Anthropic and Theorem Automate Code Safety with 180 Million Lines of Proof

The era of AI writing code without proof is ending.

Anthropic, in collaboration with Theorem, has demonstrated a method where its Claude model automatically generates mathematical proofs to verify the safety of existing software. This development addresses a critical bottleneck in software engineering: the high cost and complexity of ensuring code runs error-free under all conditions.

First, the model executed a massive volume of verification work. In a matter of weeks, Claude produced approximately 180 million lines of proof code. This effort focused on 123 open-source libraries from Google’s OSS-Fuzz security project. Instead of creating new software, the AI translated existing crash tests into mathematical problems and analyzed compiled machine code to generate extensive proofs.

Second, the process proved highly effective at uncovering latent defects. During the verification phase, Claude identified hundreds of bugs that conventional testing methods had missed. These errors often only manifested under specific, unusual conditions, such as large input files or specific memory access sequences. In one notable instance, the team found as many security vulnerabilities in a widely used PDF reader in a single week as are typically reported for that software in an entire year. In another case, a logical error undetected for over a decade was caught by the model.

Third, the workflow relies on automated checking to minimize human intervention. An independent verification program called Rocq automatically validates the proofs generated by Claude. According to Anthropic, this process requires almost no human reviewers, leading the researchers to describe it as "fully autonomous" proof generation. While the underlying formal foundations and tools were built by humans at Theorem, the actual generation and checking of proofs are handled by the AI and the verification software.

Contextually, this approach tackles a problem that has historically been prohibitively expensive. Formal verification has long been reserved for high-stakes environments like Airbus avionics due to the labor costs involved. For example, a team of specialists required 20 person-years to formally verify the seL4 operating system kernel. By automating this process, Anthropic aims to make formal verification as routine as standard testing, potentially allowing developers to trust AI-generated software more and reduce time spent on manual reviews.

However, the method comes with strict practical limitations. Anthropic acknowledges that "formally verified" does not equate to "error-free" in every real-world scenario. The proofs are valid only under specific conditions, including a particular processor architecture, single-threaded execution, and input sizes under 64 MB. Additionally, the compute costs are significant, with individual proofs consuming hundreds of millions of tokens. Despite these constraints, the efficiency gains are evident; newer models like Opus 5.5 solve half the proofs with approximately 40 percent fewer tokens than their predecessor, Opus 5.

Looking ahead, the project signals a major shift in software automation. If AI can both write code and mathematically guarantee its safety under defined conditions, the industry’s focus may shift from basic coding capability to proof generation. Theorem’s roadmap already targets critical infrastructure components such as glibc, OpenSSL, and cURL, suggesting that this technology could soon become a standard part of the development lifecycle for critical systems.