Anthropic says it partnered with Theorem to use Claude to formally prove useful security properties at the assembly code level across 123 open-source libraries
Introduction — Even mature, heavily tested software contains bugs, and LLMs are increasingly adept at finding them.
Anthropic
Context & Ripple Effects
Anthropic had already positioned Claude in software assurance: it said Opus 4.6 found more than 500 previously unknown high-severity flaws in open-source libraries, while Mythos Preview was being offered to organizations maintaining critical software. The collaboration with Theorem advances that work from identifying possible defects to producing formal evidence about compiled code.
The result also follows Claude's largely autonomous formalization of Fermat's Last Theorem in Lean. Applying comparable proof-generation capability to open-source libraries makes formal methods relevant to code maintainers rather than solely to mathematical or research workflows.
First-order effects
Theorem and Anthropic have produced assembly-level proofs for security properties across more than 100 open-source libraries, giving affected maintainers an artifact stronger than a conventional vulnerability report for the properties covered.
Claude's security role expands from finding suspected flaws to generating formal verification work that can be checked against compiled software behavior.
Second-order effects
Organizations in Anthropic's critical-software cohort will have a reason to evaluate proof-producing workflows alongside vulnerability scanning, especially where a finding alone is difficult to validate or prioritize.
Security-tool vendors competing with Claude Security and Theorem face pressure to show not only detection coverage but also verifiable evidence for the claims their tools make.
Third-order effects
If proof generation can be reproduced across broader codebases, software assurance may shift toward [[a:proof-carrying-discovery|proof-carrying discovery]], where automated findings arrive with evidence that reduces human verification work.
The durable constraint becomes the trusted-tool boundary: maintainers and buyers will need to distinguish which security properties were formally proved from those merely inferred by a model.
The trend: AI security tooling is moving from high-volume bug discovery toward formal, checkable assurances about software behavior.
This week: two PHP bugs put the internet in lockdown. Today: Claude proved security properties in 100+ open-source libraries in a few weeks. Someone point it at PHP. 🙃
How to find ALL PHP bugs: 1. Compile code (e.g. to RISC-V, x86, LLVM IR) 2. Vibe prove ASAN and non-ASAN versions have same behavior across all inputs. Hard, but Claude can do it! 3. Find a LOT of bugs Super proud of our work. A big step towards finding ALL memory safety bugs
Formal verification with private open weight models - cheap and avoids gets your code to be uploaded to Anthropic. Results are comparable using @near_ai harness at fraction of the cost.
step 1: find and fix all the bugs step 2: rewrite the foundations of software to not have bugs in the first place Proud of this work from @keenlooks and @theoremlabs and team. This is a glimpse of the direction we're going.
At this point, if you're in software and aren't currently working on a plan for moving to formal verification, it's irresponsible. The writing is on the wall. This needs to be your priority now.
Absolutely wild results in the details: - Claude built and formally verified a Python interpreter - Claude wrote ~1Bn lines of Rocq - Claude built an x86 semantics that can boot Ubuntu
New on our Frontier Red Team blog: using Claude to formally verify software at large scale. Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time). With AI models, however,…
the holy grail is formal verification for all code currently code has tests (a lossy proxy for the behavior of the code) in reality, code should be more like math. in order for code to flourish, we need ways to formally verify any program
We formally verified 123 open-source projects in a partnership with Anthropic. Formal verification at scale is here! Now we're launching OSS Verify to scale it to the software we all depend on. We prove it's crash-free or send you the patches it needs. Free for open-source. Let's…
Good timing for this blog post. We needed a win. Formal verification is a big part of why cyber is defense-dominant long term. It's not a panacea, but a formally verified program is way more robust than one that's vibe-tested. Frontier LLMs are now capable enough to generate subs…
Translation: Fable 5.5 is apparently such an absolute MONSTER that it can finish in HOURS what would take human experts YEARS, check its own work, fix its mistakes, and hand you almost bug-free code. And Anthropic somehow made this sound like just another Thursday update.
Brilliant work from my colleagues on FRT and Theorem on using Claude to scale formal verification methods on real world software https://www.anthropic.com/...
We're in the middle of watching a seismic shift towards verification in software engineering - I gander that in the next 5 years 95% of serious software …
*It's as if the Grammar Police had invented a Newspeak with an accurate, fully-provable grammar, and if everybody in the world didn't promptly learn to write that way, they would all be attacked and robbed by the new Grammar Criminals — www.anthropic.com/research/for...