🔍 Read the full analysis: How Anthropic Reframed Fuzz Testing As Formal Proof on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Anthropic’s Frontier Red Team and Theorem report that Claude produced machine-checked proofs covering 239 fuzz-test entry points in 123 open-source libraries. The proofs apply to specified compiled RISC-V programs and inputs under 64 MB, not to every version or configuration of the libraries; the team also reports finding hundreds of bugs.
Anthropic’s Frontier Red Team and research collaborator Theorem said on October 22 that Claude produced machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries, establishing that the modeled programs do not crash on inputs under 64 MB. The work, checked by the Rocq proof assistant, also surfaced bugs the researchers say existing fuzzing had missed, though the findings apply only to specific compiled programs and stated assumptions.
The researchers used existing fuzz tests as specifications rather than asking the model to define what each library should do. Each test was compiled with its library into an instrumented RISC-V executable. AddressSanitizer made specified memory errors cause a crash, while the formal model described the program and its execution. Claude then generated a proof in Rocq that the test would not crash for any input below the size limit. Rocq’s checker, not Claude’s own assessment, verifies whether a proof follows from the specification.
Anthropic and Theorem report that the proofs amount to about 180 million lines of Rocq, with a typical proof around 600,000 lines. The team says it completed the work over a few weeks. When a proof attempt exposed a possible problem, Claude could help patch the code, after which the specification was regenerated and another proof attempted. Anthropic says it is publishing proofs that did not require patches, some previously unpublished trusted components, and specifications for tests it could not prove.
The report says the process found hundreds of bugs. Examples include a decompressor issue requiring an input around 20 MB with a rare layout, and an image-decoder issue involving a 64 MB input and more than 2 GB of memory. Other cases depended on a particular sequence of calls or deeply nested input. The team also describes a logic flaw in a file-loading restriction that did not necessarily cause a crash. These are examples cited by the researchers, not independent confirmation that every reported issue is exploitable or affects commonly used builds.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Could Change
Fuzzing tests software by supplying many inputs and looking for failures. It can be highly effective, but it samples behavior: a fuzzer may not reach a rare combination of input size, layout, or call sequence. A proof covering every modeled execution from an entry point offers a different kind of assurance. If its assumptions and specification hold, the particular no-crash property is established for that model, rather than inferred from a set of successful test runs.
The scale matters because formal verification has traditionally required substantial specialist effort. Anthropic cites the seL4 microkernel as an example in which verification took far more labor than implementation. In this experiment, AI generated extensive proofs and a small proof-checking system verified them, shifting the human task toward checking the specification and trusted foundations. That could make formal methods practical for more code, but the project does not show that all software can be verified cheaply: the researchers say some proofs consumed hundreds of millions of tokens, making cost a major constraint.
The distinction is important for software users and maintainers. A proved property can reduce uncertainty about a specific class of failure, but it is not a general certification that a library is safe or correct. The experiment’s results could inform future security work, while deployment decisions still depend on whether the analyzed binary matches the software people actually run.
As an affiliate, we earn on qualifying purchases.
The Test Suite Became the Specification
Formal verification requires a precise statement of what a program must do. For complex software, writing that specification can itself be a difficult and costly task. The approach described by Anthropic and Theorem narrows the claim: it takes an existing fuzz-test entry point and proves that the test does not trigger a crash under defined conditions. The test therefore supplies the property being checked, rather than a complete description of intended behavior.
The system modeled single-threaded, statically compiled RISC-V programs linked against musl. The stated input limit was 64 MB, and the instrumentation targeted AddressSanitizer memory errors and failed assertions. The report says a proof depends on a trusted base that includes models of RISC-V instructions and Linux processes, the theorem statements, and the Rocq checker. Hardware, the operating system, and the OCaml compiler used by Rocq also sit among the assumptions the team identifies.
Anthropic frames the work against security risks from software flaws and notes that extensive testing does not rule out vulnerabilities. Its claim is that AI can reduce the cost of producing formal proofs; the project’s evidence is this defined set of entry points and builds, not a general demonstration that language models can verify arbitrary production systems.
“The Rocq proof checker verifies the proof against the specification.”
— Anthropic, describing the proof pipeline
Where the Proofs Stop
The results do not establish that the libraries are bug-free. They establish a particular no-crash property for particular compiled programs, entry points, input limits, and modeling assumptions. The report’s RISC-V and musl setup does not directly cover the x86 or ARM builds linked with glibc that many users may run. It is also not clear from the supplied material how many reported bugs have been independently reproduced, fixed, or assigned security advisories.
Other limits arise from what the fuzz test checks. A no-crash proof can cover a higher-level property when the test asserts it—for example, a compression round trip—but it cannot prove requirements that the test does not express. Nor does a completed proof remove the need to trust the formal models, theorem statements, checker, and supporting system components. The researchers also report that some proof attempts did not complete, and the cost in tokens can be very high.
Publication and Replication Ahead
Anthropic says it is releasing the proofs that required no code patches, trusted components that were not already public, and specifications for fuzz tests the system could not prove. Those materials provide a basis for other researchers and maintainers to inspect the assumptions, verify the proof artifacts, and test whether the approach can be reproduced.
The next practical questions are whether the bugs are addressed in affected projects, whether proofs can be extended to common x86 and ARM configurations, and whether improved models or reusable proofs can lower the reported costs. The source material does not give a schedule for those steps or quantify how many of the 123 libraries will receive proofs for other architectures. For now, the result is a substantial demonstration within a tightly defined setup, with broader coverage and real-world adoption still to be shown.
Key Questions
What did Claude prove?
For 239 fuzz-test entry points in 123 libraries, the proofs establish that the specified compiled RISC-V programs do not crash on inputs under 64 MB, under the report’s assumptions. They do not prove that the libraries are free of all bugs.
Does this mean the libraries are bug-free?
No. The proofs cover specific entry points, builds, and properties. They do not establish that every feature works correctly or that other versions and configurations are safe.
How were the proofs checked?
Claude generated proofs in Rocq. Rocq’s proof checker evaluated them against formal specifications built from the fuzz tests and models of the compiled program.
What kinds of bugs did the team report?
The researchers describe memory-safety issues requiring unusually large or carefully structured inputs, a bug dependent on a sequence of calls, and a logic flaw that did not necessarily crash the program. These examples are claims in the report and do not establish that every issue is exploitable.
Do the results apply to software people run today?
Not automatically. The reported proofs cover single-threaded, statically compiled RISC-V binaries linked against musl. The source says they do not directly cover common x86 or ARM builds linked against glibc.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
