180 million lines of proof: How AI is tackling the cost of software verification

180 million lines of mathematical proof code were generated in a matter of weeks, a figure that fundamentally challenges the traditional economics of software security. Anthropic, the developer of the Claude AI model, announced on October 23 that it has successfully used its technology to mathematically prove that existing software code behaves correctly. This achievement marks a significant shift in how the industry approaches formal verification, a process that has historically required immense human capital and time. By automating this complex task, the company aims to make AI-generated software easier to trust while addressing the high costs associated with traditional expert review.

The financial and temporal barriers to formal verification have long kept the practice out of reach for most developers. To understand the scale of the savings, consider the case of seL4, a small operating system kernel. Specialists required 20 person-years to verify this single piece of software. This intense resource demand has largely confined the technique to extreme environments where failure is not an option, such as the avionics software used by Airbus. The new approach by Anthropic and its partner, Theorem, suggests that these timelines can be compressed from years to weeks, potentially democratizing access to rigorous code certification.

The core of this effort involved the Frontier Red Team at Anthropic collaborating with Theorem to hand the proof generation tasks to Claude. The model did not write new software but instead verified existing code by converting crash tests into mathematical problems. It analyzed compiled machine code and constructed extensive proofs to demonstrate correctness. The scope of the project was substantial, drawing on test programs from 123 open-source libraries within Google's OSS-Fuzz security project. This broad application demonstrates the model's ability to handle diverse codebases without specialized manual intervention for each instance.

A critical component of the workflow is the role of Rocq, a separate verification program that automatically checks the proofs generated by Claude. Anthropic states that this automated checking process requires almost no human reviewers. The researchers describe the proof generation as fully autonomous, although they clarify that the underlying tools and formal foundations were built by humans at Theorem. This division of labor highlights a hybrid model where AI handles the heavy computational lifting while human experts design the framework and validate the final results.

Beyond generating proofs, the system identified hundreds of bugs during the process. The researchers noted that many of these flaws would likely have escaped conventional testing because they only appear under narrow conditions, such as unusually large input files or specific sequences of data access. In one notable instance, the team verified a widely used PDF reader and found as many security bugs in a single week as are usually reported for that software in a full year. In another application, Claude identified a logical error that had remained unnoticed for more than a decade. Anthropic adds that even when a complete proof fails, the attempt can still reveal real bugs, adding value beyond binary success or failure.

Despite these successes, the company is careful to define the boundaries of what is being verified. The term formally verified does not equate to error-free in all possible scenarios. The proofs hold only under specific, defined conditions, including a particular processor architecture, single-threaded programs, and inputs smaller than 64 MB. Real-world deployments of these libraries often run on different hardware and configurations, meaning the verification is context-dependent. This precision is crucial for businesses integrating these tools into their development pipelines to understand exactly what level of assurance they are purchasing.

Cost remains a significant constraint for this technology. Individual proofs consume hundreds of millions of tokens, and Anthropic has not yet published the total project costs. However, the company argues that if AI can verify its own code, developers can trust AI-generated software more and spend less time on manual review. This reduction in labor time could cut costs across the entire coding process. A smaller test run indicated that proofs can be reused, and efficiency is improving. Specifically, Opus 5.5 solves half the proofs using about 40 percent fewer tokens than its predecessor, Opus 5, suggesting a trajectory toward greater economic viability.

The project shifts the industry focus from whether AI can program to whether it can prove the code it writes is safe. Anthropic expects formal verification with AI to become as practical as standard testing in the near future. Theorem's roadmap already targets critical infrastructure, including glibc, OpenSSL, and cURL, which are foundational components of many digital systems. As these models become more efficient and cost-effective, the market for software assurance may see a structural shift, with rigorous mathematical proof becoming a standard feature rather than a luxury reserved for aerospace and defense.

Businesses looking to adopt these technologies must weigh the benefits of automated proof generation against the specific constraints of the current models. The ability to find latent bugs and reduce verification time offers a clear competitive advantage, particularly for companies operating in sectors where software reliability is paramount. As the cost per proof decreases and the scope of verifiable code expands, the integration of AI-driven formal verification is likely to become a key differentiator in the software market.