Anthropic and Theorem: Claude proved security properties in the machine code of 123 open-source libraries and found bugs that had gone unnoticed for years
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
SI has learned not only to find bugs in code but to prove their absence, although the proofs work only under narrow conditions and are expensive.
In joint work with the company Theorem, Anthropic used Claude to prove security properties at the level of RISC-V assembly code in more than 100 real open-source libraries; the authors call this, to their knowledge, the first large-scale attempt to apply SI to formal verification of production software at the assembly level. As The Decoder retells it, Claude turned crash tests into mathematical problems and wrote proofs that an independent program, Rocq, checks: this covers 123 libraries from the OSS-Fuzz project and about 180 million lines of proof code. Along the way, hundreds of bugs missed by ordinary testing turned up, including a logic error that had gone unnoticed for more than ten years; for one PDF viewer, as many security problems were found in a week as are usually reported in a year. Caveats: the proofs hold for a specific processor architecture, single-threaded programs and inputs up to 64 MB, and a single proof can cost hundreds of millions of tokens.
Sources 2