🔍 Read the full analysis: Anthropic’s Fuzz-Test-to-Proof Approach: What It Shows And Leaves Open on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Anthropic and Theorem report that Claude produced machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries, covering compiled RISC-V programs and inputs under 64 MB. The effort also found bugs missed by years of fuzzing, but the proofs apply only to a defined test property and a particular build environment, not to software being bug-free.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that Claude helped prove a defined safety property for 239 fuzz-test entry points across 123 open-source libraries. The machine-checked proofs cover compiled RISC-V programs and show that, under stated assumptions, the programs do not crash on inputs under 64 MB; the team also said the effort found hundreds of bugs, including defects earlier fuzzing had missed.
The work turns an existing fuzz test into a formal specification. Fuzz tests send many inputs to a software entry point and treat a crash as a failure. Instead of relying on a fuzzer to sample inputs, the team asked whether the compiled program could be shown not to crash for every input below the 64 MB limit, under the modeled conditions. The property includes no AddressSanitizer memory error and no failed assertion.
According to the account of the project, the libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer. Claude generated proofs in Rocq, a proof assistant, and the Rocq checker verified them against the specifications. When a proof attempt exposed a possible failure, Claude could patch the code, regenerate the specification and attempt a proof of the revised program.
The scale reported by the teams was substantial: the proofs total about 180 million lines of Rocq, with a typical proof around 600,000 lines. Anthropic said the work took a few weeks. It also reported discovering hundreds of bugs, including memory-safety defects triggered only by large or unusually structured inputs, as well as a logic flaw involving a restriction on which files an application could load. A proof of a test that checks a higher-level property can cover that property too, provided the test expresses it as a failure condition.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Could Change
The report matters because it suggests AI may help extend formal verification—an approach that can establish properties for all executions covered by a model—beyond the small set of projects that can afford extensive specialist effort. Anthropic cites the cost of verifying the seL4 microkernel as an example of the historical barrier: the work took far longer than building the system. If AI can produce proofs that a separate checker validates, more software teams may be able to test this method on bounded, specific properties.
The findings also show why fuzzing and formal proof serve different roles. Fuzzers explore many inputs but cannot establish that every possible path has been tested. The teams said some defects required inputs around 20 MB, a rare data layout, or a sequence of calls across two file handles. One image-decoder issue reportedly needed a 64 MB input and more than 2 GB of memory. Those cases illustrate how defects can remain outside the inputs or execution paths a typical fuzzing campaign reaches.
Still, the result is not a general certification of the libraries. The proof establishes the property stated for the modeled program, not that the software is free of all defects. Its practical value will depend on whether teams can apply similar methods to the builds, environments and behaviors their users actually rely on.
As an affiliate, we earn on qualifying purchases.
From Existing Fuzz Tests to Rocq
Formal verification requires a precise statement of what a program must do. The project avoids writing a broad specification for each library by reusing its existing fuzz test as the starting point. In this setup, the test defines a narrower question: can any modeled input cause a crash or trigger a checked assertion at that entry point?
The proof process relies on formal models of RISC-V instructions and Linux processes, alongside the generated theorem statements and the Rocq proof checker. The teams say the checker—not a human reading every line of generated proof—is what validates whether each proof follows from its specification. The trusted base also includes components such as the hardware, operating system and OCaml compiler used by Rocq.
Anthropic described the effort as, to its knowledge, the first large-scale use of AI for formal verification of production software at the assembly-code level. It said it is publishing proofs that did not require code patches, previously unavailable trusted components, and specifications for fuzz tests it could not prove. The source account frames the work against a broader concern: advanced models may find and combine software vulnerabilities, making stronger ways to establish specific safety properties more relevant.
The Proofs’ Boundaries and Costs
The guarantees are limited to single-threaded, static RISC-V binaries linked against musl, as described in the source material. They do not directly establish the same properties for the x86 or ARM builds linked against glibc that many users run. The stated input limit is also 64 MB, and each proof concerns the particular entry point and behavior captured by its test and model.
“Formally verified” here does not mean that a library is bug-free. The method can only establish the theorem that was specified, and the source says a logic defect that did not crash was found only because a test encoded a relevant check. Other incorrect behavior may not be represented in a fuzz test or theorem. The report also notes that proofs can consume hundreds of millions of tokens, making computational cost a significant constraint, though newer models and reuse of shared proofs may reduce the burden.
The source material does not give a complete accounting of the bugs, the total computational cost, or how many findings were fixed and independently confirmed. It also does not establish whether the approach will scale to other architectures, threaded programs, dynamic builds or broader correctness properties.
Publication and Wider Testing
Anthropic said it is releasing the proofs that did not require patches, some trusted components that were not already public, and specifications for tests it could not prove. Those materials should let other researchers inspect the claims and examine where proof attempts succeeded or stalled.
The next test will be whether independent teams can reproduce the results and adapt the method to the software configurations used in production. Further work would also need to show how much proof cost falls with newer models and shared proof components, and whether the technique can cover properties beyond those already encoded in fuzz tests. The project’s report establishes a significant technical result within its stated scope; broader applicability remains to be demonstrated.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude produced Rocq proofs that 239 fuzz-test entry points in 123 libraries do not crash on inputs under 64 MB, for the modeled compiled programs and under the stated assumptions.
Does this prove the libraries are bug-free?
No. The proofs address specific properties expressed by particular tests, on specified builds and within the model’s limits. They do not rule out every possible defect or incorrect behavior.
How is this different from fuzzing?
Fuzzing tests many inputs but cannot guarantee it has exercised every possible path. A formal proof can establish a stated property for all inputs within its modeled scope, if the proof checks successfully.
What systems do the reported proofs cover?
The source describes single-threaded, static RISC-V binaries linked against musl. It does not claim the results directly cover common x86 or ARM builds linked against glibc.
What happens after the report?
Anthropic says it is publishing selected proofs, previously unavailable trusted components and specifications for tests it could not prove. Independent reproduction and testing on other builds will help clarify how broadly the method applies.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
