Formal verification has long been the kale of software engineering: everyone agrees it's good for you, and almost nobody actually eats it. Writing mathematical proofs that code behaves correctly is so laborious that it has mostly been reserved for aircraft, chips and the occasional heroic PhD. This week, an AI model ate an entire salad bar.

180 Million Lines of Proof, Hold the Crashes

In research published October 22, Anthropic's Frontier Red Team and the verification company Theorem used Claude to prove security properties for 239 fuzz-test entry points across 123 open-source libraries from Google's OSS-Fuzz project. The proofs show those programs don't crash, meaning no memory-safety errors or failed assertions, for any input under 64 MB, checked at the RISC-V assembly level. They're written in the Rocq proof assistant and total roughly 180 million lines, with a typical proof running about 600,000 lines.

The bug hunting was the side dish that stole the show. Along the way, Claude found and patched hundreds of bugs, including a counter underflow in a decompressor, an out-of-bounds read in an image decoder and a rediscovered libexpat vulnerability. Separately, Claude proved that the Linux kernel's zlib implementation matches its RFC spec.

"Verified" Still Doesn't Mean "Bug-Free"

Credit where it's due: the write-up is refreshingly upfront about its limits. The proofs assume static musl binaries on RISC-V, while most of the world runs dynamically linked glibc on x86 or ARM, and bugs can still hide in the spec, the machine model or the proof checker. The team also had to guard against the AI "winning" by rewriting code so it simply never crashes, penalizing and auditing patches to discourage that. And proofs can still burn hundreds of millions of tokens, so this isn't free.

The real takeaway for anyone running software they didn't write, which is everyone, is the trajectory. This same week, AI-assisted research helped surface critical PHP flaws that sent the web scrambling. The tools that find bugs and the tools that prove their absence are improving at the same time, and defenders who adopt them early get the advantage. Open-source dependencies, long the soft underbelly of every web stack, may finally be getting a security audit at scale.

Mathematical certainty used to be a luxury good. It's quietly becoming a commodity, and attackers should be nervous.

Proofs at this scale only cover the libraries someone chose to verify; for everything else in your dependency tree, our free developer's guide to defending against supply-chain attacks is a practical place to start.

Source: Anthropic