Read the full analysis: What Claude’s Verification Results Mean For Fuzz Testing on ThorstenMeyerAI.com
TL;DR
Anthropic’s Frontier Red Team and Theorem say Claude produced Rocq-checked proofs that 239 fuzz-test entry points in 123 open-source libraries do not crash on inputs under 64 MB in a specified RISC-V environment. Their work also uncovered bugs reported to have escaped years of fuzzing, but the proofs do not establish that the libraries are bug-free or safe across common production builds.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that Claude produced machine-checked proofs for 239 fuzz-test entry points in 123 open-source libraries. The proofs establish a specific property: under stated assumptions, the compiled programs do not crash for inputs smaller than 64 MB in a modelled RISC-V environment. The team also said its proof attempts found bugs that fuzzing had not reached, offering a potential way to strengthen testing while leaving important limits on what the results establish.
The researchers treated each library’s existing fuzz test as a specification. They compiled the library and test into an instrumented RISC-V executable, then used formal models of RISC-V instructions and Linux processes to generate a statement about whether the program could crash. Claude wrote proofs in Rocq, whose proof checker tested whether each proof followed from the specification. When a proof attempt exposed a possible failure, Claude could patch the code and try to prove the revised version.
The reported scale was substantial: the proofs amount to about 180 million lines of Rocq, produced over a few weeks. Anthropic says a typical proof was about 600,000 lines, covering a binary with a median length of 18,000 RISC-V instructions. The company described the work as, to its knowledge, the first large-scale use of AI to formally verify production software at assembly-code level. That characterization is Anthropic’s; the reported totals do not by themselves establish how the approach compares with other verification efforts.
Anthropic said the process found hundreds of bugs, including memory errors associated with unusual inputs and call sequences. Examples in its account include an out-of-bounds write requiring an input of around 20 MB with a rare layout, and an image-decoder read requiring a 64 MB input and more than 2 GB of memory. It also reported rediscovering CVE-2026-56132 in libexpat and finding a file-access logic flaw that did not necessarily cause a crash. These are examples reported by the researchers, not evidence that every bug class or pathway was covered.
Anthropic × Theorem · Oct 2026
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
A Proof Layer Beyond Fuzzing
The result matters because fuzzing and formal verification answer different questions. A fuzzer tests many generated inputs and can reveal crashes, but it cannot generally prove that every possible input or reachable path has been checked. A verified theorem can cover all inputs within its defined bounds and assumptions. For the entry points and binaries in this project, a successful proof means the specified crash conditions cannot be reached under that model—not that the software has no defects.
That distinction may be useful for security teams deciding where to spend testing effort. The reported bugs include cases involving large or specially structured inputs that ordinary fuzzing may be unlikely to exercise. If AI can reduce the labor needed to build proofs, developers could gain an additional check for selected components. But the proof process itself is costly: Anthropic says some attempts used hundreds of millions of tokens. Lower costs in newer models and reuse of proofs may help, but the work does not yet show that broad verification is inexpensive or routine.
There is also a practical deployment gap. The reported proofs cover single-threaded, static RISC-V binaries linked against musl, not the x86 or ARM builds linked against glibc that many users run. The findings therefore demonstrate a method on a defined system, rather than directly certifying the software configurations most commonly deployed.
From Existing Tests to Theorems
Formal verification uses mathematical statements and machine-checked proofs to show that software satisfies specified properties. Its application has often been limited by the effort required to define those properties and construct proofs. Anthropic’s approach narrows that challenge by taking a property already encoded in a fuzz test: the test treats a crash or failed assertion as a failure, and the researchers ask whether the compiled program can ever trigger one within the model’s input bounds.
The team’s account says this approach can cover properties beyond basic memory safety when a test checks them by failing. For example, a compression test that asserts a decompressed result matches the original can make that round-trip condition part of the verification target. Still, the scope is set by the test and its formal specification: behavior not represented there is not automatically proved.
The proof checker is central to the trust model. Anthropic says people do not need to inspect the full 180 million lines manually; they rely instead on the specification, formal models and Rocq’s checker, along with supporting components such as the hardware and operating system. The researchers said they are publishing proofs that required no patch, previously unavailable trusted components, and specifications for fuzz tests they could not prove.
“The work is, “to our knowledge,” the first large-scale use of AI to apply formal verification to production software at the assembly-code level.”
— Anthropic
Where the Proofs Stop
The results are limited to the specified entry points, input bound and execution model. The supplied account does not establish that equivalent proofs hold for the libraries’ x86 or ARM versions, builds using glibc, multithreaded behavior, or every way the libraries are used in applications. Nor does a no-crash result rule out logic flaws that the test does not detect, incorrect outputs that do not trigger an assertion, or vulnerabilities outside the specification.
Other open questions include how many reported bugs were independently reproduced, fixed or assigned vulnerability identifiers, and how the total effort and token cost varied across the 239 proofs. Anthropic says attempts can consume hundreds of millions of tokens, but the source material gives no per-proof cost or comparison with human verification. It also says some proof attempts did not finish; the scope and outcomes of those attempts are not detailed here.
Publication and Wider Testing
Anthropic says it is publishing the proofs that did not require code changes, trusted components that were not already public, and specifications for fuzz tests it could not prove. Those materials should allow researchers and maintainers to inspect the formal statements and evaluate how closely they match the intended software behavior.
The next meaningful test is whether the method can be repeated on other libraries and adapted to the architectures and build configurations used in production. Maintainers will also need to review and address reported bugs, while independent researchers can check the proofs, assumptions and models. The account does not set a timetable for that work or say when broader platform coverage will be available.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude produced Rocq-checked proofs that 239 fuzz-test entry points in 123 open-source libraries do not crash on inputs under 64 MB, within a specified RISC-V model and under stated assumptions.
Does this mean the libraries are bug-free?
No. The proofs address properties expressed by the tests and formal specifications. They do not show that every behavior is correct or that the software has no vulnerabilities.
How did the project find bugs fuzzing missed?
A fuzzer samples inputs and execution paths, while a successful proof must account for every path covered by its formal model. The researchers said some discovered bugs required unusually large inputs or specific call sequences.
Do the results cover software people commonly run?
Not directly across all common builds. The reported proofs cover single-threaded, static RISC-V binaries linked against musl; the source says they do not establish the same results for typical x86 or ARM builds linked against glibc.
What remains to be checked?
Researchers and maintainers can inspect the published proofs and assumptions, reproduce reported bugs, and test whether the approach extends to other libraries and production configurations. The source does not give a schedule for that work.
Source: ThorstenMeyerAI.com