Anthropic deploys Claude to verify 180 million lines of software proof code

Anthropic has utilized its Claude model to mathematically prove the correct behavior of existing software code, a task that traditionally requires significant specialized effort. The model generated approximately 180 million lines of mathematical proof code in a matter of weeks. This work represents a step toward making AI-generated software more trustworthy, although the company has outlined strict limits on what these proofs actually guarantee.

Formal verification involves proving that software runs without error in all circumstances. This practice has historically been prohibitively expensive. For example, specialists required 20 person-years to verify seL4, a small operating system kernel. Consequently, the technique has largely been confined to extreme cases such as Airbus avionics software where reliability is paramount.

Anthropic's Frontier Red Team collaborated with a partner named Theorem to assign the proof work to Claude. The model drew on test programs from 123 open-source libraries in Google's OSS-Fuzz security project. It is important to note that Claude did not write new software. Instead, it verified existing code by converting crash tests into mathematical problems and analyzing the compiled machine code.

The process involved constructing extensive proofs that are automatically checked by a separate verification program called Rocq. Anthropic states that the process requires almost no human reviewers. The researchers describe the proof generation as fully autonomous, while noting that the underlying tools and formal foundations were built by humans at Theorem.

During the verification process, Claude encountered hundreds of bugs and was permitted to fix them. The researchers indicated that many of these issues would likely have escaped conventional testing. These bugs often appear only under narrow conditions, such as unusually large input files or a specific sequence of accesses. In an effort to verify a widely used PDF reader, the team found as many security bugs in one week as are usually reported for that software in a full year.

In another application, Claude identified a logical error that had gone unnoticed for more than a decade. Anthropic adds that even when a complete proof fails, the attempt can still reveal real bugs. This suggests that the verification process has value beyond simply confirming the correctness of the code.

The company is careful to note that formally verified does not mean error-free. The proofs hold only under defined conditions. These include a particular processor architecture, single-threaded programs and inputs smaller than 64 MB. Real-world deployments of these libraries often run on different hardware and configurations, which may not align with these specific constraints.

Cost is another significant constraint for this approach. Individual proofs consume hundreds of millions of tokens, and Anthropic has not published total project costs. Despite this, the company argues that if AI can verify its own code, developers could trust AI-generated software more. This would allow them to spend less time reviewing it, potentially cutting costs across the coding process.

A smaller test run indicated that proofs can be reused, and efficiency is improving. Opus 5.5 solves half the proofs using about 40 percent fewer tokens than Opus 5. The project shifts the focus from whether AI can program to whether it can prove the code it writes is safe. Anthropic expects formal verification with AI to become as practical as standard testing, and Theorem's roadmap already targets critical infrastructure including glibc, OpenSSL and cURL.