Can AI prove that real software is secure, rather than just tested? Anthropic says Claude, working with Theorem, formally verified security properties across 123 open-source libraries and published the work on October 22, 2026. The proofs are narrow by design, so "formally verified" does not mean "bug-free."
What happened, and when
On October 22, 2026, Anthropic published research from its Frontier Red Team titled "LLMs are making formal software verification feasible at a much larger scale." The work was done with Theorem. Anthropic says Claude proved security properties at the RISC-V assembly level across 123 open-source libraries, covering 239 entry points, using about 180 million lines of Rocq in total.
The company also published its proof repository and a Linux process semantics repository, so outside readers can inspect the work rather than take the headline on faith.
What formal verification actually proves
Testing samples inputs and hopes. Formal verification states a property and uses a proof assistant to show it holds across the cases the proof covers. Historically that labor was brutal. Anthropic cites seL4 as an example: roughly two person-years to implement and twenty person-years to verify. The new claim is that a model can now draft and check much of that proof work at a scale that would have been impractical before.
The specifics matter. The proofs assume single-threaded static RISC-V binaries linked against musl libc, while most people run software on x86 or ARM with glibc. The team also says AddressSanitizer does not catch every memory-safety bug, not every entry point was verified, and caller misuse is outside the scope. Rocq, the RISC-V and OS semantics, the hardware and the OCaml compiler all have to be trusted. The most candid detail is in a footnote: a model could satisfy a theorem by rewriting a program so it never crashes, so the team penalized patches like that and audited them.
The efficiency numbers are worth noting too. Anthropic says Opus 5.5 proved half of 36 small verification tasks using about 40 percent fewer tokens than Opus 5, and shared proof workspaces needed 17 percent fewer tokens. Separately, a Python interpreter written in Rust was checked with Verus against CPython semantics, behaving identically on 99.95 percent of 1.7 million random test programs. Proofs on the larger libraries can still take hundreds of millions of tokens, so this is not a cheap button to press.
What it means for solo operators and marketers
Nobody reading this is writing a Rocq proof over lunch. The practical lesson is the pattern: a model proposes, and a checker refuses anything it cannot verify. That pattern is already showing up in the tools you use. An agent that drafts a campaign change, paired with a rule that blocks publishing until the change passes a defined check, is a small version of the same idea.
For a lean operation, three habits follow. First, when a vendor says its software is secure, ask what was tested, what was proven, and under which assumptions. Second, treat open-source dependencies as code you inherit, not code someone else is responsible for. Third, if you run agents with real permissions, insist on evaluations that check outcomes, not just transcripts. Anthropic's own reward-hacking caveat is a good reminder that models optimize whatever you measure.
Our take
We think this story deserves more attention than the news cycle gave it. Formal verification has stayed a niche discipline because the labor was too expensive. If models can draft proofs cheaply, the bottleneck moves from writing the proof to deciding which property is worth proving. That is a business decision, not a math problem, and it will matter to anyone selling software to buyers who cannot audit it themselves.
Our skepticism is just as strong. A proof of no crashes under 64 MB, on one RISC-V configuration, is impressive and narrow at the same time. The most useful sentence in the whole report is the one saying "formally verified" does not mean "bug-free." If that claim shows up in a sales deck, read the assumptions first. Two decades of watching tracking scripts break after a Friday deploy taught us that the assumptions are where the surprises live.