🔍 Read the full analysis: Fuzz Testing Meets Formal Verification In Anthropic’s Claude Work on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Anthropic’s Frontier Red Team and collaborator Theorem report that Claude produced Rocq proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs establish a specific no-crash property for compiled RISC-V programs under stated conditions; they do not show that the libraries are bug-free or that commonly used builds are covered.
Anthropic’s Frontier Red Team and collaborator Theorem report that Claude proved a no-crash property for 239 fuzz-test entry points across 123 open-source libraries, using proofs checked by the Rocq system. The work also found hundreds of bugs, according to Anthropic, including cases its source says fuzz testing had not reached; the results are limited to particular compiled programs and assumptions, not a general guarantee that the libraries are secure.
The team used each library’s existing fuzz test as a specification. In a fuzz test, software is given varied inputs and a crash is treated as evidence of a bug. The researchers instead asked whether the compiled program could be shown to avoid crashing for every input smaller than 64 MB at the tested entry point. Anthropic says that, for the cases proved, the property rules out crashes caused by AddressSanitizer-detected memory errors or failed assertions under the model’s assumptions.
According to Anthropic’s account, the libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer. Theorem supplied formal models of RISC-V instructions and Linux processes and generated specifications from the tests. Claude wrote proofs in Rocq, a proof assistant whose checker verifies whether a proof follows from its specification. If an attempted proof failed, that could point to a possible bug; the code could then be patched, with a new specification and proof generated.
Anthropic says the project ran for several weeks and produced about 180 million lines of Rocq proof. A typical proof was about 600,000 lines, and the median binary contained 18,000 RISC-V instructions. The company says it is publishing proofs that did not require patching, certain supporting components, and specifications for fuzz tests that it could not prove. It characterizes the work, to its knowledge, as the first large-scale AI application of formal verification to production software at assembly-code level.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What the Proofs Can Establish
The reported result offers a way to extend ordinary testing: fuzzers sample inputs and paths, while a successful proof can cover all inputs in the stated range for a particular modeled program and entry point. That distinction matters for bugs that require unusual input sizes or a rare sequence of operations. Anthropic says the effort found hundreds of bugs, including an out-of-bounds write requiring an input around 20 MB with a specific layout, and an image-decoder issue requiring a 64 MB input and more than 2 GB of memory.
The approach could make formal verification more practical if the cost falls. Traditional verification can demand substantial specialist effort; Anthropic cites the seL4 microkernel project as taking two person-years to build and 20 person-years to verify. In this project, the proof checker, rather than a person reading millions of proof lines, checks whether the submitted proof supports the stated claim. That may help teams examine software properties at a scale that would otherwise be difficult, but the reported token costs remain a constraint.
The finding should not be read as proof that the libraries contain no bugs. The property is tied to a defined test, a compiled binary, an input-size bound and formal models. It also concerns crashes and related assertions, not every possible security flaw or incorrect result. One example in Anthropic’s account is a logic error in a file-loading restriction that did not necessarily crash. The work shows a potential route to stronger guarantees about specific behaviors, not a substitute for broader security review.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq Proofs
Fuzzing is widely used to test software by feeding it random or mutated inputs, often guided by which code paths have been exercised. It can uncover crashes efficiently, but a fuzzer’s failure to find a crash does not establish that none exists. Formal verification takes a different approach: a program is checked against a precise specification. Writing that specification is often difficult, so this project reused existing fuzz tests to define the behavior to be proved.
The scope described by Anthropic is narrower than the software people commonly run. The proofs cover single-threaded, static RISC-V binaries linked against musl. They do not directly cover x86 or ARM builds linked against glibc, which are common in deployed systems. The proof also depends on the correctness of the formal models and theorem statements, as well as Rocq’s checker and supporting components. Anthropic says the trust base includes hardware, the operating system and the OCaml compiler used by Rocq.
The source describes examples where proof attempts exposed issues beyond typical fuzzing patterns: deeply nested input, large files, and a particular sequence of calls using two handles to the same file. It also says the process rediscovered CVE-2026-56132 in libexpat. These examples illustrate the kinds of cases the method may surface; they do not establish that every bug was found or that all affected code has been fixed.
“for every input under 64 MB, this test does not crash”
— Anthropic, describing the project’s scope
Limits of the Verified Builds
The published account does not establish whether all identified bugs have been fixed, independently reproduced or assigned vulnerability identifiers. It also does not specify the full distribution of proof costs, including how many cases required patching or failed to reach a proof. Anthropic says proofs can consume hundreds of millions of tokens, while newer models and shared proofs may reduce the amount needed.
Most importantly, the result does not transfer automatically to other architectures, compilers, libraries or runtime environments. The proofs cover static, single-threaded RISC-V binaries linked against musl, not the x86 and ARM builds with glibc commonly used in practice. The work’s conclusions also rely on its formal models and trusted software components. The available source does not provide independent evaluations of those assumptions or a full account of the security significance of each reported bug.
Publication and Practical Validation
Anthropic says it is releasing proofs for cases that did not require patches, non-public trusted components, and specifications for tests it could not prove. Those materials may let outside researchers inspect the claims and understand where proof attempts succeeded or stopped. The account does not give a timetable for further releases or say whether additional libraries and architectures will be included.
For developers, the next questions are whether the reported bugs are fixed, whether the proofs can be reproduced, and how much the method costs when applied to different codebases. Wider use would also depend on extending coverage beyond the specific RISC-V and musl setup and on confirming that the formal models match the systems being deployed. Until then, the results are evidence that AI-assisted proofs can cover selected software properties at scale, with important limits still in place.
Key Questions
What did Claude prove?
Anthropic says Claude produced Rocq proofs that 239 fuzz-test entry points in 123 libraries do not crash on inputs under 64 MB, under the project’s stated assumptions and for the modeled compiled programs.
Does this mean the libraries are bug-free?
No. The proofs address a defined no-crash property, not every possible security flaw or incorrect behavior. The reported scope also excludes other builds and platforms, and the source describes a logic bug that did not necessarily cause a crash.
How did the team check Claude’s proofs?
Claude wrote proofs in Rocq, and Rocq’s proof checker checked them against specifications generated from existing fuzz tests and formal models of the program environment.
What kinds of bugs did the project find?
Anthropic reports hundreds of bugs, including memory-safety problems that required large or unusual inputs and particular call sequences. Its account also names a rediscovery of CVE-2026-56132 in libexpat and a file-loading logic issue.
Can these results be applied to common x86 or ARM software builds?
Not directly based on the reported work. The proofs cover single-threaded static RISC-V binaries linked against musl; Anthropic says they do not cover common x86 or ARM builds linked against glibc.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
