Anthropic Used Claude to Formally Verify 123 Open-Source Libraries

Anthropic has used Claude to write mathematical proofs that 239 entry points across 123 widely used open-source libraries cannot crash on any input up to 64 megabytes, and the result moves AI's role in software security from finding bugs one at a time toward proving whole classes of them absent. The research, published on October 22 with the verification startup Theorem, produced about 180 million lines of proofs in the Rocq proof language over a few weeks, work that has historically taken specialists years for a single system.

Claude turned fuzz tests into proofs that a machine can check

Formal verification means writing a mathematical argument that a program always obeys a rule, then letting a small, trusted program check that argument. Its cost has kept it confined to aircraft software and research kernels. Anthropic cites the seL4 operating system kernel, which took two person-years to write and 20 person-years to verify.

Anthropic's shortcut was to skip writing new specifications. Google's OSS-Fuzz project already contains thousands of developer-written fuzz tests, entry points that crash when something goes wrong, such as an out-of-bounds memory access. Claude restated each test as a theorem that the test never crashes for any input under 64 MB, then wrote the proof against the compiled binary. Rocq's proof checker verifies every line, so the 180 million lines need no human review. What a developer has to trust shrinks to Theorem's formal models of the RISC-V processor and Linux processes, the theorem statements, and the checker itself.

The bugs Claude found sat where fuzzers rarely look

A failed proof points to a bug, so the effort doubled as a bug hunt. Claude found a counter underflow in a decompressor that caused an out-of-bounds write only on inputs of about 20 MB with one rare layout, an image decoder that misread memory on a 64 MB input with more than 2 GB of RAM, and a rediscovery of a known libexpat flaw that needed deeply nested input. It also caught a logic bug where a library's restriction on which files an application may load was not always enforced, which no crash test would ever flag.

Fuzzers mutate small inputs, usually capped near 1 MB, and steer by code coverage, so a bug that needs a 20 MB file with a specific shape can survive trillions of test runs. A proof covers every input in its range by construction. In a separate experiment on a widely used PDF reader, Anthropic says Claude-led verification attempts surfaced as many security bugs in one week as are typically reported in a year.

Proof cost is falling with each model and shrinking with reuse

The constraint Anthropic names is cost, with proofs consuming hundreds of millions of tokens. Two numbers suggest that constraint is easing. On 36 small verification tasks built from real OSS-Fuzz code, Opus 5.5 proved half of them using about 40% fewer tokens than Opus 5. When agents could copy each other's finished proofs from a shared workspace, they needed 17% fewer tokens, and most of any proof covers C runtime and AddressSanitizer startup code that every program shares.

Source: Anthropic, October 22, 2026.

Reuse turns verification into something closer to a package ecosystem. Theorem has published a roadmap to verify the Nix software ecosystem, including glibc, OpenSSL and cURL, on the logic that dependencies follow a power law and each one only needs proving once.

The limits sit in the models of the machine

Anthropic is explicit that “formally verified” does not mean bug-free. The proofs assume a single-threaded, statically linked program on a RISC-V chip using the musl C library, while most of these libraries run on x86 or ARM servers with glibc. AddressSanitizer catches most memory errors but not all, only some entry points per library were proven, and a caller that misuses a library can still corrupt memory. Remaining bugs, by design, live in the trusted models or outside the theorem's scope, which tells defenders exactly where to look.

That limitation also defines the next contest. Improving the processor and operating system models is a bounded task done once, while debugging every line of every library never ends, so the economics favor building the models. Theorem is offering to run the pipeline for other open-source projects and has released a Claude skill for developers who want to try it on their own code, which makes AI agents that verify code a tool open-source maintainers can start using now.

Yesterday's PHP2Shell flaws showed that frontier models can turn a forgotten bug into an attack on most of the web faster than maintainers can respond. Anthropic's result points to the only defense that scales with that speed: once a library's proof exists, attackers searching it with the same models have, within the proof's assumptions, nothing left to find, and the work shifts to making those assumptions match the machines the code actually runs on.