🔍 Read the full analysis: Anthropic’s Claude Work Connects Fuzz Tests With Formal Proofs on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Anthropic’s Frontier Red Team and collaborator Theorem say Claude produced machine-checked proofs that 239 fuzz-test entry points in 123 open-source libraries do not crash for inputs under 64 MB, under specified assumptions. The effort also found hundreds of bugs, but the proofs cover particular compiled RISC-V builds, not all versions or platforms, and can require hundreds of millions of tokens.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that Claude produced machine-checked security proofs for 239 fuzz-test entry points across 123 open-source libraries. The proofs cover specific compiled RISC-V programs and show, under stated assumptions, that the tested entry points do not crash on inputs under 64 megabytes—a result the teams say also exposed hundreds of bugs missed by prior fuzzing.
The project starts with existing fuzz tests rather than asking researchers to define software correctness from scratch. Each test is treated as a specification: for every input within the stated size limit, the program must not trigger a crash. The libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer, which makes certain memory errors cause a failure.
According to the project description, Claude generated proofs in Rocq, a proof assistant whose checker verifies whether a proposed proof follows from its formal specification. Theorem supplied formal models of RISC-V instructions and Linux processes. When an attempted proof failed, that could point to a possible defect; Claude could then patch code, regenerate the specification and attempt a new proof.
The reported scale was about 180 million lines of Rocq proof, produced over a few weeks. Anthropic says a typical proof was about 600,000 lines and covered a binary with a median size of 18,000 RISC-V instructions. The teams report that the process found hundreds of bugs, including cases involving unusually large or structured inputs and sequences of calls that ordinary fuzzing might not reach.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Why Machine-Code Proofs Matter
Fuzzing tests many inputs and can find faults when those inputs reach a vulnerable code path. It cannot, by itself, establish that every possible input has been tested. A formal proof can make a stronger statement for a precisely defined program and property: in this case, that the specified entry point does not crash for inputs under the chosen limit, assuming the model and other stated conditions are accurate.
The approach matters because it could extend formal verification beyond projects with unusually large budgets. Anthropic cites the seL4 microkernel as an example of the effort involved in traditional verification, reporting that its construction took two person-years and its verification took 20. If AI can generate proofs that a compact checker can validate, some of the work may become less dependent on humans writing and reviewing every proof step.
That does not make the software bug-free. A no-crash result is bounded by the specification, binary, input limit and execution model. It also does not automatically prove that a program behaves as users expect. Still, the findings suggest a possible complement to fuzzing: use testing to find problems, and proof attempts to establish whether a defined class of failure is absent from a particular build.
software test automation platforms
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Existing Tests to Formal Claims
Formal verification requires a precise statement of what a program must do. For a large general-purpose application, defining all intended behavior can be difficult. The reported method narrows the task by reusing fuzz tests developers already maintain. These tests provide small entry points into libraries and define failure through crashes or assertions.
In the pipeline described by Anthropic and Theorem, AddressSanitizer makes certain memory errors observable as crashes, while formal models describe how the compiled program executes. Claude then attempts to prove that the instrumented program cannot fail the test for any input within the specified bound. The check is not based on reviewers reading every generated line: the teams say trust instead rests on the specification, formal models and Rocq’s proof checker, along with related components such as the hardware and software toolchain.
The report says some discovered issues involved inputs much larger or more unusual than those commonly used by fuzzers, while others depended on a particular call sequence or deeply nested data. It also describes a logic flaw that did not cause a crash: a file-loading restriction was not always enforced. That example illustrates a boundary of the headline no-crash property. A proof can establish only what its specification says; a security or logic requirement must be encoded for the proof to cover it.
“The process “discovered hundreds of bugs.””
— Anthropic and Theorem, as described in the project report
As an affiliate, we earn on qualifying purchases.
Limits of the Verified Builds
The results apply to single-threaded, static RISC-V binaries linked against musl, according to the supplied report. They do not establish the same properties for the x86 or ARM builds, or for commonly deployed glibc configurations. It is also unclear from the material how many of the reported bugs were independently reproduced, assigned identifiers or fixed in released versions.
The proof claim is limited to the modeled execution conditions and the test’s stated property. The 64 MB input bound does not establish behavior for larger inputs, and a no-crash proof does not rule out every security flaw or incorrect result. The report also notes that some proof attempts can be extremely expensive. Anthropic says it is publishing proofs that did not require patches, certain previously unpublished trusted components and specifications for tests it could not prove; the supplied material does not specify the complete release contents or a schedule.
As an affiliate, we earn on qualifying purchases.
Publication and Broader Coverage
Anthropic says it is publishing the proofs that required no code patch, trusted components not already public, and specifications for fuzz tests that its system could not prove. Those materials would let other researchers inspect the formal statements and checker inputs, though the report does not provide a timetable or a full account of independent review.
The next tests for the approach are practical: whether the proofs can be reproduced, whether fixes for discovered bugs reach affected libraries, and whether the method can be adapted to other architectures and software configurations. The project report also identifies token use as a constraint and says newer models and shared proofs can lower the cost. No broader platform coverage or cost reduction is confirmed in the supplied material.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
For 239 fuzz-test entry points in 123 libraries, the project reports proofs that the specified compiled programs do not crash on inputs under 64 MB, subject to the formal model and other stated assumptions. The claim is not that the libraries are free of all bugs.
What role did the Rocq checker play?
Claude generated proofs in Rocq, and Rocq’s checker mechanically checked whether they followed from the formal specifications. The reported method relies on the checker and formal models rather than human review of all 180 million proof lines.
Did the project find security bugs?
Anthropic and Theorem say the effort found hundreds of bugs, including issues that depended on large or unusual inputs. The supplied account does not provide a full independently verified tally or confirm the status of every fix.
Does this prove the libraries are safe on common computers?
No. The reported proofs cover single-threaded, static RISC-V builds linked against musl. They do not automatically apply to x86 or ARM binaries, glibc builds, other configurations, inputs over the limit or properties not included in the specifications.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
