AI Proves Code Safety in Weeks, Not Years

Software verification has long been a luxury reserved for high-stakes environments like aircraft avionics, where the cost of a single bug is catastrophic. Now, that expensive process is becoming significantly faster and more accessible through a new AI-driven method.

Anthropic, in partnership with Theorem, has demonstrated that its Claude model can automatically generate formal proofs for existing software. The system did not just write new code; it mathematically verified that established code functions correctly under specific conditions. This approach addresses a major hurdle in AI-generated software, which is the lack of guaranteed correctness.

The scale of the effort was substantial. In a matter of weeks, Claude produced approximately 180 million lines of proof code. These proofs were applied to 123 open-source libraries sourced from Google's OSS-Fuzz security project. The model worked by translating standard crash tests into mathematical problems and analyzing the compiled machine code to build a case for correctness.

The process is described as fully autonomous, though it relies on human-built formal foundations. Once Claude generates a proof, an independent verification program called Rocq automatically checks it. According to Anthropic, this step requires almost no human review. This automation marks a shift from manual inspection to machine-verified logic, potentially reducing the time and cost associated with ensuring software reliability.

A significant benefit emerged during the verification process: the discovery of numerous bugs that conventional testing had failed to catch. Claude identified hundreds of issues that only appear under specific, rare conditions, such as unusually large input files or specific access sequences. In one notable instance, the team verified a widely used PDF reader and found as many security bugs in a single week as are typically reported in an entire year.

The model also uncovered a logical error in another application that had gone undetected for over a decade. Anthropic notes that even when a complete proof is not achieved, the attempt itself often surfaces real bugs. This suggests that formal verification can serve as a powerful debugging tool, not just a certification of safety.

However, the term formally verified does not mean error-free in all contexts. The proofs hold only under strict conditions, including a specific processor architecture, single-threaded execution, and inputs under 64 MB. Since these libraries often run on diverse hardware and configurations, the real-world applicability is currently limited to these defined parameters. Developers must still account for these constraints when deploying the verified code.

The computational cost remains a consideration. Individual proofs can consume hundreds of millions of tokens, and Anthropic has not disclosed the total project cost. That said, the approach shows efficiency gains with newer models. Opus 5.5, for example, solves half the proofs using about 40 percent fewer tokens than its predecessor, Opus 5. This trend toward efficiency could make the process more viable for broader use.

This project strengthens the argument for deeper software automation. If AI can both write code and prove its safety, the focus of development shifts from mere generation to guaranteed correctness. Anthropic believes that formal verification with AI will soon become as routine as standard testing. Theorem is already targeting critical infrastructure components like glibc, OpenSSL, and cURL for similar treatment.