Anthropic Proved 123 Open-Source Libraries Safe — and Found Bugs Tests Missed
Anthropic says it has used its Claude model to mathematically prove security properties in 123 open-source software libraries, and in the process found bugs that had survived years of automated testing.
The work, done with a partner called Theorem, applied formal verification—a technique that translates code into a mathematical model and proves it obeys security rules—to real production software at a scale previously considered impractical. Anthropic says this is the first large-scale effort to use AI for formal verification of production code at the assembly level, the instructions a computer actually executes.
The practical result: Claude proved that 239 fuzz-test entry points across 123 libraries in Google's OSS-Fuzz program will never crash for any input under 64 megabytes, under certain assumptions about how the program runs. While attempting those proofs, Claude found and patched hundreds of bugs. Some were the kind a fuzzer would almost never catch—one required an input of around 20 megabytes with a rare, specific layout; another needed a 64-megabyte input and more than 2 gigabytes of memory. Claude also rediscovered a known vulnerability in libexpat and found a logic bug in a widely used PDF reader that had been latent for more than a decade.
The catch is cost. The proofs ran to about 180 million lines of verification code, with a typical proof around 600,000 lines for a binary of 18,000 instructions. Anthropic says newer models are getting more efficient—its Opus 5.5 model proved half of a 36-task benchmark using about 40% fewer tokens than its predecessor—and that letting agents reuse each other's proofs cut token use by 17%. The company is publishing a subset of the proofs and the underlying system models for independent verification.
For software buyers and operators, the significance is directional rather than immediate. Formal verification has historically been reserved for mission-critical systems like Airbus avionics, where it took 20 person-years to verify an operating system kernel that took two person-years to build. Anthropic's claim is that AI is pushing that cost down fast enough to make proof-based security a routine part of software development, not a bespoke luxury.