Claude Generates 180 Million Lines of Proof to Verify Legacy Software

Formal verification of software has historically required vast amounts of human expertise, limiting its use to high-stakes systems like aircraft controls. Anthropic announced on Wednesday that its Claude model has now completed this rigorous check for a wide range of existing open-source code.

The effort marks a shift in how developers might ensure code reliability. Traditionally, proving that software runs without error in every scenario was prohibitively expensive. Specialists spent 20 person-years verifying seL4, a small operating system kernel. Because of this cost barrier, the technique rarely extended beyond niche applications.

Anthropic’s Frontier Red Team partnered with Theorem to change that dynamic. Instead of relying on human mathematicians, the team tasked Claude with generating the proofs. In a matter of weeks, the model produced approximately 180 million lines of mathematical proof code. The project drew on test programs from 123 open-source libraries within Google’s OSS-Fuzz security project.

Claude did not write new software; it verified existing code by converting crash tests into mathematical problems. It analyzed compiled machine code and constructed extensive proofs. A separate program called Rocq checks these proofs automatically. Anthropic states the process requires almost no human review, though the underlying tools were built by humans at Theorem.

The verification process uncovered hundreds of bugs that Claude was permitted to fix. Researchers noted that many of these errors likely escape conventional testing because they appear only under narrow conditions, such as unusually large input files or specific access sequences. While verifying a widely used PDF reader, the team found as many security bugs in one week as are usually reported for that software in a full year. In another instance, Claude identified a logical error that had gone unnoticed for more than a decade.

The company clarifies that formal verification does not mean the software is error-free. The proofs hold only under specific conditions: a particular processor architecture, single-threaded programs, and inputs smaller than 64 MB. Real-world deployments often use different hardware configurations.

Cost remains a constraint, with individual proofs consuming hundreds of millions of tokens. Anthropic has not published total project costs but notes that efficiency is improving. Opus 5.5 solves half the proofs using about 40 percent fewer tokens than Opus 5. Theorem’s roadmap targets critical infrastructure libraries including glibc, OpenSSL, and cURL.