🔍 Read the full analysis: A Closer Read Of Claude’s Move From Fuzz Testing To Formal Proof on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and Theorem say Claude proved that 239 entry points across 123 open-source libraries do not crash on inputs under 64 MB in specified, instrumented RISC-V builds. The work also uncovered hundreds of bugs, but the proofs apply to a narrow system configuration and do not establish that the libraries are bug-free.
Anthropic’s Frontier Red Team and collaborator Theorem say Claude produced machine-checked proofs for 239 fuzz-test entry points in 123 open-source libraries, showing that specified compiled programs do not crash on inputs under 64 MB. The work, reported October 22, also identified hundreds of bugs, but its result applies only to particular instrumented RISC-V builds and defined properties—not to every version or use of the libraries.
The team’s method starts with existing fuzz tests, which provide a ready-made specification: for each entry point, the program should not crash for any input within the stated size limit. The libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer, so memory errors and failed assertions would trigger a crash. Claude then wrote proofs in Rocq, a formal proof system whose checker verifies whether each proof follows from its specification.
According to Anthropic’s account, the project ran over a few weeks and generated about 180 million lines of Rocq proof. A typical proof was around 600,000 lines and covered a binary with a median of 18,000 RISC-V instructions. When an attempted proof failed, the failure could point to a possible bug; Claude could patch the code, regenerate the specification and attempt a proof again. Anthropic says it is publishing proofs that did not require code patches, previously unpublished trusted components, and specifications for fuzz tests it could not prove.
The reported bugs include cases that ordinary fuzzing might have difficulty reaching. Anthropic describes, among others, an out-of-bounds write requiring an input of roughly 20 MB with a rare layout, and an image-decoder read error that required a 64 MB input and more than 2 GB of memory. Another issue required a particular sequence of calls involving two handles to one file. The team also reports rediscovering CVE-2026-56132 in libexpat and finding a logic flaw in a feature intended to restrict which files an application could load. These are examples from the project, not evidence that every reported defect has the same severity or exploitability.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Add
Fuzzing tests many inputs and can expose crashes, but it cannot establish that every possible input has been tried. A formal proof can cover all inputs allowed by its specification and assumptions. That makes the reported work significant as a demonstration of AI-assisted verification at compiled-code level: it attempts to establish a bounded security property rather than relying only on samples of program behavior.
The distinction matters because security defects may be difficult to trigger during routine testing, especially when they require large inputs, unusual call sequences or rare data layouts. If the approach can be made practical, it could help software teams identify classes of defects that existing test campaigns miss. Anthropic presents the volume of machine-checked proofs as evidence that AI may reduce some of the labor involved in formal verification. The report does not, by itself, show that the approach is cheaper or more effective for typical production deployments.
The result is also narrower than a general safety guarantee. It says that particular binaries satisfy particular no-crash properties under stated conditions. It does not prove that the software behaves correctly in every respect, has no vulnerabilities, or is safe when built and run in other environments.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq Proofs
Fuzz testing supplies a practical starting point because developers have already written small programs that feed inputs into library code and treat crashes or failed assertions as bugs. Anthropic and Theorem used those tests as specifications rather than trying to define, from scratch, what every library should do. The property they sought to prove was correspondingly limited: the test does not crash for any input below the stated size limit.
The proof pipeline models the RISC-V instructions and Linux processes involved, while AddressSanitizer makes certain memory errors observable as crashes. Claude generates a proof, and the Rocq checker checks it against the specification. Anthropic says the proof checker and the formal models are among the components that must be trusted; its account also identifies hardware, the operating system and the OCaml compiler used by Rocq as part of the broader trust base.
Formal verification has historically demanded substantial expert effort. Anthropic cites the seL4 microkernel as an example, saying its development took two person-years and verification took 20 person-years. The new report argues that language models can change the cost of producing proofs, but also acknowledges that some proofs consumed hundreds of millions of tokens. The account says newer models and reuse of shared proofs can reduce that burden; it does not provide a full cost comparison for the library project.
“The project is, to its knowledge, the first large-scale use of AI to apply formal verification to production software at the assembly code level.”
— Anthropic
formal proof verification software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Where the Proofs Stop
The claims cover single-threaded, static RISC-V binaries linked against musl, not the x86 or ARM builds linked against glibc that many users run. The source material does not establish that the same properties hold for those other builds, for concurrent execution, or for behavior beyond each fuzz test’s specification and input limit. Differences in compilers, libraries and runtime conditions could affect whether the result transfers.
“Formally verified” here does not mean “bug-free.” A proof can establish only the stated property under the models and assumptions used. A program might still have a non-crashing logic error, an issue outside the tested entry point, or a vulnerability the no-crash specification does not capture. The report gives examples of bugs and describes material being published, but the supplied information does not provide a complete independent assessment of all defects, their severity, or the total compute and financial cost.
As an affiliate, we earn on qualifying purchases.
Published Proofs and Broader Testing
Anthropic says it is publishing the proofs that required no patch, the trusted components that were not already public, and specifications for tests the team could not prove. Those materials will allow outside researchers to inspect the formal models, statements and proof-checking process. The account does not specify a publication schedule for every component or say when equivalent work on commonly deployed x86 and ARM builds may be attempted.
The next substantive test is whether independent reviewers can reproduce and extend the results, and whether the method’s token and compute demands can fall enough for wider use. Until comparable proofs cover more architectures, runtime configurations and properties, the finding should be read as a bounded demonstration: Claude helped prove a specific no-crash guarantee for a defined set of builds, while also helping expose defects beyond the reach of the fuzzing described.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
Anthropic and Theorem say Claude helped produce Rocq-checked proofs that 239 fuzz-test entry points in 123 libraries do not crash on inputs under 64 MB in specified, instrumented RISC-V builds. The proofs cover the stated no-crash property, not every aspect of program correctness.
Does this mean the libraries are bug-free?
No. The proofs are limited to particular binaries, entry points, input bounds and assumptions. They do not rule out bugs outside those specifications or in other builds and environments.
How did the project use fuzz tests?
The team treated each existing fuzz test as a specification for a property: that the compiled program would not crash for any input within the defined size limit. Claude generated proofs, and the Rocq checker verified them against those specifications.
Why did the work find bugs fuzzers missed?
Fuzzers test a selection of inputs and paths. The proof attempts had to account for all inputs allowed by their specifications, which could expose rare cases involving large inputs, unusual layouts or sequences of calls. That does not mean every proof attempt found a bug.
Do the results apply to software people commonly run?
Not directly. The reported proofs concern single-threaded static RISC-V binaries linked against musl. The source says they do not cover the x86 or ARM builds linked against glibc that many users run.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
