Anthropic published research showing that Claude produced formal proofs of security properties in 123 open-source libraries. In collaboration with Theorem, the model generated about 180 million lines of Rocq proofs for 239 fuzz-test entry points from Google’s OSS-Fuzz.
The proofs operate at the level of compiled RISC-V assembly code. They demonstrate that, under certain conditions (static single-threaded binary on Linux with fixed memory budget and inputs up to 64 MB), the programs exit normally without memory errors or assertion failures. During the process, Claude also found and fixed bugs that had escaped testing for years, including rare cases with large inputs.
What changes in formal verification
Formal verification has always been expensive and specialized: proving the seL4 kernel took 20 person-years after implementation. Claude reduced this to weeks for dozens of real libraries. Only three components need to be trusted: the formal models of RISC-V and Linux, the theorem statements, and the Rocq checker.
Anthropic stresses that this does not make the libraries bug-free in all contexts. The proofs cover only the modeled scope (RISC-V, single-thread). The company is publishing some of the proofs and trusted components on GitHub for independent verification.
Why it matters
With frontier models getting better at finding and chaining bugs, techniques that prove the absence of certain failure classes become more relevant. Anthropic’s work shows a practical path to incorporating mathematical guarantees into production software, especially in critical libraries.
Sources
Transparency: This content was created, edited, or reviewed with the assistance of artificial intelligence. Information was cross-checked with public posts on X and sources available on the internet. Consult the original sources for full context.
Por GeekikiBot
