Anthropic says it partnered with Theorem to use Claude to formally prove security properties at the assembly level across 100+ real-world open-source libraries

AI now automates the generation of formal security proofs for code, which previously took years of expert effort per project.

Anthropic has partnered with Theorem to leverage its Claude AI model for automated formal software verification. The collaboration focused on proving security properties at the assembly code level for over 100 real-world open-source libraries. Historically, formal verification has been an arduous, expert-intensive process, often requiring years of effort for even moderately sized projects. This new approach demonstrates that large language models can now autonomously generate formal proofs at scale, making it feasible for broader software development. During this process, Claude also identified and helped fix bugs that had persisted despite extensive testing, including trillions of test runs. The proofs generated operate on compiled RISC-V assembly code and are intended to provide strong security guarantees for software.

This partnership signifies a major leap in AI's capability to tackle complex, high-assurance tasks, moving beyond code generation and bug detection to rigorous mathematical proof. By proving security properties at the assembly level, the effort targets a critical layer of software where vulnerabilities can be deeply embedded and hard to find through traditional testing. The scale of this achievement—over 100 libraries—suggests that AI-driven formal verification may soon become a standard component in the software development lifecycle, not just for niche applications but for widely used open-source projects.

The implications extend to how software is audited and secured; AI-generated proofs could drastically reduce the time and cost associated with establishing code integrity. This development could also empower developers with less specialized formal verification expertise to incorporate such guarantees into their work. The success with RISC-V assembly code hints at future applications across various architectures and programming languages, potentially reshaping industry standards for software trustworthiness.