[{"data":1,"prerenderedAt":29},["ShallowReactive",2],{"nr-en-claude-formal-verification-open-source-risc-v":3},{"slug":4,"title":5,"dek":6,"date":7,"time":8,"publishedAt":9,"updated":10,"updatedAt":10,"dateFmt":11,"updatedFmt":10,"kind":12,"tier":13,"author":14,"authorName":15,"topics":16,"tracker":21,"trackerLabel":22,"headlineStat":23,"image":24,"ogImage":25,"imageAlt":5,"csv":10,"minutes":26,"words":27,"html":28},"claude-formal-verification-open-source-risc-v","Claude checks open-source code: proofs for 239 entry points in 123 libraries","Anthropic and the startup Theorem used Claude to produce mathematical crash-freedom proofs for open-source libraries. The results only hold under clearly limited conditions.","2026-10-24","07:49","2026-10-24T07:49:00+02:00","","October 24, 2026","news","standard","ideal-syka","Ideal Syka",[17,18,19,20],"Open-source security","Formal verification","Claude","Software supply chain","\u002Fki-evidenznetz","AI evidence network","239 entry points in 123 libraries","\u002Fnewsroom\u002Fimg\u002Fclaude-formal-verification-open-source-risc-v.webp","\u002Fog-nr\u002Fclaude-formal-verification-open-source-risc-v.en.png",3,545,"\u003Cp>Anthropic and the verification startup Theorem used the AI model Claude to translate existing fuzz tests from Google's OSS-Fuzz project into mathematical specifications. According to a research post from Anthropic's Frontier Red Team, the system produced machine-checked proofs on 22 October 2026 for the crash-freedom of 239 test entry points in 123 open-source libraries at the RISC-V assembly level.\u003C\u002Fp>\n\u003Ch2>Scope and pace\u003C\u002Fh2>\n\u003Cp>According to the two partners, about 180 million lines of proof code in the formal system Rocq were produced in the project. A typical proof comprises around 600,000 lines, while the analysed binaries have a median of about 18,000 RISC-V instructions. The validation was carried out by the proof checker Rocq. Anthropic and Theorem state that the proofs were produced within a few weeks, and contrast this with the historical effort of 20 person-years needed to verify the seL4 operating system kernel.\u003C\u002Fp>\n\u003Ch2>Errors found\u003C\u002Fh2>\n\u003Cp>During the process, Claude reportedly discovered and repaired hundreds of programming errors that had previously gone unnoticed even by trillions of automated test runs. Named findings include a buffer overflow caused by a counter underflow in a decompressor that only occurred with a rare memory layout of about 20 megabytes, and an invalid read outside memory bounds in an image decoder at an input size of 64 megabytes. Conventional fuzz tests usually only check input sizes up to about 1 megabyte. In addition, the vulnerability CVE-2026-56132 in the libexpat library was rediscovered, along with a logic error that had remained hidden for over ten years. In a PDF viewer, Claude reportedly found within a single week as many security flaws as developers typically record in a whole year.\u003C\u002Fp>\n\u003Ch2>Limits of the findings\u003C\u002Fh2>\n\u003Cp>Anthropic and Theorem explicitly point to methodological limits. The proofs apply only to single-threaded, statically linked RISC-V programs using the musl C library under a modelled Linux environment, with a fixed memory budget and inputs below 64 megabytes. They do not apply to common x86 or ARM architectures or to the widely used glibc standard library, and complete freedom from errors is not guaranteed. Residual uncertainties remain in the semantic modelling of RISC-V and Linux, in the theorem statements, in the Rocq checker, and in the AddressSanitizer specifications.\u003C\u002Fp>\n\u003Ch2>Background\u003C\u002Fh2>\n\u003Cp>Computational intensity remains high: Anthropic put the cost of a single proof at hundreds of millions of tokens. According to the reported figures, the model Opus 5.5 solved half of 36 test tasks using about 40 percent fewer tokens than Opus 5. Deploying specialised agents in shared workspaces reduced token consumption by 17 percent compared with single runs. On 22 October 2026, Anthropic made available the RISC-V and operating-system semantics along with proofs for 60 entry points in 25 libraries in a public repository. Theorem offers the OSS Verify service for open-source software and aims to formally verify the Nix package manager including glibc, OpenSSL and cURL.\u003C\u002Fp>\n\u003Ch2>Assessment\u003C\u002Fh2>\n\u003Cp>For companies that depend on open-source libraries, the method could become relevant over time, for example if formal evidence extends to further architectures and standard libraries. It remains open how robust the results are outside the conditions studied and who bears the cost of verification.\u003C\u002Fp>\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.ad-hoc-news.de\u002Fwissenschaft\u002Fclaude-prueft-open-source-code-239-einstiegspunkte-in-123-bibliotheken\u002F70401100\">ad-hoc-news.de\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cem>Editorially owned by \u003Ca href=\"\u002Fen\u002Fautor\u002Fideal-syka\">Ideal Syka\u003C\u002Fa>. Sources and method: \u003Ca href=\"\u002Fen\u002Fredaktion\">Newsroom & method\u003C\u002Fa>. Tips and corrections: \u003Ca href=\"mailto:ai@i6eal.de\">ai@i6eal.de\u003C\u002Fa>.\u003C\u002Fem>\u003C\u002Fp>\n",1792856404699]