Anthropic's Quiet Revolution: Claude Performs Formal Verification of Code at an Unprecedented Level
In the world of development, "Formal Verification" has always been considered the holy grail of software security. It is a mathematical process that proves beyond any doubt that code behaves exactly as it is intended, without exceptions or crashes. Until now, this was an expensive, slow, and complex process that required rare expertise. But new research published by Anthropic changes the rules of the game: Claude has managed to generate mathematical proofs for code security for 123 different open-source libraries, and it happened at an unprecedented scale.
What actually happened here?
In collaboration with the company Theorem, Anthropic's Frontier Red Team used Claude models to perform formal verification on compiled code (Assembly) in the RISC-V architecture. The result? A mathematical proof that 239 entry points within 123 popular libraries from OSS-Fuzz will never crash, as long as the input is smaller than 64 megabytes.
This is a significant achievement for several reasons:
- •Scale: This is the first time AI has been used to apply formal verification to production software at this scale.
- •Depth: The proofs were not done on the source code, but on the compiled code (Binary), which ensures there are no bugs created during the compilation process.
- •Bug discovery: While generating the proofs, Claude not only verified the code but also identified and fixed old bugs that had evaded developers' eyes for years Anthropic Research.
Why is this important for developers?
It is important to understand: formal verification is not "magic" that erases all the bugs in the world. It proves that a specific property (in this case – non-crashing under certain conditions) holds under defined working assumptions. This is an especially powerful tool for critical systems, where any crash can lead to a security breach or heavy financial loss.
The big change here is economic and operational. In the past, writing such proofs required months of work by experts. Today, the process is moving to AI-based automation, where developers define the specification and the model does the "grunt work" of writing the proofs. As reported in Unite.AI, this is a change in cost structure: instead of expensive man-hours, we pay in language model tokens.
Is this the future of information security?
The fact that Claude managed to generate about 180 million lines of proof code (in Rocq format) indicates that we are entering an era where formal verification becomes accessible to every significant open-source project. Theorem is already offering this infrastructure to relevant projects, which indicates that this technology is moving from the labs to the field.
The bottom line: We should not expect every piece of code we write to be "mathematically proven" tomorrow morning, but the ability to use AI to verify critical components in a system is a huge leap forward. For developers, this means we will be able to rely on third-party libraries with higher confidence, knowing they have undergone a rigorous check that no human would have had enough patience to perform manually.
This technology is an excellent reminder that AI is not just writing code, but is beginning to understand it at the deepest levels. It is worth following these developments – they are going to change the way we build secure software.