AI Verification: Claude Proves Software Correctness at Scale

Anthropic has demonstrated that its Claude model can mathematically verify that existing software code behaves as intended, a process that traditionally requires immense human expertise. The company presents this achievement as a critical step toward making artificial intelligence generated software more trustworthy, while clearly defining the specific boundaries of what these proofs can guarantee.

Formal verification, which proves that software runs without errors under all circumstances, has historically been too expensive for widespread use. Specialists once required twenty person-years to verify seL4, a small operating system kernel. This high cost confined the technique to extreme cases, such as the avionics software used by Airbus. To change this dynamic, Anthropic’s Frontier Red Team partnered with Theorem to allow Claude to perform the proof work.

The model generated approximately 180 million lines of mathematical proof code within a matter of weeks. This work drew on test programs from 123 open-source libraries in Google’s OSS-Fuzz security project. Claude did not write new software. Instead, it verified existing code by converting crash tests into mathematical problems and analyzing compiled machine code. A separate program called Rocq automatically checks these proofs, and Anthropic states that the process requires almost no human reviewers. The researchers describe the generation as fully autonomous, though humans at Theorem built the underlying tools and formal foundations.

During the process, Claude found and was permitted to fix hundreds of bugs. Many of these issues would likely have escaped conventional testing because they only appear under narrow conditions, such as unusually large input files or specific access sequences. In one effort to verify a widely used PDF reader, the team discovered as many security bugs in a single week as are usually reported for that software in a full year. In another case, the model identified a logical error that had gone unnoticed for over a decade. Anthropic notes that even when a complete proof fails, the attempt can still reveal real bugs.

The company is careful to clarify that formally verified does not mean error-free. The proofs hold only under defined conditions, including a particular processor architecture, single-threaded programs, and inputs smaller than 64 MB. Real-world deployments often run on different hardware and configurations. Cost is also a constraint, as individual proofs consume hundreds of millions of tokens. Anthropic has not published total project costs but argues that if AI can verify its own code, developers can trust it more and spend less time on review.

A smaller test run indicated that proofs can be reused and that efficiency is improving. Opus 5.5 solves half the proofs using about 40 percent fewer tokens than Opus 5. The project shifts the focus from whether AI can program to whether it can prove its code is safe. Anthropic expects this method to become as practical as standard testing, with Theorem’s roadmap already targeting critical infrastructure like glibc, OpenSSL, and cURL.