{"version":1,"type":"story","url":"https://digestai.news/story/claude-proves-security-properties-for-123-open-source-libraries-using","json":"https://digestai.news/story/claude-proves-security-properties-for-123-open-source-libraries-using.json","markdown":"https://digestai.news/story/claude-proves-security-properties-for-123-open-source-libraries-using.md","slug":"claude-proves-security-properties-for-123-open-source-libraries-using","headline":"Claude proves security properties for 123 open-source libraries using RISC‑V verification","summary":"The authors report that, in collaboration with Theorem, Claude was used to generate formal proofs for 123 open‑source libraries compiled to RISC‑V binaries. Over 239 entry points from Google’s OSS‑Fuzz initiative were proved never to crash for any input under 64 MB, and the process uncovered several long‑standing bugs, including an out‑of‑bounds write that required a 20 MB input and a rediscovered CVE‑2026‑56132.\n\nThe proofs total about 180 million lines of Rocq code, with a typical proof around 600 k lines covering binaries of median length 18 k RISC‑V instructions. The authors note that agents sharing proofs needed 17 % fewer tokens, and that Opus 5.5 required about 40 % fewer tokens than Opus 5 on 36 small verification tasks. They also measured 1.7 million randomly generated Python programs against a Rust interpreter and found 99.95 % behavioral agreement.\n\nThe paper concludes that as LLMs become more capable, formal verification could become as routine as fuzz testing for production software, provided the underlying machine models are refined.","keyPoints":["Claude generated about 180 million lines of Rocq proofs, with typical proofs around 600 k lines for libraries of median 18 k RISC‑V instructions.","The pipeline proved 239 entry points across 123 OSS‑Fuzz libraries never crash for inputs under 64 MB, uncovering several long‑standing bugs.","Agents sharing proofs used 17 % fewer tokens, and Opus 5.5 needed about 40 % fewer tokens than Opus 5 on 36 verification tasks."],"whyItMatters":"Scaling formal verification with LLMs could make provable security guarantees practical for everyday software, reducing reliance on costly manual proofs and improving bug detection.","category":{"slug":"research","name":"Research","url":"https://digestai.news/category/research"},"entities":{"companies":["Theorem","Google"],"models":["Claude"],"people":["Keane Lucas","Aengus Lynch","Luna Tong","Luke Champine","Zygi Straznickas","Dino Distefano"]},"firstPublishedAt":"2026-10-22T22:54:43Z","updatedAt":"2026-10-22T22:54:43Z","sourceCount":1,"hasPrimarySource":true,"sources":[{"outlet":"anthropic.com","title":"LLMs are making formal software verification feasible at a much larger scale","url":"https://anthropic.com/research/formal-verification","publishedAt":"2026-10-22T22:54:43Z","type":"primary","primary":true,"lead":true}],"sourceNotes":null,"discussions":[{"site":"Hacker News","url":"https://news.ycombinator.com/item?id=50202217","points":41}],"thread":null,"cite":{"text":"Digest AI, \"Claude proves security properties for 123 open-source libraries using RISC‑V verification\", 22 October 2026, https://digestai.news/story/claude-proves-security-properties-for-123-open-source-libraries-using","publisher":"Digest AI","title":"Claude proves security properties for 123 open-source libraries using RISC‑V verification","datePublished":"2026-10-22T22:54:43Z","url":"https://digestai.news/story/claude-proves-security-properties-for-123-open-source-libraries-using"},"generatedBy":"Written by Digest AI's editorial model from the linked sources; the sources are the record.","license":"Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse"}