# Claude proves security properties for 123 open-source libraries using RISC‑V verification

Digest AI · Research · published 2026-10-22T22:54:43Z

Canonical: https://digestai.news/story/claude-proves-security-properties-for-123-open-source-libraries-using

## Summary

The authors report that, in collaboration with Theorem, Claude was used to generate formal proofs for 123 open‑source libraries compiled to RISC‑V binaries. Over 239 entry points from Google’s OSS‑Fuzz initiative were proved never to crash for any input under 64 MB, and the process uncovered several long‑standing bugs, including an out‑of‑bounds write that required a 20 MB input and a rediscovered CVE‑2026‑56132.

The proofs total about 180 million lines of Rocq code, with a typical proof around 600 k lines covering binaries of median length 18 k RISC‑V instructions. The authors note that agents sharing proofs needed 17 % fewer tokens, and that Opus 5.5 required about 40 % fewer tokens than Opus 5 on 36 small verification tasks. They also measured 1.7 million randomly generated Python programs against a Rust interpreter and found 99.95 % behavioral agreement.

The paper concludes that as LLMs become more capable, formal verification could become as routine as fuzz testing for production software, provided the underlying machine models are refined.

## Key points

- Claude generated about 180 million lines of Rocq proofs, with typical proofs around 600 k lines for libraries of median 18 k RISC‑V instructions.
- The pipeline proved 239 entry points across 123 OSS‑Fuzz libraries never crash for inputs under 64 MB, uncovering several long‑standing bugs.
- Agents sharing proofs used 17 % fewer tokens, and Opus 5.5 needed about 40 % fewer tokens than Opus 5 on 36 verification tasks.

## Why it matters

Scaling formal verification with LLMs could make provable security guarantees practical for everyday software, reducing reliance on costly manual proofs and improving bug detection.

## Sources

1. [LLMs are making formal software verification feasible at a much larger scale](https://anthropic.com/research/formal-verification) (anthropic.com, 2026-10-22, primary source)

## Cite

Digest AI, "Claude proves security properties for 123 open-source libraries using RISC‑V verification", 22 October 2026, https://digestai.news/story/claude-proves-security-properties-for-123-open-source-libraries-using

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/claude-proves-security-properties-for-123-open-source-libraries-using.json