LLMs are making formal software verification feasible at a much larger scale
Claude produced machine-checked no-crash proofs for 123 real open-source libraries at the compiled RISC-V level, not just source…
Anthropic, with formal-verification startup Theorem, used Claude to generate and have machine-checked over 180 million lines of Rocq proof code showing 239 fuzz-test entry points across 123 open-source OSS-Fuzz libraries never crash under memory-safety or assertion checks for inputs under 64MB, under stated assumptions about the execution environment. While building these proofs Claude also found and patched previously undetected bugs. Anthropic is releasing a subset of proofs and semantics, and Theorem will run the pipeline for other projects and is publishing a Claude skill for developers.
Why it matters
Formal verification has historically been reserved for a handful of mission-critical systems because it required years of specialized expert effort (e.g., 20 person-years to verify the seL4 kernel). This work demonstrates that an LLM can autonomously produce and have machine-checked large-scale formal proofs against real compiled binaries, potentially making provable absence of certain bug classes tractable for ordinary open-source software rather than only elite safety-critical projects.
What is verified
Anthropic, in collaboration with Theorem, used Claude to produce formal proofs that 239 fuzz-test entry points across 123 open-source OSS-Fuzz libraries never crash (memory-safety errors or failed assertions) for inputs under 64 MB, assuming single-threaded static RISC-V binaries on Linux with a fixed memory budget. [1]
The proofs operate on compiled RISC-V assembly rather than source code, comprise about 180 million lines of Rocq proof code in total, with a typical proof around 600,000 lines for binaries with a median length of 18,000 RISC-V instructions. [1]
While writing the proofs, Claude discovered bugs in the libraries that had not been found despite trillions of fuzz test runs, and patched them before completing the no-crash proofs. [1]
Anthropic states this is, to their knowledge, the first large-scale effort to apply AI-driven formal verification to production software at the assembly code level, and notes manually verifying the seL4 kernel previously took 20 person-years versus 2 person-years to implement it. [1]
Anthropic is publishing a subset of the proofs along with RISC-V and OS semantics for reuse, and Theorem is offering to run the same pipeline on other open-source projects and publishing a Claude skill for developers to verify their own code. [1]
What is not
- No independent replication or third-party audit of the proofs is provided in this evidence beyond Anthropic's own account.
- The proofs assume a narrow execution model (single-threaded static binary, fixed memory budget, RISC-V, specific Linux semantics) that may not generalize to typical multi-threaded, dynamically linked production software.
- No cost, time-per-proof, or compute figures are given, so the practical cost reduction versus traditional formal verification is not quantified.
- It is unclear how many of the 123 libraries are widely used in production versus chosen for tractability, and whether the found bugs were previously known or exploitable.
Sources
- 1Anthropic Newsanthropic.com · Primary source
Original source published 22 October 2026 at 02:00.
An AI-assisted briefing by Coding Partners. We link the evidence behind the reporting so you can explore the original work and assess the claims. How CP Signal works.