is evidence that AI can assist with large-scale formal verification—not a general security certification for the libraries involved.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude produced Rocq-checked proofs that 239 selected fuzz-test entry points in 123 libraries do not crash on inputs under 64 MB, for the compiled programs and assumptions specified in the project.
Does this mean the libraries are bug-free?
No. The proofs cover particular tests, properties, binaries and modeled conditions. They do not establish that every function is correct or that all vulnerabilities are absent.
How did the team use fuzz tests?
The team treated each existing fuzz test as a specification for a no-crash property. Claude generated a proof in Rocq, whose checker verified it against the formal specification.
Why did the process find bugs fuzzers missed?
Fuzzers sample inputs and execution paths. A proof must account for every path covered by its specification, which can expose failures tied to rare input layouts, large files or unusual call sequences.
Do the results apply to common x86 and ARM software builds?
Not directly. The reported proofs cover single-threaded static RISC-V binaries linked against musl. The source says they do not establish the same results for x86 or ARM builds linked against glibc.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
