Anthropic claims Claude can verify existing software code in weeks

Anthropic has announced that its Claude large language model successfully performed mathematical proofs to verify that existing software code functions correctly. This development marks a shift in how artificial intelligence is applied to software engineering, moving from code generation to code validation. The company presents this work as a critical step toward making AI-generated software more trustworthy for developers and end users.

The core of the effort involves formal verification, a rigorous method of proving that software runs without error in all possible scenarios. Historically, this process has been incredibly expensive and time-consuming. For example, specialists required twenty person-years to verify seL4, a small operating system kernel. Due to these high costs, the technique was largely reserved for critical systems like Airbus avionics. Anthropic, however, suggests that AI can dramatically reduce this burden.

To execute this task, Anthropic's Frontier Red Team collaborated with a partner named Theorem. They tasked Claude with generating proofs for existing code rather than writing new applications. In a matter of weeks, the model produced approximately 180 million lines of mathematical proof code. The work drew on test programs from 123 open-source libraries within Google's OSS-Fuzz security project. Claude analyzed compiled machine code and converted crash tests into mathematical problems to construct these extensive proofs.

A separate verification program called Rocq automatically checks the proofs generated by Claude. Anthropic states that this process requires almost no human reviewers. The researchers describe the proof generation as fully autonomous, although they clarify that the underlying tools and formal foundations were built by humans at Theorem. This division of labor highlights the current state of AI autonomy in complex technical tasks.

During the verification process, Claude encountered hundreds of bugs and was permitted to fix them. The researchers note that many of these issues would likely have escaped conventional testing because they only appear under narrow conditions, such as unusually large input files or specific sequences of accesses. In one notable instance, the team found as many security bugs in a widely used PDF reader in a single week as are typically reported in a full year. In another application, the model identified a logical error that had gone unnoticed for over a decade.

Despite these successes, the company is careful to define the scope of its achievements. Anthropic emphasizes that formally verified does not mean error-free. The proofs hold only under specific conditions, including a particular processor architecture, single-threaded programs, and inputs smaller than 64 MB. Real-world deployments often run on different hardware and configurations, which means the verification may not apply to every scenario.

Cost remains a significant constraint for this approach. Individual proofs consume hundreds of millions of tokens, and Anthropic has not yet published the total project costs. However, the company argues that if AI can verify its own code, developers can trust AI-generated software more and spend less time on manual review. A smaller test run indicated that proofs can be reused and that efficiency is improving, with newer model versions solving problems using fewer tokens.

The project shifts the industry question from whether AI can program to whether it can prove its code is safe. Anthropic expects formal verification with AI to become as practical as standard testing. Theorem's roadmap already targets critical infrastructure components, including glibc, OpenSSL, and cURL, suggesting a broader push to secure the backbone of modern software systems.