Verification follows code generation
On October 22, 2026, Anthropic reported work with Theorem using Claude to prove selected security properties across 123 open-source libraries. Existing fuzz tests become specifications, and an external proof checker validates the generated proofs. The work aims to establish properties under stated conditions, not simply find another failing test.
The assumptions matter: single-threaded static RISC-V binaries, modeled Linux behavior and memory constraints, and inputs smaller than 64 MB. Not every entry point or entire library is covered, and ordinary x86 or ARM deployments do not automatically inherit these guarantees. These are the collaborators' research findings; a subset of proofs and machine semantics is being shared.
A valid proof still needs the right specification
For development teams, the useful shift is from “tests passed” to explicit claims about behavior. A proof checker cannot establish that a specification adequately represents real requirements. Before adopting this workflow, teams should examine input bounds, execution assumptions and caller obligations, then revisit the proof when deployment conditions or dependencies change. The announcement is not evidence that all software is bug-free or that security review can be skipped.