Claude automates formal software verification for 123 open-source libraries
Anthropic used Claude to mathematically prove code is bug-free, turning a decades-long manual process into an automated AI workflow.
Research · Source: Hacker News
What happened
Anthropic and Theorem used Claude to perform formal software verification at an unprecedented scale. They proved security properties at the assembly code level for 123 real-world open-source libraries. The AI generated mathematical proofs guaranteeing these programs will not crash from memory-safety errors or failed assertions. This verification process operated directly on compiled RISC-V instructions running on a modeled Linux operating system.
Formal verification is notoriously difficult and expensive. Historically, it required years of highly specialized human labor to verify even small codebases. For example, verifying the seL4 operating system kernel previously took 20 person-years of expert effort. Now, frontier models can produce these complex correctness proofs fully autonomously. This makes mathematical security guarantees practical for everyday software projects.
The research team converted existing fuzz tests into strict mathematical specifications. Claude then wrote 180 million lines of Rocq proof code to satisfy these exact specifications. During this process, the AI discovered deep logic bugs that traditional fuzzing had missed for years despite trillions of test runs. Claude autonomously patched the broken code before finalizing the mathematical proofs.
Key facts
- 123 — open-source libraries verified by Claude
- 180 million — lines of Rocq proof code generated
- 20 person-years — historical time required to verify the seL4 kernel
- 64 MB — maximum input size guaranteed crash-free in the proofs
Why it matters
You no longer have to rely purely on brute-force testing to secure critical infrastructure. Traditional fuzz testing only checks random inputs and hopes to trigger a crash. It can never test infinite possibilities. AI-driven formal verification changes the paradigm entirely. It mathematically proves that no input under specified conditions can ever break your code. This brings aerospace-grade security guarantees to everyday software development. Builders can now ship code knowing certain classes of bugs are mathematically impossible.
The cost of absolute software security is about to plummet. As frontier models get smarter, writing formal proofs will become cheaper and faster than writing endless test suites. We will see a massive industry shift where developers trust the mathematical proof checker rather than the code itself. Entire categories of memory-safety vulnerabilities will disappear from verified codebases. Malicious actors rely on these exact vulnerabilities to chain exploits together. Removing them at the assembly level cripples the standard playbook for cyberattacks.
For builders
Convert fuzz tests into formal proofs
Stop relying on random input testing to find edge cases. You can now use AI to convert existing fuzz tests into strict formal specifications. Companies building high-stakes infrastructure win by mathematically guaranteeing memory safety.
Catch deep bugs traditional tests miss
Claude found out-of-bounds reads requiring 64 megabytes of input and specific memory layouts. Traditional fuzzers cap inputs at one megabyte and miss these complex vulnerabilities completely. Teams relying solely on standard fuzzing will lose to competitors using AI verification.
Secure code at the assembly level
High-level language checks are no longer enough to stop sophisticated exploits. Claude verified these programs directly at the RISC-V assembly code level. Security engineers who adopt assembly-level AI verification will command massive premiums in the market.
My take
I think we are witnessing the beginning of the end for the software bug. For years, formal verification was a luxury reserved for aviation and defense because human proof-writing was far too expensive. Now that Claude can write 180 million lines of proof code autonomously, builders have absolutely no excuse for shipping memory leaks.
Original reporting: Hacker News. This is my rewrite and opinion.