Anthropic has officially announced the successful application of its Claude model to verify the security properties of 123 open-source libraries. Using advanced mathematical proofs, the artificial intelligence was able to uncover hundreds of hidden errors and vulnerabilities that traditional testing methods had missed for years.
Mathematical Approach to Code Verification
As part of a joint project with Theorem, a firm specializing in program verification, Anthropic developers applied rigorous mathematical proofs directly to compiled machine code. Traditional testing and fuzzing tools generate large volumes of input data but are physically unable to exhaust all possible combinations to guarantee absolute safety.
To solve this task, the Claude model transformed existing fuzz tests into precise mathematical specifications. This allowed the artificial intelligence to generate proofs demonstrating that 239 entry points across 123 libraries are guaranteed not to fail under specific conditions within RISC-V assembly code.
Automation of Verification and Bug Fixing
For independent verification of the generated specification-compliance proofs, researchers utilized a separate tool called Rocq. This approach completely freed developers from the necessity of manually inspecting every single line of code.
Furthermore, the neural network demonstrated the ability not only to find defects but also to fix them independently and create new proofs for updated software. This significantly accelerates the development cycle and enhances the overall reliability of critical components.
Discovered Vulnerabilities and Method Limitations
The new methodology successfully exposed complex defects that had eluded testers for years. These included an underflow counter capable of triggering out-of-bounds writes, an image decoder error, out-of-bounds reads, and a logical error bypassing file upload restriction functions.
Despite the impressive results, Anthropic specialists emphasize that formally verified software does not become completely flawless. The obtained guarantees apply exclusively to the specific properties, input data, and assumptions described in each individual proof within a simulated Linux environment.
Significance of the Technology for Future Development
The integration of artificial intelligence models into the mathematical verification process opens new horizons for global cybersecurity. It is expected that further advancements in technology and the reusability of proofs will drastically reduce the financial and time costs of auditing complex software systems.
