Science & Tech · Cybersecurity · 3 hrs ago
Claude verification project finds bugs in 123 open-source libraries
Anthropic used Claude with Theorem to check open-source software by proving that parts of its code followed specified rules.
The work covered 239 program entry points in 123 libraries, using mathematical proofs checked by a separate tool.
Traditional tests try selected inputs, while fuzzing tests generate many unusual ones, but neither can cover every possible input.
The process found bugs missed by years of testing, including flaws that could cause unsafe memory access or bypass a file restriction.
These libraries are used in software, so finding defects in them could help improve security for applications that rely on them.
The guarantees are limited to the properties and conditions included in each proof, and the project covered only single-threaded RISC-V programs in a modeled Linux environment.
Anthropic expects better models and reusable proofs to lower verification costs, but no broader rollout or timeline was specified.
Anthropic says its Claude model formally verified security properties in 123 open-source libraries and uncovered hundreds of bugs.
The project was conducted with software verification firm Theorem and used mathematical proofs applied to compiled machine code.
Claude generated proofs for 239 program entry points, which a separate tool called Rocq checked against specifications.
The findings included flaws that had survived years of testing, as well as a logic flaw that could allow an application to bypass a file-loading restriction.
Anthropic cautioned that the proofs cover only specified properties and conditions, and do not establish that the software is entirely bug-free.
- Who
- Anthropic and software verification firm Theorem carried out the project using Claude.
- What
- They formally verified security properties in 123 open-source libraries and found hundreds of bugs.
- When
- Published October 22, 2026. The project’s start date is not stated.
- Where
- The work covered compiled RISC-V assembly code; a geographic location is not stated.
- Why
- The project aimed to prove that code follows specified rules and find defects that routine testing may miss.
This story does not have two clearly opposing sides.
Claude generated proofs for 239 program entry points across 123 libraries.
Rocq checked the proofs against their specifications.
Anthropic allowed Claude to patch them and generate new proofs for the updated code.
- Libraries
- 123 open-source libraries
- Program entry points
- 239
- Proof code
- Roughly 180 million lines
- Proof-checking tool
- Rocq
- Processor architecture
- RISC-V