🔍 Read the full analysis: Anthropic Turned Fuzz Tests Into Proofs: What Claude’s Formal Verification Shows on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and collaborator Theorem report that Claude produced Rocq-checked proofs for 239 fuzz-test entry points in 123 open-source libraries. The proofs establish a specific no-crash property for compiled RISC-V binaries under stated conditions; they do not show that the libraries are bug-free or prove safety for the common x86 and ARM builds. The effort also found hundreds of bugs, according to Anthropic, while exposing the high computational cost of producing proofs.
Anthropic’s Frontier Red Team and its collaborator Theorem said on October 22 that Claude produced formal proofs for 239 fuzz-test entry points in 123 open-source libraries. Checked by the Rocq proof checker, the proofs establish that the tested compiled programs do not crash on inputs smaller than 64 megabytes under specified conditions—a narrow security result, not proof that the libraries are free of bugs.
The team used existing fuzz tests as specifications rather than trying to define what each library should do in every possible situation. In the reported setup, each library and test was compiled into a RISC-V executable and instrumented with AddressSanitizer. The property to prove was that running a test with any input under 64 MB would not crash, trigger an AddressSanitizer memory error or fail an assertion. The result applies to the modeled program and its stated assumptions.
According to Anthropic’s account, Claude generated proofs written in Rocq, a formal proof language, and Rocq’s checker verified them against the specifications. When an attempted proof failed, the failure could point to a possible bug; Claude could patch the code, regenerate the specification and attempt a new proof. The reported output totaled about 180 million lines of proof. A typical proof ran to roughly 600,000 lines and covered a binary with a median length of 18,000 RISC-V instructions.
Anthropic said the process found hundreds of bugs, including issues it said fuzzers were unlikely to encounter. Its examples include a decompressor bug requiring an input around 20 MB with a rare layout, and an image-decoder read error that required a 64 MB input and more than 2 GB of memory. The source account also describes a bug dependent on a sequence of calls across two handles, a rediscovery of CVE-2026-56132 in libexpat, and a file-loading restriction that was not always enforced. These are examples reported by the team, not an independent audit of the full results.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What the Proofs Can Establish
The result offers a way to test software beyond the finite set of inputs that conventional fuzzing can try. Fuzzers generate and mutate inputs, then report failures they reach. A successful formal proof, by contrast, can establish a property across every input covered by its specification and model. That distinction can matter for bugs requiring unusually large inputs, rare layouts or specific sequences of operations.
The practical reach remains limited. The proofs cover single-threaded, static RISC-V binaries linked against musl, rather than the x86 or ARM builds linked against glibc that most users typically run. Nor does a no-crash result rule out all security problems: it does not prove that a program behaves as intended in every respect, or that the specification captures every property developers care about. The work is a demonstration of a verification method, not a general safety certification.
Cost is another constraint. Anthropic says some proofs required hundreds of millions of tokens, making computation a bottleneck even when the checker can verify the final proof mechanically. The team says newer models and sharing proofs can reduce the work, but the report does not establish that the method is yet economical for routine use across large software projects.
formal verification software tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq Proofs
Fuzzing is widely used to find crashes by feeding programs many random or mutated inputs. It can be effective at discovering defects, but testing a large sample cannot establish that every possible path has been covered. Anthropic and Theorem’s approach starts with the fuzz tests already written for projects in OSS-Fuzz and asks whether the corresponding compiled program can ever fail those tests within the specified input range.
The team used formal models of RISC-V instructions and Linux processes to turn that question into a machine-checkable statement. Claude generated proofs, while Rocq checked them. The trusted base is much smaller than the generated proof output: Anthropic identifies the models, theorem statements and Rocq checker as key components that must be trusted, along with supporting software and hardware assumptions. The company says it is publishing proofs that did not require patches, previously unpublished trusted components, and specifications for tests it could not prove.
Anthropic frames the work against the difficulty of verifying software by hand. It cites the seL4 microkernel as an example in which verification required far more work than construction, and argues that AI could lower that cost. The new report shows a large automated effort, but does not establish that the approach has replaced human verification or applies to software outside the tested setup.
“For every input under 64 MB, this test does not crash.”
— Anthropic, describing the proof property
fuzz testing tools for open-source libraries
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Limits of the Verified Builds
The report does not show whether the same properties hold for the x86 and ARM versions most commonly deployed, or for builds using glibc. Its conclusions are confined to the modeled single-threaded, static RISC-V programs and their stated assumptions. It is also not clear from the supplied report how the findings translate into risk reduction in real-world deployments.
A proof can only establish what its specification says. The central property here is that a particular fuzz test does not crash for inputs under 64 MB, with specified memory and assertion checks. That leaves other classes of incorrect behavior outside the result. The source material also describes a logic bug involving a file-loading restriction, underscoring that not every meaningful defect is captured by a crash property.
Anthropic’s account gives no independent assessment of the reported bug count, the overall success rate across attempted proofs or the total compute cost for the project. It says some attempted proofs were not completed and that proof generation could consume hundreds of millions of tokens. Those details make it difficult to judge how readily the method can be repeated at lower cost.
As an affiliate, we earn on qualifying purchases.
Publication and Broader Testing
Anthropic says it is releasing the proofs that did not require code patches, the trusted components not already public, and specifications for fuzz tests it could not prove. Those materials should let other researchers inspect the theorem statements, checker inputs and some of the limits of the work.
The next practical test is whether independent researchers can reproduce the results, examine the reported bugs and extend proofs to other architectures and build configurations. The report does not give a schedule for those efforts or say when equivalent proofs might cover commonly deployed x86 and ARM binaries. For now, the demonstrated result is a large set of machine-checked proofs for a particular class of compiled programs, alongside substantial cost and scope limitations.
AddressSanitizer compatible debugging tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
Anthropic and Theorem say Claude generated Rocq proofs that, for 239 fuzz-test entry points, the modeled compiled programs would not crash on inputs under 64 MB or trigger the specified AddressSanitizer errors and failed assertions. The claim applies only under the report’s assumptions and specifications.
Does this show the libraries are bug-free?
No. The proofs establish a defined no-crash property for particular tests and builds. They do not establish that the libraries have no bugs or that every behavior is correct.
Why might formal proofs find bugs that fuzzing missed?
Fuzzers test a finite set of inputs. A proof can cover every input and path represented by its specification and model, including some rare conditions that a fuzzer may not reach. The coverage is still limited to what the proof actually describes.
Do the results apply to software people commonly run?
Not directly, based on the report. The proofs cover single-threaded, static RISC-V binaries linked against musl, not the x86 or ARM builds with glibc that many users run.
What is the main obstacle to wider use?
Cost is a major obstacle. Anthropic says some proof efforts required hundreds of millions of tokens. The report says newer models and shared proofs can reduce the work, but does not establish the cost of applying the method routinely across software projects.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
