Claude generates machine-checkable security proofs for 123 libraries
Anthropic and Theorem used Claude to generate formal proofs for selected security properties in 123 open-source libraries. A separate proof checker tests the results against mathematical models of compiled programs. The effort also involved repairing bugs, while its guarantees depend on specific execution conditions, input limits and the correctness of the models used to describe the software.
Artificial Intelligence··Midday
Claude targets selected library security properties
Anthropic has used its Claude models to produce formal proofs of selected security properties across 123 open-source software libraries. The work concerns mathematical guarantees about program behavior, with the company reporting that the project took a few weeks.[1], [2]
The project with Theorem, Anthropic’s collaborator on the verification work, covers 239 entry points in OSS-Fuzz, a software-testing system. It addresses crashes and specified memory-safety failures under defined execution conditions. Some programs needed bug fixes before a proof could be completed; Anthropic says hundreds of bugs were found and patched during the effort.[1]
A separate checker evaluates the generated proofs
Rocq, the proof-checking software used by the project, checks the generated proofs against formal models of RISC-V machine code and Linux process behavior. The analysis assumes single-threaded programs, static linking and the musl software library. It also uses a fixed memory budget and inputs below 64 MB. These assumptions restrict the programs and operating conditions to which the stated guarantees apply.[1]
Coverage stays tied to the specified program model
The guarantee does not extend to every entry point, every memory error or misuse by software calling the library. Errors in the checker, specifications or machine model can affect the result. Anthropic says it is releasing some proofs and formal models, alongside specifications for entry points still awaiting proof. The project also evaluates how its patches change program behavior, since repairing a fault can alter the program being verified.[1]
