🔍 Read the full analysis: What Changes When Fuzz Tests Become Proofs In Claude’s Work? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and Theorem report that Claude produced machine-checked proofs for 239 fuzz-test entry points across 123 open-source libraries. The work found hundreds of bugs, according to Anthropic, but the proofs cover specific compiled RISC-V binaries under stated assumptions—not every version or deployment of those libraries.
Anthropic’s Frontier Red Team and collaborator Theorem said on October 22 that Claude had produced machine-checked security proofs for 239 entry points in 123 open-source libraries. The proofs establish that particular compiled RISC-V programs do not crash on inputs under 64 MB, subject to the project’s assumptions; Anthropic says the effort also uncovered hundreds of bugs that fuzzing had not found.
The project starts with existing fuzz tests, which give a program inputs and treat crashes as evidence of a bug. Rather than asking Claude to prove that an entire library is correct, the researchers used each test as a specification: for every input below the stated size limit, the tested program should not crash. That property includes crashes caused by AddressSanitizer memory errors and failed assertions.
According to Anthropic’s description, the libraries and tests were compiled into RISC-V executables and instrumented with AddressSanitizer. Theorem supplied formal models of RISC-V instructions and Linux processes. Claude wrote proofs in Rocq, a proof assistant whose checker verifies whether a proof follows from its specification. When an attempted proof exposed a problem, the team could patch the code, regenerate the specification and attempt the proof again.
The reported work produced about 180 million lines of Rocq proof over a period of a few weeks. Anthropic says a typical proof was about 600,000 lines and covered a binary with a median length of 18,000 RISC-V instructions. The company says the proofs that did not require code changes are being published, along with previously unpublished trusted components and specifications for tests that could not be proved.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
From Fuzzing to Machine-Checked Guarantees
Fuzzing tests many inputs but cannot establish that every possible input or execution path has been covered. A successful proof offers a different kind of result: for the modelled binary and stated property, the checker verifies that no input within the specified range triggers the tested failure. That can rule out a class of crashes for that exact setup, rather than simply reporting that no crash appeared during a run of tests.
The project matters because software verification has often demanded substantial specialist effort. Anthropic cites the seL4 microkernel as an example of the cost: its account says building the system took two person-years and verifying it took 20. The new work suggests AI may help produce formal proofs at a scale that would be difficult for people to write line by line. However, the reported proof volume also points to a practical limit: Anthropic says some attempts can consume hundreds of millions of tokens, while newer models and reusable proofs may reduce the cost.
The distinction matters for security decisions. A proof of a bounded no-crash property can increase confidence in a particular build, but it is not a certificate that a library is free of every flaw. The result may be useful to maintainers and security teams deciding what to test or verify next; it does not, on its own, establish that ordinary users’ installed versions are protected.
As an affiliate, we earn on qualifying purchases.
What the Proofs Actually Cover
The team addressed a common difficulty in formal verification: defining what “correct” means. Instead of writing a broad specification for each library, it used a developer-written fuzz test as the property to prove. The method therefore inherits the test’s scope. It can prove that the tested entry point does not crash under the modelled conditions, but it does not prove that every intended feature behaves correctly.
Anthropic says fuzzing often works by mutating inputs and following code coverage, while many fuzzers use relatively small inputs. The proof effort found bugs requiring unusual conditions, including very large or deeply structured inputs and a sequence of calls across two handles to the same file. The company also reports rediscovering CVE-2026-56132 in libexpat and finding a logic flaw in a feature intended to restrict which files an application could load.
Some fuzz tests encode more than memory safety. Anthropic gives an LZO compression test as an example: it asserts that decompressing compressed data returns the original input. Proving that test cannot fail establishes that round-trip property for the tested setup. In another case, the team says proving a test required ruling out a possible stack overflow from deep recursion in a C++ set destructor—an issue not necessarily obvious from the test’s headline purpose.
“The process “discovered hundreds of bugs.””
— Anthropic
As an affiliate, we earn on qualifying purchases.
Limits of the Verified Builds
The proofs apply to single-threaded, static RISC-V binaries linked against musl, according to the source account. They do not directly establish the same properties for x86 or ARM builds linked against glibc, which are common in deployed systems. Different compilers, build options, operating systems or library versions may produce programs outside the proof’s scope.
“Formally verified” here does not mean the libraries are bug-free. The result is tied to specified entry points, a no-crash property, inputs under 64 MB and formal models that the proof relies on. The account also notes that hardware, the operating system and the OCaml compiler used by Rocq sit among the trusted components. The source does not give a full public accounting of every discovered bug, how many were fixed or the total compute and financial cost of the campaign.
It is also unclear how readily the approach will extend to larger programs, other architectures and properties that are harder to express through existing tests. Anthropic says some proof attempts did not succeed; the work includes specifications for fuzz tests it could not prove, which underscores that the method did not establish a result for every target it tried.
As an affiliate, we earn on qualifying purchases.
Published Proofs and Wider Testing
Anthropic says it is publishing proofs that required no patching, along with formal components that were not previously public and specifications for tests it could not prove. Those materials should let researchers and maintainers inspect what was verified, reproduce parts of the work and assess the assumptions behind the results.
The next practical question is whether the method can be made cheaper and applied to the builds people actually use. Anthropic points to newer models and shared proofs as ways to reduce token use, but the source does not set out a timeline, cost target or commitment to cover x86 and ARM deployments. The report also does not specify when fixes for the bugs found will be released.
For now, the result is best read as a large demonstration of AI-assisted formal verification, not a general guarantee for the libraries involved. Broader evidence will depend on public review of the proofs, details about fixes and further testing across platforms, configurations and security properties beyond crashes.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
Anthropic and Theorem say Claude proved that 239 fuzz-test entry points in 123 open-source libraries do not crash for inputs under 64 MB in particular compiled RISC-V programs, under stated assumptions. The proofs cover the specified tests and builds, not every possible property of each library.
Does this mean the libraries are bug-free?
No. The proofs address a defined no-crash property for selected entry points and configurations. They do not rule out all logic, security or compatibility bugs, and they do not automatically apply to other versions or platform builds.
How is a proof different from fuzzing?
Fuzzing runs a program on many generated or changed inputs and reports failures it reaches. A formal proof uses a specification and a proof checker to establish a property for all inputs covered by that specification and model, rather than only the inputs sampled in test runs.
What bugs did the project report finding?
Anthropic says the effort found hundreds, including issues requiring very large or deeply nested inputs, a particular sequence of file-handle calls, and a logic flaw in a file-loading restriction. The source also reports a rediscovery of CVE-2026-56132 in libexpat.
What remains outside the proofs?
The reported proofs cover single-threaded, static RISC-V binaries linked against musl. They do not directly verify common x86 or ARM builds linked against glibc, and they rely on stated models and trusted components. The project’s cost and how broadly the method can scale also remain open questions.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
