🔍 Read the full analysis: Claude, Fuzz Testing, And Proofs: Separating Findings From Open Questions on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and Theorem report that Claude helped prove no-crash properties for 239 entry points across 123 open-source libraries. The Rocq-checked proofs also exposed hundreds of bugs, but apply to specific compiled RISC-V binaries and do not establish that the libraries are bug-free across platforms.
Anthropic’s Frontier Red Team and research collaborator Theorem said on October 22 that Claude helped prove a defined no-crash property for 239 fuzz-test entry points in 123 open-source libraries. The proofs were checked by Rocq against compiled RISC-V programs, and the effort also found hundreds of bugs, according to the teams; the results apply only to the specified binaries and assumptions, not every version or platform.
The property proved was limited and concrete: for each tested entry point, the compiled program would not crash on any input under 64 megabytes, with no AddressSanitizer memory error or failed assertion under the stated model. The teams used existing fuzz tests as specifications rather than trying to define broad, general-purpose software correctness. A fuzz test runs a library function on inputs and treats a crash or failed assertion as a defect.
In the reported pipeline, libraries and fuzz tests were compiled into RISC-V executables with AddressSanitizer instrumentation. Theorem’s formal models of RISC-V instructions and Linux processes were used to generate specifications. Claude then produced proofs in Rocq, a proof-assistant system whose checker validates whether a proof follows from its specification. When proof attempts failed, the team said the failures could point to bugs; Claude could patch code, after which the specification and proof were generated again.
Anthropic reported that the work took a few weeks and produced roughly 180 million lines of Rocq proof. The company said about 180 million lines did not need human review because trust rests on the theorem statements, formal models and proof checker, along with supporting components. It is publishing proofs that did not require patches, some previously unavailable trusted components, and specifications for tests the system could not prove.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Add
The reported result points to a possible way to extend security checks beyond the paths that conventional fuzzing happens to exercise. Fuzzers explore inputs and code paths through repeated testing; a successful formal proof can establish a property for every input covered by its specification and model. That distinction matters for vulnerabilities triggered only by large, unusual or carefully structured inputs.
Anthropic said the work found hundreds of bugs, including issues it said fuzzers were unlikely to reach. Examples in its account include a decompressor counter underflow leading to an out-of-bounds write on a roughly 20-megabyte input with a rare layout, and an image-decoder out-of-bounds read requiring a 64-megabyte input and more than 2 gigabytes of memory. The source also describes a bug requiring a sequence of calls across two file handles, and a file-loading restriction that was not consistently enforced. These are examples reported by the company, not independent measurements of how often such defects occur across software.
The approach could make formal verification less dependent on large teams of specialists, but the project also shows that proof generation is expensive. Anthropic said some proofs consumed hundreds of millions of tokens. It described newer models and reuse of shared proofs as ways to reduce that cost, but did not establish that the method is already economical for routine use across arbitrary software.
Products Worth Considering
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
Bose QuietComfort Wireless Over-Ear Noise-Cancelling Headphones, Sandstone
Apple iPad 11-inch (A16), 128GB, Wi-Fi, Silver
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Specifications
The project addresses a familiar gap: fuzz testing can uncover defects, but running many inputs does not by itself prove that all relevant cases have been tested. Formal verification can provide such guarantees for a precisely stated property, yet writing specifications and proofs has traditionally required substantial expert effort. Anthropic cited the seL4 microkernel as an example of the burden, saying its development took two person-years and verification took 20 person-years.
Rather than specify whether an entire library is “correct,” the teams used existing fuzz-test entry points and their crash conditions. That makes the claim narrower and easier to state: the test does not crash for any modeled input within the size limit. The reported proofs also sometimes covered higher-level assertions. Anthropic gives an LZO compression test as an example: proving that its test never crashes can establish that decompressing compressed input returns the original, within the conditions represented by the test and model.
The work was conducted at the level of compiled machine code, rather than only reasoning from source code. Anthropic described it as, to its knowledge, the first large-scale use of AI for formal verification of production software at assembly level. That characterization is the company’s assessment, not a separately confirmed field-wide consensus.
“To its knowledge, this is the first large-scale use of AI to apply formal verification to production software at the assembly code level.”
— Anthropic, describing the project’s novelty
Where These Proofs Stop
The results do not show that the libraries are bug-free. They establish only the properties stated in the specifications, for the modeled programs and conditions. The reported scope is single-threaded, static RISC-V binaries linked against musl; most users encounter builds for x86 or ARM, often linked against glibc. The source does not establish that the same proofs hold for those builds, other configurations or behavior outside the tested entry points.
The input bound, AddressSanitizer instrumentation and formal assumptions also limit what can be inferred. A proof that a particular entry point does not crash under these conditions does not rule out logic errors that do not trigger the test’s assertions, concurrency defects, or failures in components not represented by the model. Anthropic’s account includes a logic bug found during the work, but that does not mean every property of the library was covered.
Several practical questions remain open: the source does not give a full per-library breakdown of proof success, patched defects or compute costs, nor does it report an independent replication. It says proofs can require hundreds of millions of tokens and that newer models and shared proofs may use fewer, but gives no general cost figure for applying the technique to a new codebase.
Proofs, Patches and Broader Builds
Anthropic said it is publishing proofs that did not require code patches, trusted components that were not already public, and specifications for fuzz tests that could not be proved. Those materials will let researchers and maintainers examine the precise claims and assumptions rather than relying only on a summary of the results.
The next meaningful test is whether the approach can be repeated across more software and adapted to builds people actually use. That would require showing how proofs transfer across architectures, operating systems, libraries and compiler configurations, while reporting the time and computing resources needed. The source does not give a timetable for that work.
For now, the reported development is a demonstration of machine-checked proofs for a bounded set of properties and programs, alongside bug discoveries. Whether the method can make verification affordable and broadly useful remains to be shown.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude generated Rocq proofs that 239 fuzz-test entry points across 123 libraries would not crash for inputs under 64 megabytes, with no AddressSanitizer memory error or failed assertion under the stated assumptions.
Does this mean the libraries are bug-free?
No. The proofs cover specific properties, entry points, binaries and modeled conditions. They do not establish that every library version or platform is free of bugs.
How were the proofs checked?
Claude wrote proofs in Rocq, and Rocq’s proof checker checked them against formal specifications. The teams say trust also depends on the formal models and other supporting components.
Why could the work find bugs fuzzers missed?
Fuzzers test selected inputs, while a successful proof addresses every input covered by its specification. The teams reported defects involving unusually large or structured inputs and particular sequences of calls.
Do the results apply to common x86 and ARM software builds?
Not directly, based on the reported scope. The proofs covered single-threaded static RISC-V binaries linked against musl, not the x86 or ARM builds with glibc that many users run.
Source: ThorstenMeyerAI.com
