Anthropic uses Claude to formally verify 123 open source libraries
Formal verification used to take decades, but Claude just proved 123 open source libraries are bug-free at the assembly level.
Research · Source: Hacker News
What happened
Anthropic just dropped a massive research update. They used Claude to formally verify software at the assembly code level. This is a huge deal. Formal verification proves code is mathematically free of bugs. Historically, this took years of expert human labor. For example, it took twenty person-years to formally verify the seL4 operating system kernel.
Working with Theorem, Anthropic turned existing fuzz tests into mathematical specifications. Claude then wrote the proofs. The Rocq kernel checked them. They successfully proved security properties for 239 entry points across 123 open-source libraries in the Google OSS-Fuzz initiative. The proofs guarantee these programs will exit normally without memory-safety errors for inputs under 64 megabytes.
The scale is unprecedented. Claude generated 180 million lines of Rocq proof code. A typical proof was 600,000 lines just to verify 18,000 RISC-V instructions. While doing this, Claude found and patched deep bugs that traditional fuzzing missed. This includes a counter underflow requiring a specific 20 megabyte input and a rediscovery of a known vulnerability in libexpat.
Key facts
- 1,000 — Vulnerabilities recently disclosed in the Linux kernel
- 20 — Person-years required to formally verify the seL4 operating system kernel
- 123 — Open-source OSS-Fuzz libraries Claude proved security properties for
- 64 MB — Maximum input size Claude proved the programs would not crash under
- 180 million — Lines of Rocq proof code generated by Claude
- 18,000 — Median number of RISC-V instructions in the verified binaries
- CVE-2026-56132 — A vulnerability in libexpat rediscovered by Claude during proof generation
Why it matters
We can finally stop relying solely on brute-force testing. Fuzz testing only finds bugs by throwing random inputs at code until it crashes. It never guarantees you found everything. Now, LLMs can automatically translate code into mathematical models and prove that certain crashes are impossible. You get military-grade software security without hiring a team of specialized researchers. This unlocks formal verification for standard commercial projects, not just avionics software.
The cost of absolute software correctness is crashing to zero. If models keep improving, formal verification will become a standard step in the deployment pipeline. Developers will only need to trust the proof checker, the hardware semantics, and the theorem statements. The actual proof generation becomes a cheap, automated commodity. This shifts the engineering bottleneck from finding bugs to simply defining what correct behavior looks like.
For builders
Automate your security proofs
Theorem is offering to run this pipeline for other open-source projects. They are also publishing a Claude skill to help developers verify their own code. Security teams save money, and developers ship safer code.
Find deep edge case bugs
Traditional fuzzers usually cap inputs at 1 megabyte. Claude found an out-of-bounds read that required a 64 megabyte input and over 2 gigabytes of memory. You can use LLMs to catch complex logic flaws that evade trillions of standard test runs.
Turn fuzz tests into specs
You do not need to write complex mathematical specifications from scratch. Anthropic proved you can automatically convert existing compilable test suites into strict rules. This drastically lowers the barrier to entry for founders building secure infrastructure.
My take
I have always hated writing tests because they only prove the presence of bugs, never their absence. Anthropic using Claude to automate formal verification changes the entire foundation of software engineering. If we can mathematically prove our code works at the assembly level, the days of shipping broken software and patching it later are finally over.
Original reporting: Hacker News. This is my rewrite and opinion.