N環球 
Claude Writes 180 Million Lines of Mathematical Proof in First Large-Scale AI Formal Verification of Open-Source Software
Anthropic's official research: with Theorem, Claude formally verified security properties at the RISC-V assembly level across 123 open-source libraries and 239 entry points — and dug up hundreds of bugs that had evaded trillions of automated tests.
Why it matters
Formal verification used to be a luxury only experts could afford over years — the seL4 microkernel took 2 person-years to write and 20 person-years to verify. Anthropic has now shown that a frontier model can do it for over a hundred real open-source libraries in weeks, while unearthing bugs that survived "trillions" of automated test runs.
Full report
Anthropic announced on its official research page on October 22: in collaboration with software verification company Theorem, Claude formally verified security properties at the RISC-V assembly level across 123 real-world open-source libraries drawn from Google's OSS-Fuzz, covering 239 program entry points. The company calls it "the first large-scale effort to use AI to apply formal verification to production software at the assembly code level."
The scale is striking: about 180 million lines of Rocq proofs, with a typical proof running to some 600,000 lines, covering binaries with a median length of 18,000 RISC-V instructions — all completed in a matter of weeks. The Rocq kernel independently checks each proof, so no manual line-by-line review is needed.
The method converts existing fuzz tests into mathematical specifications: for any input under 64 MB, a single-threaded statically linked RISC-V binary on Linux must always exit normally, with no memory-safety violations. When Claude suspected a bug mid-proof, it patched the code directly and re-proved the new spec.
Hundreds of bugs surfaced along the way, including a counter underflow in a decompressor copy leading to an out-of-bounds write (triggerable only by ~20 MB inputs with one rare layout), an out-of-bounds read in an image decoder, and a rediscovery of CVE-2026-56132 in libexpat — some vulnerabilities had lurked for years.
Anthropic acknowledges the limits itself: a passed formal verification does not mean bug-free — the proofs cover only single-threaded static RISC-V binaries, while most code actually runs on x86/ARM. It has published a subset of the proofs on GitHub for independent verification, and Theorem says it will run the same pipeline for other open-source projects.
Side results are notable too: the Linux kernel's zlib implementation was proven to conform to RFC 1950 at the x86 binary level, and a large subset of a Python interpreter written in Rust matched CPython's behavior on 99.95% of 1.7 million-plus randomized programs.
💬 Comments
No comments yet. Be the first!