🔍 Read the full analysis: A Guide To Anthropic’s Claude Work On Fuzz Tests And Proofs on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic’s Frontier Red Team and collaborator Theorem report that Claude produced machine-checked proofs that 239 fuzz-test entry points across 123 open-source libraries do not crash under a defined set of conditions. The project also found bugs, but its proofs apply to particular compiled RISC-V binaries and do not establish that the libraries are bug-free across the versions and platforms people use.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that Claude had proved a defined no-crash property for 239 fuzz-test entry points in 123 open-source libraries. The work applies formal verification to compiled machine code and, Anthropic says, found hundreds of bugs—but the proofs cover specific RISC-V builds and conditions, not every version or platform used in practice.
The team treated each library’s existing fuzz test as a specification: for every input under 64 megabytes, the compiled program must not crash. The property also rules out AddressSanitizer memory errors and failed assertions, subject to the project’s stated assumptions. Claude generated proofs in Rocq, a proof assistant whose checker tests whether a proof follows from its specification.
In the reported pipeline, a library and its fuzz test are compiled into an instrumented RISC-V executable. Formal models of RISC-V instructions and Linux processes help generate the specification. Claude attempts a proof; when that attempt exposes a possible failure, the system can point to a bug, patch the code, regenerate the specification and try again. The source says the work ran over a few weeks and produced about 180 million lines of Rocq proof. A typical proof was about 600,000 lines, covering a binary with a median length of 18,000 RISC-V instructions.
Anthropic says the effort discovered hundreds of bugs, including cases that ordinary fuzzing might be unlikely to reach. Examples in the source include an out-of-bounds write requiring an input of about 20 megabytes with a rare layout, and an image-decoder read requiring a 64-megabyte input and more than 2 gigabytes of memory. Another reported issue depended on a particular sequence of calls involving two handles to the same file. These are examples reported by the project, not evidence that every discovered issue affected deployed software.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
What Machine-Checked Proofs Add
Fuzzing tests many inputs, but it does not establish that every possible path has been exercised. A formal proof can cover all paths reachable from a defined entry point—if the specification and model accurately represent the system being checked. That makes the reported results a different kind of assurance from a large test count: within the stated model, the property is proved rather than inferred from sampled runs.
The approach also puts attention on a longstanding cost barrier. Anthropic cites formal verification work on the seL4 microkernel that took two person-years to build and 20 person-years to verify, illustrating why this technique has tended to be reserved for selected safety-critical software. The project argues that language models can take on much of the work of writing proofs, while a separate checker validates them. That could make verification practical for more code, though the reported effort’s token use and scale remain substantial.
The method is not limited to memory safety. The source says some fuzz tests assert higher-level behavior by crashing if a condition fails. For example, proving that a compression test never crashes can establish its specified round-trip property. In another case, completing a proof required ruling out a stack overflow caused by deep recursion in a destructor. This illustrates how proof work may surface relevant properties beyond the most obvious crash checks.
formal verification software tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From Fuzz Tests to Rocq Proofs
Fuzzers feed programs large numbers of generated or mutated inputs and look for crashes or other failures. They are useful because they can uncover bugs without developers spelling out every expected behavior. But testing remains limited by the inputs tried, the paths reached and the resources available. The source says fuzzers often use relatively small inputs, while some bugs found in this project required unusually large or specially structured inputs.
Formal verification takes a different route: define a property precisely and prove that a model of the program satisfies it. Anthropic and Theorem used existing fuzz-test entry points to avoid writing a complete specification for each library from scratch. The project describes its work as, to Anthropic’s knowledge, the first large-scale application of AI-assisted formal verification to production software at the assembly-code level.
That description does not mean the entire result rests on Claude. The proof checker verifies the generated proofs, while the trusted base includes the formal models, theorem statements and checker. The source also identifies hardware, the operating system and the OCaml compiler used by Rocq as components that must be trusted. Anthropic says it is publishing proofs that did not require patches, previously unpublished trusted components and specifications for fuzz tests it could not prove.
As an affiliate, we earn on qualifying purchases.
Where the Proofs Stop
The results establish only the properties named in the specifications for the systems modeled. According to the source, the proofs concern single-threaded, static RISC-V binaries linked against musl. They do not directly prove the behavior of x86 or ARM builds linked against glibc, which are common in real deployments. Nor does a no-crash proof establish that a library has no logic errors, security weaknesses or incorrect outputs outside the checks encoded by its test.
The project’s 64-megabyte input limit and other modeling assumptions also define the scope of each result. The source describes a logic bug involving a file-loading restriction that did not always apply, despite the method’s focus on crash-based tests. That example signals both the potential and the limits of deriving assurances from existing tests: the test has to express the property in question, and the proof must finish under an adequate model.
Cost remains another open issue. The source says some proofs can take hundreds of millions of tokens, although newer models and shared proofs may reduce the amount needed. It does not provide a complete per-library cost, a comparison with conventional verification, or figures for how much human effort was required across the project. It is also unclear from the supplied report how many discovered bugs were patched upstream, independently confirmed or present in widely deployed releases.
As an affiliate, we earn on qualifying purchases.
Publication and Wider Validation
Anthropic says it is publishing the proofs that did not require code patches, the previously unpublished trusted components and specifications for fuzz tests it could not prove. Those materials can let other researchers inspect the assumptions, check the proof artifacts and assess which results apply to particular library versions.
The next meaningful test is whether the approach can be reproduced and extended beyond the reported RISC-V and musl setup, while reducing the proof-generation cost. Readers will also need follow-up information on bug triage: which findings were confirmed, whether maintainers issued fixes and which releases or users were affected. The supplied account does not give a timetable for that work or say how broadly the approach will be applied next.
As an affiliate, we earn on qualifying purchases.
Key Questions
What did Claude prove?
According to Anthropic and Theorem, Claude generated Rocq proofs that 239 fuzz-test entry points in 123 open-source libraries did not crash on inputs under 64 megabytes, under the project’s assumptions and for the modeled binaries. The checks included AddressSanitizer errors and failed assertions.
Does this mean the libraries are bug-free?
No. The proofs cover specified properties for particular compiled programs. They do not establish that all library behavior is correct or that other builds, platforms, versions and untested properties are free of bugs.
How is a proof different from fuzzing?
Fuzzing tries many generated inputs and checks whether they trigger a failure. A formal proof aims to show that a stated property holds across all paths represented by the model, rather than only the inputs sampled during testing. The result depends on the quality and scope of that model and specification.
Which platforms do the reported proofs cover?
The source describes single-threaded static RISC-V binaries linked against musl. It says the results do not directly cover the x86 or ARM builds linked against glibc that many users run.
What remains to be confirmed about the bugs?
The supplied report does not say how many findings were independently confirmed, patched upstream or present in widely deployed releases. It also does not provide a complete breakdown of verification costs or a schedule for expanding the work to other platforms.
Source: ThorstenMeyerAI.com
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
