🔍 Read the full analysis: Anthropic’s Claude Work Explores The Line Between Tests And Proofs on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and Theorem report that Claude used the Rocq proof checker to verify no-crash properties for 239 entry points across 123 open-source libraries. The work also found bugs missed by prior fuzzing, but the proofs apply to specific compiled RISC-V binaries and do not establish that the libraries are bug-free.
Anthropic’s Frontier Red Team and collaborator Theorem reported October 22 that Claude helped prove a specific no-crash property for 239 fuzz-test entry points in 123 open-source libraries. The proofs were checked by the Rocq proof assistant against compiled RISC-V programs, and the effort also identified bugs the teams said prior fuzzing had missed; it does not establish that the libraries are bug-free.
The team used existing fuzz tests as specifications rather than trying to define software correctness in general. Each test was compiled with its library into an instrumented RISC-V executable. The property to prove was that, for every input below 64 megabytes, the program would not crash because of an AddressSanitizer memory error or a failed assertion, under the system’s stated assumptions.
Claude generated proofs in Rocq, a system whose proof checker mechanically tests whether a proposed proof follows from its specification. According to the report, the work took a few weeks and produced about 180 million lines of proof. A typical proof was about 600,000 lines, covering a binary with a median length of 18,000 RISC-V instructions. The report says much of that proof text did not require human review; confidence depends instead on the models, theorem statements, and checker being correct.
Anthropic and Theorem also said the effort found hundreds of bugs. Examples included memory errors triggered only by large or unusually structured inputs, and a bug requiring a particular sequence of calls using two handles to the same file. The source describes one logic flaw involving a file-loading restriction that was not always enforced, illustrating that not every reported issue was a crash or memory-safety error.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Proofs Reach Beyond Fuzzing
Fuzzers test many inputs, but they cannot ordinarily establish that every possible input has been covered. A checked proof can make a stronger claim—but only about the precise property and system that were modelled. Here, the method aimed to show that a particular test entry point would not crash for any input under the size limit, rather than merely reporting that no crash appeared during a test run.
That distinction matters for software security. Bugs buried behind rare input patterns or long sequences of operations may escape ordinary testing, while a proof attempt must account for reachable paths in its model. The reported examples suggest that AI-assisted proof generation could help expose such cases and could make formal methods more practical for larger projects. The report does not show that this approach replaces testing, nor does it establish how often the method will be affordable or successful across software outside the study.
The cost remains a major qualification. The source says individual proofs can consume hundreds of millions of tokens, although newer models and reuse of shared proofs can reduce the amount required. This is a research result about a particular workflow, not evidence that comprehensive verification is now inexpensive for typical development teams.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq
Fuzz testing feeds software large numbers of random or mutated inputs and records failures such as crashes. It is useful for finding defects, but results depend on which inputs the fuzzer reaches. Anthropic and Theorem took the tests already written for the OSS-Fuzz libraries and treated each as a formal specification for a compiled program.
Their pipeline compiled the code for RISC-V and added AddressSanitizer instrumentation so that certain improper memory accesses would cause a crash. Formal models of RISC-V instructions and Linux processes were then used to express the no-crash property. Claude generated a Rocq proof; when the attempt failed, the failure could point to a possible bug, after which the code could be patched and the specification and proof run again.
The report describes the work as, to the authors’ knowledge, the first large-scale use of AI for formal verification of production software at the assembly-code level. It contrasts the approach with historically expensive verification efforts, including the seL4 microkernel project, which Anthropic cites as taking two person-years to build and 20 person-years to verify. That comparison helps explain the motivation, but it does not show that the new method has the same scope or assurance as a full verification project.
“The process “discovered hundreds of bugs.””
— Anthropic and Theorem, as described in their report
As an affiliate, we earn on qualifying purchases.
What the Proofs Leave Out
The reported guarantees apply to single-threaded, static RISC-V binaries linked against musl, not automatically to the x86 or ARM builds linked against glibc that many users run. The result is also limited to the selected fuzz-test entry points, the stated input-size bound, the assertions and memory errors represented in the specification, and the assumptions built into the formal models.
A no-crash proof does not by itself show that a program returns the intended result for every input, has no security weaknesses, or behaves correctly in every environment. The report gives examples of additional properties that may be captured when a test asserts them, but the exact guarantees vary by test. It also remains unclear from the supplied material how the method would perform across a wider range of codebases, architectures, concurrent software, or projects without suitable fuzz tests.
The authors say they are publishing proofs that did not require patching, trusted components not already public, and specifications for tests they could not prove. The source material does not provide a complete accounting of how many proof attempts failed or were abandoned, or a full cost breakdown for the reported campaign.
As an affiliate, we earn on qualifying purchases.
Published Artifacts and Further Tests
The next step described by Anthropic is access to parts of the project’s verification record: the proofs that required no code patch, selected trusted components, and specifications for fuzz tests that Claude could not prove. Those materials may let other researchers inspect the assumptions and reproduce or extend parts of the work.
Further evaluation will be needed to determine whether the approach can cover more architectures and software configurations, how often proof attempts identify actionable defects, and whether token and engineering costs fall enough for routine use. Until then, the reported results support a narrower conclusion: AI-generated proofs can check defined safety properties for selected compiled programs, while substantial limits remain on what those proofs establish.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude generated Rocq proofs for a no-crash property at 239 fuzz-test entry points in 123 libraries. The property covers inputs under 64 megabytes for the specified compiled program and stated assumptions; it is not a general proof that each library is correct.
Does this mean the libraries are bug-free?
No. The proofs cover specific entry points, properties, and RISC-V configurations. They do not establish that every library behavior is correct or that other builds and environments have no defects.
How did the team check Claude’s proofs?
Claude wrote proofs in Rocq, and Rocq’s proof checker mechanically checked them against the specifications. The assurance also depends on the formal models and theorem statements used for the work.
What kinds of bugs did the work find?
The report cites memory errors triggered by large or unusual inputs, a defect requiring a particular sequence of calls, and a logic flaw involving a file-loading restriction. Anthropic and Theorem say the effort found hundreds of bugs, but the supplied material does not give a complete breakdown.
Does the method apply to software people use on x86 or ARM?
Not automatically. The described proofs cover single-threaded, static RISC-V binaries linked against musl. The report does not establish the same guarantees for x86 or ARM builds linked against glibc.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
