Anthropic says Claude produced formal proofs for 123 open-source libraries and uncovered bugs that had evaded detection for years.
Anthropic said its Claude models were able to produce formal proofs for security properties in compiled code across 123 open-source libraries, a result the company described as a step toward making formal software verification practical at much larger scale. In the research post published on Oct. 22, 2026, Anthropic said the work also surfaced bugs that had gone unnoticed for years.
According to Anthropic, Claude proved that 239 entry points across those 123 libraries would not crash on any input below 64 MB under the project’s modeled conditions. The company said the proofs were applied at the assembly-code level on RISC-V binaries and used Theorem’s formal semantics for RISC-V and Linux process behavior. Anthropic said the effort covered real-world open-source software, including libraries from Google’s OSS-Fuzz initiative, and that it represents, to its knowledge, the first large-scale use of AI to apply formal verification to production software at the assembly-code level.
The company said the proofs were generated over several weeks and that Claude also patched bugs it encountered during the process. Among the examples listed were an out-of-bounds write triggered by a rare 20 MB input layout, an out-of-bounds read in an image decoder requiring a 64 MB input and more than 2 GB of memory, a crash tied to a particular call sequence across two file handles, and a rediscovery of CVE-2026-56132 in libexpat. Anthropic also said the effort uncovered logic bugs that did not crash the software, including one case in which a file-access restriction feature was not always enforced.
Source link
