Claude Automates Formal Verification of Open-Source Code

A new collaboration between Anthropic and Theorem has made it possible to mathematically verify software correctness without the need for massive human teams. This development marks a significant shift in how developers ensure the safety of complex codebases.

Historically, formal verification was an expensive process reserved for high-stakes environments like aerospace avionics. For example, a team of specialists required twenty person-years to verify the seL4 operating system kernel. To overcome this barrier, Anthropic's Frontier Red Team used Claude to handle the heavy lifting. The model processed test programs from 123 open-source libraries associated with Google's OSS-Fuzz security project. In just a few weeks, Claude produced approximately 180 million lines of mathematical proof code.

The process does not involve writing new software from scratch. Instead, Claude translates existing crash tests into mathematical problems and analyzes the compiled machine code. The system then generates extensive proofs that are automatically checked by an independent verification program called Rocq. According to the researchers, this workflow requires almost no human review. They describe the output as fully autonomous proof generation, although the underlying formal foundations were built by humans at Theorem.

The verification process also yielded significant security improvements. Claude identified and fixed hundreds of bugs that conventional testing had missed for years. Many of these errors only appeared under specific conditions, such as unusually large input files or particular access sequences. In one notable case, the team found as many security bugs in a widely used PDF reader in one week as are typically reported in an entire year. Claude also caught a logical error that had remained undetected for over a decade. Even when a complete proof fails, the attempt often surfaces real defects.

Despite these successes, the method has strict practical limits. Anthropic notes that formal verification does not guarantee a system is entirely error-free. The proofs only hold under specific conditions, including a specific processor architecture, single-threaded programs, and inputs under 64 MB. Real-world applications often run on different hardware and configurations. Additionally, the computational cost is high, with individual proofs consuming hundreds of millions of tokens.

The project suggests a future where AI can both write code and prove its safety. If this becomes routine, developers can trust AI-generated software more and spend less time on manual review. This could reduce costs across the entire coding process. Smaller tests also showed that newer models are more efficient. Opus 5.5 solves half the proofs with about 40 percent fewer tokens than its predecessor. Anthropic expects this approach to become as common as standard testing. Theorem's roadmap already targets critical infrastructure libraries like glibc, OpenSSL, and cURL.