🔍 Read the full analysis: From Fuzz Test To Formal Proof: Understanding Claude’s Role on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Anthropic’s Frontier Red Team and Theorem say Claude proved a no-crash property for 239 fuzz-test entry points across 123 open-source libraries, checking compiled RISC-V programs with the Rocq proof system. The work also found bugs that fuzzing had missed, but the proofs apply only to specific builds and assumptions—not to every version or configuration of those libraries.
Anthropic’s Frontier Red Team and Theorem reported October 22 that Claude helped prove a defined no-crash property for 239 fuzz-test entry points across 123 open-source libraries, checking the compiled programs at the machine-code level. The work also surfaced bugs that fuzzing had not found, but the result is limited to specific RISC-V builds and stated assumptions; it does not establish that the libraries are bug-free across the systems people commonly use.
The team used existing fuzz tests as specifications rather than trying to define software correctness from scratch. Each test was compiled with its library into an instrumented RISC-V executable. The property under review was that, for any input under 64 megabytes, the test would not crash because of an AddressSanitizer memory error or a failed assertion, subject to the model’s assumptions.
Claude generated proofs in Rocq, a formal proof system. Rocq’s checker then verified whether the proofs followed from the specified property and formal models. When a proof attempt exposed a possible defect, Claude could patch the code, regenerate the specification and attempt another proof. The reported proofs total about 180 million lines; Anthropic said they were produced over a period of weeks.
Anthropic said the process found hundreds of bugs, including cases involving large or unusually structured inputs, sequences of calls across file handles, and deeply nested data. One reported example was a decompressor counter underflow that could lead to an out-of-bounds write on an input of around 20 megabytes with a particular layout. The report also describes a file-loading restriction that was not always enforced, a logic issue that did not necessarily cause a crash.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Add
Fuzzing tests software by running many inputs and watching for failures. It can be effective, but a successful run does not show that every possible path was tested. A formal proof can address all executions within its model, making it possible to establish a specific property for inputs that a fuzzer is unlikely to generate.
The reported work matters because it suggests AI may help reduce the labor involved in producing formal proofs. Anthropic has described verification as costly: it cites the seL4 microkernel project as requiring two person-years to build and 20 person-years to verify. If models can generate proof scripts at scale and a checker can validate them mechanically, more software teams may be able to examine properties that previously demanded extensive specialist effort.
That does not make proof generation equivalent to proof of overall correctness. The result depends on the exact specification, the accuracy of the formal models, and the build being checked. A proven absence of certain crashes is useful evidence about that artifact; it is not a blanket security certification for a library or its other deployments.
formal verification software tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq
The project draws on libraries in OSS-Fuzz, Google’s open-source fuzzing program, and Theorem’s formal models of RISC-V instructions and Linux processes. Rather than ask developers to write a full formal specification for each library, the researchers treated an existing fuzz-test entry point as the behavior to analyze: the test should not encounter the specified crash conditions for inputs within the stated size limit.
This approach also means the proof covers what the test checks, not every property a user might care about. Some fuzz tests encode higher-level assertions. The report gives a compression example in which a test checks that decompressing compressed data returns the original; proving the test cannot fail can establish that round-trip property for the modeled executions. In other cases, proof work exposed additional conditions that needed to be ruled out, such as a possible stack overflow during destruction of a data structure.
Anthropic described the effort as, to its knowledge, the first large-scale use of AI for formal verification of production software at assembly-code level. It said it is publishing proofs that required no patch, previously unavailable trusted components, and specifications for tests it could not prove.
“To our knowledge, this is the first large-scale use of AI to apply formal verification to production software at the assembly code level.”
— Anthropic, describing the scope of the project
As an affiliate, we earn on qualifying purchases.
Where the Proofs Stop
The proofs apply to single-threaded, statically compiled RISC-V binaries linked against musl, according to the source report. Most users encounter different builds, including x86 or ARM systems and glibc-based environments. The reported results do not automatically transfer to those builds, to later versions, or to code paths outside the selected fuzz-test entry points.
The property is also conditional on the formal models and theorem statements being right. Anthropic identifies the RISC-V and Linux process models, the exact specifications, and Rocq’s checker among the components that must be trusted; hardware, the operating system and the OCaml compiler used by Rocq are also part of the trust basis. The report does not establish that every vulnerability was found, nor that every proof attempt completed. It says some specifications were published for tests the system could not prove.
The source material does not give a complete accounting of the total compute expense or a per-library cost. It says individual proofs can require hundreds of millions of tokens and that newer models and reuse of shared proofs can reduce the burden. How much the method costs in routine practice remains unresolved.
AddressSanitizer memory error detector
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Publication and Practical Adoption
Anthropic says it is releasing selected unpatched proofs, components needed to inspect the trusted computing base that were not already public, and specifications for fuzz tests it could not prove. Those materials can let other researchers examine the claims, reproduce parts of the process and assess where proof attempts fall short.
The next test is whether the method can be made less expensive and extended to the architectures and configurations used in deployed software. The report points to improved models and shared proofs as ways to reduce token use, but it does not announce a deployment timetable or a completed expansion beyond the stated RISC-V and musl setup. For now, the results show what Claude-assisted proof generation achieved on a defined set of programs—and leave broader coverage and operational cost open.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
Claude generated Rocq proofs for a specified no-crash property covering 239 fuzz-test entry points in 123 libraries. The property concerns the modeled program and inputs under 64 megabytes, including the specified AddressSanitizer errors and failed assertions.
Does this mean the libraries are bug-free?
No. The proofs cover particular entry points, builds, properties and assumptions. They do not establish that every library version, architecture, configuration or behavior is free of defects.
How did the process find bugs fuzzing missed?
Fuzzers sample inputs and execution paths. A proof attempt must account for all executions reachable under its model, so it can expose conditions requiring rare input sizes, layouts or call sequences that a fuzzer did not reach.
What systems did the reported proofs cover?
The reported work covers single-threaded, statically compiled RISC-V binaries linked against musl. The results do not automatically apply to common x86 or ARM builds linked against glibc.
What happens after the report?
Anthropic says it is publishing selected proofs, trusted components and specifications for tests it could not prove. Further work would need to address proof costs and extend coverage to other build configurations; the report gives no timetable for that expansion.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
