Anthropic announced that its Claude model, working with partner Theorem, has formally proven security properties in the compiled code of 123 open-source libraries. The proofs were generated at the assembly level for the RISC-V processor architecture, a first at this scale for AI-driven formal verification. Along the way, Claude found bugs that had gone undetected for years despite trillions of test runs.
The work, published by Anthropic's Frontier Red Team, tackles a fundamental problem in software security: the standard defense of testing can never prove that code is completely free of bugs. Formal verification can, but it has historically required enormous human effort — verifying the small seL4 operating system kernel took 20 person-years. Anthropic says LLMs are now making this practical at much larger scale.
How Claude verified 123 libraries at the assembly level
The team drew test programs from Google's OSS-Fuzz security project, which covers widely used open-source libraries. Rather than writing new code, Claude translated existing crash tests into mathematical problems, analyzed the compiled machine code, and produced roughly 180 million lines of proof code over a few weeks. An independent verification program called Rocq automatically checks the proofs.
According to Anthropic, the process needed almost no human reviewers, describing it as "fully autonomous" proof generation — though the tools and formal foundations were built by humans at Theorem. The security properties Claude proved were specific: that programs will always exit normally without memory-safety errors or failed assertions, for every input under 64 MB and every modeled Linux OS response and memory layout.
Anthropic is publishing a subset of the proofs so others can verify and reuse them, along with the RISC-V and OS semantics. Theorem is offering to run the same pipeline for other open-source projects and is releasing a Claude skill to help developers get started with verifying their own code.
