🔍 Read the full analysis: How Anthropic Connects Claude’s Fuzz Tests With Formal Proofs on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic and Theorem report that Claude produced Rocq-checked proofs of a no-crash property for 239 fuzz-test entry points across 123 open-source libraries, using compiled RISC-V binaries. The effort also found bugs missed by years of fuzzing, but the proofs apply only to specific binaries and assumptions, not to all versions or builds of the libraries.
Anthropic’s Frontier Red Team and formal-verification collaborator Theorem said on October 22 that Claude had proved a specified no-crash property for 239 fuzz-test entry points across 123 open-source libraries. The proofs were checked by the Rocq proof assistant against compiled RISC-V programs, and the team said the work also uncovered bugs that existing fuzzing had not reached.
The property proved is bounded and specific: under the project’s stated assumptions, each tested program does not crash on any input smaller than 64 megabytes. The proof rules out AddressSanitizer-detected memory errors and failed assertions at the selected entry point. It does not establish that the entire library is correct or free of every kind of defect.
The process began with existing fuzz tests rather than a newly written description of what each library should do. The libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer. Theorem’s formal models of RISC-V instructions and Linux processes supplied a machine-level specification; Claude generated proofs in Rocq, whose checker verified them. When a proof attempt exposed a possible defect, the team could patch the code, regenerate the specification and try again.
Anthropic reports that the project ran for a few weeks and produced about 180 million lines of Rocq proof. The company says it did not require people to inspect that entire output: confidence rests on the theorem statements, the formal models and the proof checker, along with other trusted components. Anthropic said it is publishing proofs that needed no patch, some previously unavailable trusted components, and specifications for fuzz tests the system could not prove.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Proofs Reach Beyond Fuzzer Coverage
Fuzzers test a program by feeding it many generated or mutated inputs, but a finite run cannot cover every possible input or execution path. A formal proof, if its model and assumptions match the program in question, can establish a property across the full specified input range. That difference helps explain why the team says its effort found defects missed by existing testing.
Anthropic described bugs involving unusual input sizes or sequences of operations, including an out-of-bounds write triggered by a rare layout in an input of roughly 20 megabytes and a read requiring a 64-megabyte input and more than 2 gigabytes of memory. It also reported rediscovering CVE-2026-56132 in libexpat and finding a logic flaw in a file-loading restriction that did not necessarily cause a crash. These examples suggest that proof attempts can expose issues beyond straightforward memory-safety crashes.
The broader implication is a possible change in the cost of checking software: language models can generate formal proof attempts, while a small checker validates whether a submitted proof follows from a formal specification. That could make some verification work less dependent on manual review. But Anthropic’s report does not show that the approach is already economical or broadly applicable: the source says some proofs consume hundreds of millions of tokens, making cost and scale significant constraints.
As an affiliate, we earn on qualifying purchases.
Existing Fuzz Tests Become Specifications
Fuzz testing is widely used to find crashes by exercising software with large numbers of inputs. The source report says the team took advantage of fuzz tests already used in OSS-Fuzz: each test provides a defined entry point and behavior that can be represented as a property to prove. This avoids having to formalize every aspect of a library’s intended behavior, but it also limits what a proof says to the selected test and its modeled execution.
Formal verification has historically required substantial specialist effort. Anthropic points to the seL4 microkernel as an example, citing two person-years to build and 20 person-years to verify. The company frames AI-generated proof work as a way to reduce that barrier. The current project is a research result, however, and its reported proof volume and narrow runtime configuration matter when judging how far that claim extends.
The work targets single-threaded, static RISC-V binaries linked against musl. Most users encounter other combinations, including x86 or ARM processors and builds linked against glibc. A proof for the tested binary does not automatically transfer to those builds, to later source revisions, or to behavior outside the stated input and environment assumptions.
“The team said the process “discovered hundreds of bugs.””
— Anthropic and Theorem, as described in the report
As an affiliate, we earn on qualifying purchases.
What the Proofs Do Not Cover
The reported result is not a general guarantee that the 123 libraries are bug-free. It covers selected fuzz-test entry points, a specified no-crash property, inputs under 64 megabytes, and a particular compiled environment. It does not establish that every behavior of the source code is correct, or that other architectures, operating systems, compiler configurations or library versions share the same result.
The source also leaves open how much the workflow costs across the full set of tests. It says proof generation can consume hundreds of millions of tokens, while newer models and reuse of shared proofs may reduce that burden. The report does not provide a complete per-library cost breakdown or establish how readily the method can be applied to a substantially larger, changing software ecosystem.
Some defects may not trigger a crash, and a no-crash theorem alone cannot prove that all intended security policies are enforced. The report’s file-restriction example illustrates that distinction. The project’s proof materials and specifications may allow outside researchers to examine the claims, but broader independent evaluation and practical replication are not described in the supplied account.
As an affiliate, we earn on qualifying purchases.
Published Proofs Invite Scrutiny
Anthropic said it is releasing the proofs that required no code patch, formal components that were not already public, and specifications for tests it could not prove. Those materials give other researchers a way to inspect the theorem statements, assumptions and verification artifacts rather than relying only on the reported totals.
The next questions are whether the approach can be reproduced on other software, whether proofs can be generated at lower cost, and whether the verified properties can be extended to more common processor and operating-system configurations. Until those questions are answered, the result is best understood as a large-scale demonstration on a defined set of binaries—not a blanket assurance about the libraries people use.
fuzz testing tools for open-source libraries
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
It generated Rocq proofs for a no-crash property at 239 fuzz-test entry points in 123 libraries. Under the stated model and assumptions, the compiled programs do not trigger an AddressSanitizer memory error or failed assertion for inputs under 64 megabytes.
Does this mean the libraries are bug-free?
No. The proofs cover specific entry points, properties, binaries and assumptions. They do not establish that every library behavior is correct or that all bugs have been found.
How were the proofs checked?
Claude generated proofs in Rocq, and Rocq’s proof checker checked them against formal specifications based on the compiled RISC-V programs and models of the machine and Linux processes.
Why did the project find bugs that fuzzing missed?
Fuzzers test a finite set of inputs and execution paths. A proof attempt must account for every path covered by its specification, which can expose unusual inputs or sequences that a fuzzer has not reached.
Do the results apply to software on ordinary computers?
Not automatically. The reported proofs concern single-threaded, static RISC-V binaries linked against musl. The report says they do not directly establish the same properties for common x86 or ARM builds linked against glibc.
Source: ThorstenMeyerAI.com
Evergreen bestsellers Picks
bestsellers
As an affiliate, we earn on qualifying purchases.
