Anthropic and Theorem verify 123 open source libraries with Claude at assembly level
Anthropic and formal verification firm Theorem used Claude to verify security properties at assembly level across 123 open source libraries and 239 entry points, producing about 180 million lines of Rocq proofs and surfacing real bugs including CVE-2026-56132.
Anthropic announced on October 22 the results of work with formal verification firm Theorem. The team used Claude to verify security properties at assembly level across 123 open source libraries and 239 entry points, producing roughly 180 million lines of Rocq proof code while writing close to a billion lines of code during the process.
Verification ran against artifacts around 64MB in size, covering full compiler output rather than only high-level source. Using cJSON as an illustration, a 391-line hand-written parser corresponds to about 630,000 lines of proof. Anthropic compared this against the seL4 microkernel, which a six-person team completed over ten years with verification alone consuming around 20 person-years.
Practical impact included discovering and fixing real bugs such as CVE-2026-56132 involving out-of-bounds memory reads and integer overflow. The team also reported a conformance run over 1.7 million Python programs and an observation about one-week defect density in a PDF parser. The Claude Opus 5.5 version used about 40% fewer tokens than its predecessor.