Anthropic's Frontier Red Team reported on October 22, 2026 that, working with the verification company Theorem, it used Claude to prove security properties of compiled code in 123 open-source libraries covering 239 entry points. According to Anthropic's write-up, the proofs total about 180 million lines of Rocq, and the effort surfaced hundreds of bugs, several in code that fuzzers had run for trillions of test executions.
AnthropicFormal verification has long been prized and rarely affordable. The notable part of this report is therefore less the bug count than the economics it describes, and the careful list of what the proofs do not cover.
What was proved
Claude proved properties at the RISC-V assembly level: that each program exits normally, with no memory-safety errors or failed assertions, for all inputs under 64 MB. The specifications came from OSS-Fuzz fuzz tests, with each test converted into a specification the compiled binary must satisfy. The median binary was 18,000 RISC-V instructions, and the work took, in Anthropic's words, "a few weeks."
Proving at the binary level matters because it removes the compiler from the list of things to trust: the claim is about the machine code that actually runs, not the source it came from.
What it found
When a proof attempt failed, Claude patched the bug, which regenerated the specification, and then proved the new specification. Anthropic gives examples:
| Finding | Trigger |
|---|---|
| Counter underflow in a decompressor's copy, causing an out-of-bounds write | Roughly 20 MB input with one rare layout |
| Out-of-bounds read in an image decoder | A 64 MB input and over 2 GB of memory |
| Out-of-bounds read in another library | A specific call sequence across two handles to the same file |
| Rediscovery of CVE-2026-56132 in libexpat | Deeply nested input |
| File-loading restriction not always enforced | A logic bug rather than a crash |
The input sizes explain why fuzzers missed them. A fuzzer capped near 1 MB cannot reach a bug that needs a 20 MB or 64 MB input, which is an argument about search space, not about fuzzers being weak.
The cost picture
Relative token use, baseline indexed to 100
Our indexing of two reported reductions: Opus 5.5 used about 40% fewer tokens than Opus 5 on 36 verification tasks, and agents sharing a workspace used 17% fewer tokens than solo agents.
Source: Anthropic Frontier Red Team, 'Formal verification', October 22, 2026. Index values are our arithmetic from the reported percentages.
Anthropic reports that proofs can still take hundreds of millions of tokens. On 36 small verification tasks drawn from OSS-Fuzz, Opus 5.5 proved half using about 40% fewer tokens than Opus 5, under a benchmark of three independent single-agent attempts with a 5 million token budget each. Agents sharing a workspace used 17% fewer tokens than solo agents and sometimes succeeded where solo attempts failed: solo agents were costlier in 30 of 34 completed proofs and failed to complete two.
For perspective, Anthropic cites the seL4 microkernel, which took about 2 person-years to implement and about 20 person-years to verify. It also notes that Mathlib in Lean has nearly 300,000 theorems from over 700 contributors. Those are reference points for scale, not like-for-like comparisons with a single model run.
Reuse is a second lever: much of each proof covers shared runtime code such as C runtime initialization and AddressSanitizer, so teams of agents copied and adapted finished proofs across programs.
Analysis: three shifts to watch
- Verification cost is now measured in tokens. The binding constraint moves from scarce expert hours toward compute budgets, which changes who can afford it.
- Specifications become the product. Because the proof is only as good as the property it proves, the risk concentrates in the specification and the models of the CPU and operating system.
- Anti-cheating design matters. Anthropic flags reward hacking: Claude could make a theorem provable by trivially changing the program. Patches were penalized, rewarded when their affected inputs were proven and minimized, and logged and audited.
Formally verified does not mean bug-free.
Our summary of Anthropic's stated caveat
What the proofs do not cover
Anthropic lists the limits explicitly, and they are essential to reading the headline:
- The proofs cover single-threaded static musl binaries on RISC-V, while most users run dynamically linked glibc builds on x86 or ARM.
- Remaining risk sits in the specification, the RISC-V and Linux models and the Rocq checker, which relies on the hardware and the OCaml compiler.
- AddressSanitizer does not catch all memory-safety bugs.
- Not all entry points were verified, and dead code and caller misuse are outside the proofs.
- The 64 MB bound is a parameter; changing it requires little human effort but Claude must then reprove the specification.
Beyond the headline: other case studies in the report
Anthropic also reports proving the Linux kernel's zlib correct at the x86 binary level from a specification written from RFC 1950, a Python interpreter written in Rust and checked with Verus that matched CPython behavior in 99.95% of 1.7 million randomly generated programs, and a PDF reader where it found as many security bugs in one week as are typically reported in a year. Claude also generated the instruction set formal semantics autonomously, which identified hundreds of errors in reference documentation.
Released artifacts
Anthropic released a subset of the proofs, the RISC-V and Linux process semantics, and a Claude skill for verifying other projects. Proofs that might reveal unpatched bugs are withheld, a standard coordinated-disclosure posture.
What it means for software teams
The report suggests a ladder: fuzzing finds crashes cheaply, formal proof bounds what remains, and models are now being used to climb from the first to the second. Teams comparing AI coding tools can reasonably test several models on their own verification or review tasks, since the report itself shows meaningful differences between model generations. Platforms that offer more than one model, such as Metir, make that comparison routine.
What to watch
- Independent reuse. Whether outside teams apply the released Claude skill to their projects.
- Wider platform coverage. Extending beyond static single-threaded RISC-V binaries to the builds most users run.
- Token cost trajectory. Whether future models cut the hundreds of millions of tokens per proof.
Sources:
Image credits
- Hero and in-body photo: lobby of Anthropic's San Francisco office during the October 2024 visit of UK Secretary of State Peter Kyle, by Alecsandra Dragoi / DSIT, via Wikimedia Commons, licensed CC BY 2.0. Illustrative only; reviewed visually.