Anthropic and Theorem Automate Formal Verification of 123 Libraries

180 million lines of mathematical proof code were generated in just a few weeks by a new system developed by Anthropic and its partner Theorem. This volume of output represents a significant shift in how software correctness is evaluated, moving away from traditional human-led testing toward automated, mathematical verification. The project focused on verifying existing open-source libraries rather than writing new applications from scratch.

The core innovation allows the Claude model to analyze compiled machine code and translate crash tests into solvable mathematical problems. Instead of relying on manual code reviews, the system produces extensive proofs that are then checked by an independent verification program called Rocq. Anthropic describes this workflow as fully autonomous, meaning it requires very little human intervention to complete the proof generation and validation cycle.

This approach addresses a long-standing challenge in the software industry. Historically, formal verification was too expensive for most projects. For example, a team of specialists required 20 person-years to verify the small operating system kernel seL4. Consequently, the method was largely reserved for critical systems like avionics software. By using AI to handle the heavy lifting, Anthropic aims to make this rigorous process routine for a wider range of software.

The project drew on test programs from 123 open-source libraries within Google's OSS-Fuzz security project. As Claude worked through these libraries, it identified hundreds of bugs that conventional testing methods had missed. Many of these errors only appear under specific conditions, such as unusually large input files or particular sequences of data access, making them difficult to detect through standard testing protocols.

One notable example involved a widely used PDF reader. The team found as many security bugs in a single week as are typically reported for that software over an entire year. In another case, the system caught a logical error that had remained undetected for more than a decade. Anthropic notes that even when a complete proof fails, the attempt often surfaces these real-world defects.

However, there are important limitations to this method. Anthropic clarifies that formally verified does not mean error-free. The proofs only hold under strict conditions, including a specific processor architecture, single-threaded programs, and inputs under 64 MB. In practice, these libraries often run on different hardware and configurations, which means the verification covers a defined subset of possible scenarios rather than every potential use case.

The computational cost is also substantial. Individual proofs can require hundreds of millions of tokens to process. While Anthropic has not reported the total project costs, the efficiency of newer models is improving. For instance, Opus 5.5 solves half the proofs with about 40 percent fewer tokens than its predecessor, Opus 5. This efficiency gain suggests that the method may become more economically viable over time.

The broader implication is a shift in how developers trust AI-generated software. If AI can write code and also prove its correctness under defined conditions, the focus moves from questioning AI's ability to program to assessing its ability to guarantee safety. Anthropic expects this form of verification to become as standard as regular testing, with future work targeting critical infrastructure libraries such as glibc, OpenSSL, and cURL.