🔍 Read the full analysis: From Testing To Proof: What Anthropic’s Claude Work Actually Shows on ThorstenMeyerAI.com
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and Theorem reported that Claude produced machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs cover specific compiled RISC-V programs and a defined no-crash property, not every version or use of those libraries; the team also reported finding hundreds of bugs. The approach’s cost and narrow proof scope remain significant constraints.
Anthropic’s Frontier Red Team and its collaborator Theorem say Claude produced machine-checked proofs that 239 fuzz-test entry points across 123 open-source libraries do not crash on inputs under 64 MB in the compiled programs they examined. The result, reported October 22, 2026, also includes hundreds of bugs identified during proof attempts—but it does not establish that the libraries are bug-free or that their commonly used builds have the same guarantees.
The team’s claim concerns a specific property: for each entry point, the tested compiled RISC-V program does not encounter an AddressSanitizer memory error or a failed assertion on any input below the stated 64 MB limit. That claim depends on the models and assumptions used in the formal specification. It is not a general proof that an entire library is correct, secure, or free of bugs.
The method starts with an existing fuzz test and treats its crash conditions as the specification. Libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer. Claude generated proofs in Rocq, a proof assistant whose checker verifies whether a proof follows from the specification. When an attempt failed, the failure could point to a bug; the reported process included patching code and regenerating the specification before another proof attempt.
Anthropic says the work took a few weeks and produced about 180 million lines of proof. A typical proof was about 600,000 lines, and the binaries had a median length of 18,000 RISC-V instructions. The company says the proof corpus did not need to be read line by line by people: confidence instead depends on the formal models, the exact statements being proved and the Rocq checker, among other trusted components.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Why Machine-Checked Coverage Matters
Fuzzing tests many inputs but cannot, by sampling alone, establish that every possible path has been exercised. A proof of the specified property aims to cover all inputs and paths within its formal model. If the statement and model match the software people care about, that could provide stronger assurance for a defined class of failures than running more test cases.
The reported findings also illustrate the difference between testing and proof attempts. Anthropic says Claude found bugs that fuzzers had missed, including issues requiring unusually large inputs, rare data layouts or sequences of calls across multiple file handles. One reported example involved an input around 20 MB and a specific layout; another needed a 64 MB input and more than 2 GB of memory. These are examples attributed to the team, not evidence that all such issues are exploitable in deployed products.
The approach could matter to software maintainers if machine-checked verification becomes cheaper to apply. Formal verification has often required substantial expert labor; the source cites seL4 as an example in which verification took many times as much effort as construction. But the reported project also shows that automation does not remove the need to define properties, trust verification tools or manage substantial computing costs.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Formal Proofs
A fuzz test gives a program generated or mutated inputs and reports a failure when the test crashes or violates an assertion. It is useful for finding defects, but coverage depends on which inputs the fuzzer reaches. The approach described by Anthropic and Theorem turns that test’s behavior into a formal claim about a particular compiled executable.
That choice makes the specification more tractable, but also bounds what the proof means. It establishes the behavior expressed by the test, not every property a user might expect from the library. The source gives a round-trip compression test as an example: proving that the test does not crash can establish that decompression returns the original input under the specified conditions. Some proof attempts also required reasoning about properties not explicitly written in the test, such as ruling out a stack overflow from deep recursion in a C++ destructor.
Anthropic describes the project as, to its knowledge, the first large-scale use of AI for formal verification of production software at the assembly-code level. The work targets single-threaded, static RISC-V binaries linked against musl. The source says that is not the same build configuration as the x86 or ARM versions with glibc that most users run. Anthropic says it is publishing proofs that did not require patching, some previously unpublished trusted components, and specifications for tests it could not prove.
As an affiliate, we earn on qualifying purchases.
Limits of the Verified Programs
The result applies to the specified entry points and compiled programs, under the proof assumptions. It does not establish that other entry points, library features, operating systems, architectures or build configurations satisfy the same property. In particular, the source distinguishes the tested RISC-V and musl setup from commonly used x86 or ARM builds linked with glibc.
It is also unclear from the supplied account how many of the reported bugs were confirmed and fixed by maintainers, how many remain open, or how the findings are distributed across libraries. A proof attempt that does not finish can still reveal a bug, but an unfinished attempt does not itself establish the claimed safety property. The source says proofs can consume hundreds of millions of tokens, while newer models and shared proofs may reduce that cost; it does not give a full cost breakdown for this run.
More broadly, a proof that a test does not crash is only as useful as the test’s specification and the model’s relationship to real executions. The report identifies trusted components—including formal models and the Rocq checker—but the supplied material does not quantify residual risks from those components or from differences between the tested binaries and deployed software.
As an affiliate, we earn on qualifying purchases.
Publication and Replication Ahead
Anthropic says it is publishing the proofs that did not require code patches, trusted components that were not already public, and specifications for fuzz tests that it could not prove. Those materials may let maintainers and researchers inspect the theorem statements, reproduce parts of the work and evaluate whether the proof scope matches their needs.
The next practical test is whether maintainers can confirm the reported defects, issue fixes where needed and extend the method to other builds or software properties. The account does not give a release schedule for those materials or say whether the same guarantees will be established for the libraries’ usual x86 and ARM configurations. Until then, the reported result is evidence that AI-assisted proofs can be applied at substantial scale to a carefully bounded class of software behavior—not a blanket security certification.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
Anthropic says Claude proved that 239 specified fuzz-test entry points across 123 open-source libraries did not crash under a defined set of conditions in the compiled programs. The property covered inputs below 64 MB and excluded specified AddressSanitizer memory errors and failed assertions.
Does this mean the libraries are bug-free?
No. The proofs apply to particular entry points, binaries and properties. They do not show that every feature or build of each library is correct or free of security flaws.
How did the team check Claude’s proofs?
Claude wrote proofs in Rocq, and the Rocq proof checker checked them against the formal specifications. Trust also depends on components such as the formal models and the correctness of the statements being proved.
What kinds of bugs did the work find?
Anthropic reports hundreds of bugs, including memory-safety issues that required large or unusually structured inputs and a logic issue involving a file-loading restriction. The source does not provide a full breakdown of confirmed fixes or current status.
Does the result cover software most users run?
Not directly, according to the source account. The proofs cover single-threaded static RISC-V binaries linked against musl, while many users run x86 or ARM builds linked against glibc.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
