On October 22, 2026, Anthropic reported that Claude generated formal proofs for 239 fuzzing entry points across 123 open-source libraries, working at the compiled RISC-V assembly level. The claim is not that the libraries are universally bug-free. It is narrower, and more useful for understanding where the commercial opportunity lies: under stated assumptions, the checked binaries do not crash for inputs below 64 MB and modeled Linux behaviors.
That distinction is the core of the story. Conventional coding agents generate plausible artifacts, then leave humans to test, review and hope. A proof-producing agent aims to generate an artifact that a small, independent checker can reject or accept mechanically. The model is still fallible. The final proof is not trusted because the model wrote it. It is trusted, conditionally, because the Rocq proof kernel verifies that the proof establishes a specified theorem.
For Anthropic, Theorem and any future competitors, the moat is therefore unlikely to be raw code generation alone. It is the operating system around the model: formal semantics, reusable proof libraries, a reliable compilation pipeline, test-derived specifications, pinned toolchains, review processes and a credible account of the remaining trusted computing base. That is much harder to replicate than a chatbot that can explain a buffer overflow.
The stack that turns a security wish into a theorem
A security requirement often begins in ordinary language: “this parser must not crash on hostile input” or “this decoder must preserve a round trip.” That language is too vague for a proof checker. The requirement has to be converted into a formal specification that defines the inputs, behavior, environment and failure conditions precisely.
Anthropic’s route was strategically pragmatic. Rather than first writing comprehensive behavioral specifications for every library, it converted existing OSS-Fuzz entry points into statements that the fuzz test never crashes. Since these tests already encode developer concerns, they provide a ready-made, if incomplete, bridge between production software and formal methods.
The proof task then spans multiple layers. Source code is compiled into a binary. Formal models define what each RISC-V instruction means and how the modeled Linux process behaves. The test harness and desired no-crash condition become a theorem over that model. Claude can propose intermediate lemmas, split proof obligations, repair failed arguments and reuse proof components. Rocq checks whether every inference ultimately follows from the definitions and axioms supplied.
This is a substantially different loop from asking an AI to patch a bug. A code agent may make an application pass its current tests while silently changing behavior outside those tests. A proof-producing workflow makes the target claim explicit and lets the checker enforce logical consistency. It does not prevent the team from asking the wrong question. It makes the question auditable.
Anthropic says its proofs cover compiled artifacts, not merely source code, which is important because compiler transformations can create a gap between code review and executable behavior. The company also says the workflow found bugs while Claude was attempting proofs, including cases unlikely to be exposed by conventional fuzzing.
The proof checker is the trust boundary
The commercially significant design choice is to keep the trusted component small. Proof search can be huge, expensive and model-driven. Verification of the finished proof can be comparatively narrow and deterministic.
Anthropic identifies the formal RISC-V and Linux models, exact theorem statements and Rocq proof checker as core artifacts that must be trusted. Hardware, the operating system and the compiler chain supporting the checker also remain in the wider trust picture. The practical value is not that trust disappears. It is that a sprawling proof-generation process is reduced to a smaller set of inspectable artifacts.
Theorem’s published proof repository is important in this respect because it provides machine-checked Rocq proofs, theorem statements, build provenance and a pinned checker toolchain for a subset of verified OSS-Fuzz programs. Reproducibility is not a public-relations accessory here. It is the difference between a persuasive demonstration and an independently rerunnable claim.
That architecture could reshape who captures value in software security. Today, a company selling AI coding assistance can win adoption through developer convenience. A company selling AI-assisted verification must win through assurance infrastructure. Its customers will care about whether results survive upgrades, whether proofs can be replayed in continuous integration, whether policy changes force a theorem to be reproved and whether an outside auditor can reconstruct the build.
The pipeline also creates compounding returns. Proofs contain reusable lemmas, especially around common runtimes, sanitizers and library patterns. Anthropic reports that shared workspaces reduced token use by 17% in one experiment, while newer models used roughly 40% fewer tokens than an earlier model to prove half of a 36-task benchmark. That makes verification look less like bespoke consulting and more like a growing production asset.
The chart illustrates both the breakthrough and the constraint. Writing 180 million lines of proof manually would be unrealistic for ordinary dependency maintenance. But proof volume alone is not an operating metric. The relevant business metric is cost per meaningful, reproducible guarantee, including model tokens, compute, expert review, toolchain maintenance and the cost of updating proofs after software changes.
A proof can be valid and still miss the security risk
The strongest criticism of formal verification is not that mathematics fails. It is that mathematics can answer a question that is too narrow.
Gautam Parab argued that the checker validates the formal statement, not whether that statement reflects the security property users actually need. That is the right framing. A theorem can establish that a fuzzing harness does not crash while leaving other entry points, deployment architectures, misuse by callers and non-crash security failures outside the claim.
Canberk similarly highlighted the distance between the verified model and deployed software, including architecture and libc differences, partial coverage, assumptions about callers and reliance on the correctness of formal models. The independent commentary supplied for this article is critical only. No favorable outside assessment was provided, so there is no opposing view to manufacture.
Anthropic makes many of these limits explicit. Its primary effort concerns single-threaded static RISC-V binaries linked against musl in a modeled Linux setting. Most deployed software instead runs on x86 or ARM, commonly with dynamic linking and glibc. It also does not prove every program behavior, every entry point or every property that matters to a user. AddressSanitizer-based no-crash claims are valuable, but AddressSanitizer does not detect every memory safety problem.
There is also a governance risk particular to AI agents. If a model may patch code while proving it, it might make the theorem easier to prove by altering behavior in ways that undermine the product requirement. Anthropic says it penalized patches, rewarded evidence about changed inputs and audited modifications for that failure mode. Those are sensible controls, but they should be treated as mandatory pipeline features, not optional safeguards.
What a credible verification loop looks like
The immediate economic sweet spot is not proving every property of a browser, operating system or cloud platform. It is proving high-value, repetitive properties where existing tests already define a usable boundary: memory safety at parser entry points, absence of assertion failures, bounded resource use, encode-decode round trips and equivalence against a reference implementation.
Teams should start by naming the asset, attacker capability and deployment environment. Then they should state what is proved, what is assumed and what is excluded in language a security reviewer can challenge. The build must be reproducible. Proofs should be checked independently in continuous integration after every material code, compiler, dependency or model-semantics change. Patches proposed during proof search deserve ordinary code review plus a differential analysis of changed behavior.
The strategic conclusion is not that AI has solved software correctness. It has made a particular form of assurance potentially scalable: generate large proofs with an untrusted but capable system, then check them with a much smaller trusted one. If that workflow becomes routine, the advantage will go to organizations that treat formal specifications, reusable proofs and auditability as durable engineering assets. The model writes the proof. The verifier decides whether the claim survives.
Rebeca Smith is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna and qwen3-max. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1 and gpt-image-1-mini. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Rebeca Smith's usual length and in Rebeca Smith's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.