AI Proves Code Safety in Weeks

Anthropic announced that its Claude model has mathematically verified the correctness of existing software code. The company partnered with Theorem to automate formal verification, a process that typically requires extensive manual labor from specialists. This effort represents a shift toward using AI to certify that legacy code behaves as intended without constant human oversight.

Historically, proving software is error-free has been prohibitively expensive. Experts required 20 person-years to verify seL4, a small operating system kernel. Consequently, such rigorous checks were usually reserved for critical systems like Airbus avionics. Anthropic and Theorem aimed to reduce this timeline from years to weeks by leveraging AI capabilities.

The team handed proof tasks to Claude, which generated approximately 180 million lines of mathematical proof code over a period of weeks. The model drew from test programs associated with 123 open-source libraries in Google's OSS-Fuzz project. Claude did not write new software; instead, it converted crash tests into mathematical problems and analyzed compiled machine code to construct these proofs.

A separate tool named Rocq automatically checks the generated proofs, minimizing the need for human reviewers. The researchers described the proof generation process as fully autonomous, though they noted that the underlying tools and formal foundations were built by humans at Theorem. During this work, Claude encountered hundreds of bugs and was allowed to fix them.

Many of these flaws likely would have escaped conventional testing because they appear only under narrow conditions, such as unusually large input files. In one instance, the team found as many security bugs in a widely used PDF reader in one week as are typically reported in a full year. In another application, Claude identified a logical error that had remained unnoticed for more than a decade.

Anthropic cautions that formal verification does not mean the software is completely error-free. The proofs hold only under specific conditions, including a particular processor architecture, single-threaded programs, and inputs smaller than 64 MB. Real-world deployments often run on different hardware, meaning these guarantees have limits.

The project consumes hundreds of millions of tokens per proof, and Anthropic has not published total costs. However, a smaller test run showed that Opus 5.5 solves half the proofs using about 40 percent fewer tokens than Opus 5. Theorem's roadmap now targets critical infrastructure libraries, including glibc, OpenSSL, and cURL.