❯ Anthropic and Theorem generate security proofs across 123 open-source libraries

Turning tests into mathematical claimsIn research published October 22, Anthropic described working with Theorem to use Claude to generate security proofs for 239 entry points across 123 open-source libraries. Programs and tests were compiled to RISC-V instructions; Claude wrote proofs and the Rocq proof checker checked them against the specifications.

The guarantees have defined limitsFuzzing searches for crashes by trying inputs. Formal verification seeks to establish that specified failures cannot occur within a defined scope. These proofs assume single-threaded static binaries, a fixed memory budget and modeled Linux behavior, with inputs below 64 MB. They cover specified memory-safety and assertion properties rather than every possible bug in every environment.

An independent checker verifies the resultThe workflow connects a model’s ability to generate large amounts of proof code to an independent checker. Developers still need to trust the specifications, underlying semantics and checker. Reusing those components could concentrate more of the work on defining the exact guarantees required, rather than manually reviewing every line of a generated proof.

▮ SIGNALAI-generated proofs paired with an independent checker make defined software guarantees more accessible and put greater weight on precise specifications.