🔍 Read the full analysis: What Anthropic’s Experiment Says About Fuzz Tests, Proofs, And Claude on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Anthropic and Theorem say Claude generated Rocq proofs showing that 239 fuzz-test entry points across 123 open-source libraries do not crash for inputs under 64 MB in specified RISC-V builds. The project also found hundreds of bugs, but its proofs apply only to the modeled binaries and assumptions—not to all builds or all possible defects.
Anthropic’s Frontier Red Team and collaborator Theorem reported on October 22 that Claude generated formal proofs for 239 fuzz-test entry points across 123 open-source libraries, establishing that specified compiled programs do not crash on inputs under 64 MB. The experiment also found hundreds of bugs, according to Anthropic, including cases the existing fuzzing had not reached; the results apply to particular modeled RISC-V builds, not every version of the software.
The team used each library’s existing fuzz test as the property to prove. Fuzz tests feed varied inputs to a program and treat a crash as evidence of a defect. Anthropic and Theorem compiled the libraries and tests into RISC-V executables, added AddressSanitizer instrumentation, and used formal models of RISC-V instructions and Linux processes to define a no-crash specification. Claude then wrote proofs in Rocq, a proof assistant whose checker verifies whether a proof follows from its stated assumptions.
Anthropic says the work took place over a few weeks and produced about 180 million lines of Rocq proof. A typical proof was about 600,000 lines, while the corresponding binary had a median of 18,000 RISC-V instructions. The company says approximately 180 million lines did not need human review: confidence rests instead on the theorem statements, formal models and proof checker, alongside other components in the trusted computing base.
When a proof attempt encountered a problem, the team used it to identify possible defects, patch code and regenerate the specification before trying again. Anthropic says the effort found hundreds of bugs. Examples in the source account include an out-of-bounds write requiring an input of around 20 MB with a rare layout, and an image-decoder out-of-bounds read involving a 64 MB input and more than 2 GB of memory. It also reports rediscovering CVE-2026-56132 in libexpat and identifying a file-restriction logic bug that did not necessarily cause a crash.
Infographic 01 · From test to proof
Existing fuzz tests became specifications. Claude proved them.
Over a few weeks, Claude proved at the machine-code level that hundreds of real fuzz entry points can no longer crash, after patching the bugs it found.
The pipeline
From an existing test to a checked proof
- Compile. The library and its existing fuzz test become a RISC-V executable, instrumented with AddressSanitizer.
- Specify. Theorem’s RISC-V and Linux process semantics plus the no-crash property mechanically yield the specification.
- Prove. Claude writes the proof in Rocq. A failed attempt points at a possible bug; Claude patches it and proves the new spec.
- Check. The Rocq proof checker verifies the proof. Virtually none of the proof needs human review.
Fuzzing vs. proof
Same entry point, different guarantee
| Fuzzing | Proof | |
|---|---|---|
| Inputs | Fuzzing: Generated samples, typically capped at 1 MB | Proof: Every input under 64 MB |
| Paths | Fuzzing: Guided by code coverage, no guarantee | Proof: Every path reachable from the entry point |
| Result | Fuzzing: Bugs found so far | Proof: No crash left to find on the modelled system |
Typical proof: about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions.
“If Claude can prove this spec, the fuzz test on RISC-V becomes superfluous.”Anthropic, 22 Oct 2026
Source: Anthropic, “LLMs are making formal software verification feasible at a much larger scale” (22 Oct 2026).
Powered by Thorsten Meyer AI
Proofs Extend Fuzzing’s Reach
The experiment addresses a limit of conventional fuzzing: testing can explore many inputs, but it cannot establish that every possible input follows a safe path. A successful proof of the specified property covers all inputs within its modeled scope. That can expose rare paths that random or mutated test data has not exercised, including cases requiring large inputs or a particular sequence of operations.
The result is relevant to software security because bugs in widely used libraries can affect many applications. Anthropic argues that formal verification could provide stronger assurance than testing alone, at a lower labor cost if AI can produce proofs that machines check. But the report does not show that all formal verification is now inexpensive or that the libraries are free of defects. The reported proofs concern a specific crash-related property, and the work’s computing cost remains substantial.
Products Worth Considering
Samsung 32-Inch Odyssey G5 QHD 180Hz Gaming Monitor
Bose QuietComfort Wireless Noise-Cancelling Headphones, White Smoke
Samsung Odyssey G3 G30D 27-Inch FHD Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Existing Tests to Rocq
Formal verification has often required specialists to write precise specifications and proofs by hand. The source account cites the seL4 microkernel as an example of the effort involved: two person-years to build and 20 person-years to verify. Anthropic’s approach avoids starting with a broad definition of what a library should do. Instead, it formalizes the behavior already checked by an existing fuzz test.
That choice narrows the claim. For the modeled program, the proof establishes that the fuzz test will not crash for inputs under 64 MB, including crashes triggered by AddressSanitizer errors or failed assertions. Some fuzz tests encode higher-level checks: the source account gives an LZO compression test that asserts decompression returns the original input. Proving that test’s no-crash behavior can therefore cover that round-trip property, provided the specification captures it correctly.
Anthropic describes the project as, to its knowledge, the first large-scale use of AI to apply formal verification to production software at the assembly-code level. It says it is publishing proofs that required no patches, previously unavailable trusted components and specifications for fuzz tests it could not prove.
““Nobody has to read those 180 million lines.””
— Thorsten Meyer, source article
Where the Proofs Stop
The results cover single-threaded, static RISC-V binaries linked against musl, according to the source account. They do not automatically establish the same property for commonly deployed x86 or ARM builds linked against glibc, or for different compiler settings and runtime environments. The stated input limit is under 64 MB, and the claim depends on the formal models and theorem specifications being correct.
A no-crash proof is not a general guarantee that software is correct or secure. It does not rule out every logic flaw, incorrect output, or vulnerability outside the property being checked. The source also says some proof attempts did not finish, but does not give a full breakdown of completion rates, total compute use, or the exact cost per proof. The claimed bugs and their severity have not been independently assessed in the supplied material.
Published Proofs and Open Questions
Anthropic says it is releasing the proofs that did not require code patches, the trusted components that were not already public, and specifications for tests it could not prove. Those materials could let other researchers inspect the claims and assess how much of the method can be reproduced.
The next questions are whether the approach can be extended to other architectures and runtime configurations, how often it can complete proofs without costly iteration, and how much expert work is needed to validate specifications. Anthropic’s account says proofs can consume hundreds of millions of tokens, while newer models and shared proofs can reduce that demand; detailed cost and performance comparisons are not provided in the supplied source.
Key Questions
What did Claude prove?
Anthropic and Theorem say Claude generated Rocq proofs that 239 fuzz-test entry points across 123 libraries do not crash on inputs under 64 MB in the modeled program configurations, under stated assumptions.
Does this mean the libraries are bug-free?
No. The proofs cover a defined no-crash property, not every possible defect or security issue. The reported scope is limited to particular single-threaded RISC-V binaries and their formal models.
How is a proof different from fuzz testing?
Fuzzing tests selected inputs and can find bugs when those inputs trigger them. A formal proof can establish the specified property across all inputs in scope, rather than only those tested.
What kinds of bugs did the project report finding?
Anthropic says the work found hundreds, including memory errors tied to large or unusual inputs, a libexpat issue identified as CVE-2026-56132, and a file-restriction logic bug.
Can the results be applied to software people use today?
Not automatically. The source account says the proofs cover static RISC-V builds linked against musl, not the x86 or ARM builds with glibc used in many deployments.
Source: ThorstenMeyerAI.com
