Anthropic says Claude has demonstrated security properties in 123 libraries

Anthropic published research on October 22, 2026, reporting that Claude produced formal machine-controlled proofs of RISC-V assembly code-level security properties for 239 fuzz-test entry points in 123 open source libraries, in a collaboration with Theorem.

According to Anthropic, Claude fixed the bugs found and then demonstrated that programs will always exit normally without triggering memory safety errors or failed assertions, for every input smaller than 64 MB and for every modeled response of the Linux operating system and memory layout. The tests assume that the program runs as a single-threaded static binary with a fixed memory budget on a RISC-V CPU running Linux. Anthropic said the tests comprise about 180 million lines of Rocq, with a typical test containing about 600,000 lines to cover binaries with an average length of 18,000 RISC-V instructions. The company said that, to its knowledge, this is the first large-scale effort to use artificial intelligence to apply formal verification to manufacturing software at the assembly code level.

A subset of the demonstrations, along with the RISC-V and operating system semantics behind them, have been published on GitHub. Anthropic said it is also releasing robust components created for the project that are not already public, complete proofs for fuzz tests that do not require patching, and specifications for fuzz tests that it has not been able to prove, while withholding evidence that could reveal an unpatched bug.

Turn fuzz tests into formal tests

The approach converts each library’s existing compileable fuzz test into a formal specification that encodes a rule: the test never crashes for any input smaller than 64 MB. The specification is defined on RISC-V instructions compiled using Theorem’s formal semantics of the RISC-V instruction set and Linux processes, and the Rocq proof check checks each finite proof against the specification. Anthropic says this leaves only three components that developers need to trust: the formal models of the RISC-V and Linux processes, the exact statements of theorems, and the Rocq control itself.

Anthropic said it has applied this process to hundreds of projects in Google’s OSS-Fuzz initiative, which provides continuous fuzz testing to qualify open source projects and automatically tools C and C++ programs with AddressSanitizer, a tool that crashes a program whenever memory is improperly accessed. An appendix dated October 22, 2026 spells out the entire proven theorem: for all inputs smaller than 64 MiB and all memory layouts, neither the ASan-instrumented binary nor the plain binary fails, hangs, or shows unmodeled behavior, and both produce identical read and write traces, output behavior, and final state of the file system.

The appendix states that Claude wrote approximately one billion lines of Rocq during the effort, of which approximately 180 million lines passed proofread; cJSON’s 391-line parser entry point received a proof of 630,000 lines, while fftw3, with 51,000 lines connected, received a proof of 480,000 lines. Because Claude was allowed to patch code before completing a test, Anthropic said it penalized patches, offered extra credit for demonstrating which inputs were changed in a patch, and logged and audited patches to discourage reward hacking.

Bugs discovered during testing attempts

Anthropic reports that hundreds of bugs have emerged during testing, many of which a fuzzer would be unlikely to find. While testing a library’s entry point, Claude found an underflow counter in a decompressor that caused an out-of-bounds write, but only on inputs of about 20 MB with a rare and specific layout. Other findings included an out-of-bounds read in an image decoder that required 64 MB of input and more than 2 GB of memory, an out-of-bounds read that required a particular sequence of calls on two handles to the same file, and a rediscovery of CVE-2026-56132 in libexpat, which required deeply nested input.

Claude also encountered logic bugs that never crash, including a restriction on what files an application can load that isn’t always enforced. Anthropic said that verification attempts on several widely used critical applications uncovered a previously unknown logic bug that had lain dormant for more than a decade, and that when attempting to verify a widely used PDF reader, it found as many security bugs in a week as are typically reported in a year.

Further efficiency experiments and results

In addition to OSS-Fuzz, Anthropic asked Claude to write a formal specification of RFC 1950, the technical document that defines the zlib compression format, and then to demonstrate that the Linux kernel’s zlib implementation implements it correctly. Claude demonstrated the compiled x86 binary directly, using Claude’s generated formal semantics of the x86 instruction set, and Anthropic said it repeated the process for a half-dozen other widely used libraries, finding minor, non-exploitable bugs that are filed upstream. The company also reported that the generation of x86 semantics identified hundreds of errors in the official reference documentation and a smaller number of bugs in the hardware itself, and that a single pass through the semantics can boot an Ubuntu userspace on a Linux kernel.

In another experiment, Claude built an interpreter for a large subset of Python in Rust and demonstrated, using the Verus verification tool, that it adheres to the CPython semantics outlined in an academic paper. The technical appendix states that all 17 levels of the interpreter have been proven, with the theorem holding that “Whenever the interpreter returns a result, that result is the one prescribed by formal semantics.” Anthropic said that empirical tests on more than 1.7 million randomly generated Python programs found behavior identical to CPython in 99.95% of tests; Of the seven deliberately injected bugs, five survived random testing while all seven passed the test.

To measure efficiency, Anthropic created 36 small test tasks by reducing real OSS-Fuzz entry points, producing programs of 283 to 2,491 instructions with inputs limited to 64 bytes, and AddressSanitizer replaced by a “mini-ASan” runtime of about 100 instructions. Anthropic reports that Opus 5.5 proves half as many tasks with about 40% fewer tokens than Opus 5. Anthropic also reports that agents allowed to copy each other’s trials in a shared workspace need 17% fewer tokens than agents working alone, that some succeeded after previously failing alone, and that agents working alone failed to complete two of the trials. The company said the same reuse effect appeared at scale during the OSS-Fuzz effort, in which agent teams copied finished trials and adapted them because much of each trial covers the shared C runtime and AddressSanitizer initialization code.

Stated limitations and OSS verification program

Anthropic says the trials don’t mean the libraries are bug-free – remaining bugs may be within the trusted components or outside the scope of the trials. The tests involve single-threaded static RISC-V binaries linked to musl libc, while most users run these libraries on x86 or ARM and dynamically link to glibc, and AddressSanitizer does not catch all memory safety bugs. The company said it expects these limitations to become solvable as the models improve.

Theorem offers the same pipeline for qualifying open source projects for free through its OSS Verify program. Registration works via pull request that adds project.yaml, Dockerfile, and build.sh files to the program repository, and Theorem says it reviews projects along similar lines to OSS-Fuzz, prioritizing widely used critical infrastructure. According to the Theorem, maintainers receive a Rocq proof, controlled by the Rocq kernel, that each fuzz target does not block on any input up to 64 MiB; Bugs discovered during the testing effort are disclosed privately to maintainers via email with no disclosure deadline, and testing can take multiple days to produce. Theorem’s roadmap aims to test the entire Nix ecosystem, including critical infrastructure such as glibc, OpenSSL, and cURL.