Use Claude to verify code against crash bugs

Anthropic’s red team had Claude turn fuzz tests into formal specs and prove that selected RISC-V binaries would not crash on valid inputs.

Done with Claude· Advanced

What they did
The team started with OSS-Fuzz tests and rewrote them as formal claims: that a compiled RISC-V program would not crash on any input smaller than 64 MB. Using Theorem’s RISC-V and Linux models, Claude generated Rocq proofs that a proof checker could validate. When a proof exposed a flaw, Claude fixed the code, rebuilt the specification, and kept going; any patch was checked and scored to reduce reward hacking.
How it went
Across a few weeks, Claude established no-crash properties for 239 entry points in 123 libraries. The work produced about 180 million lines of Rocq and also surfaced hundreds of bugs. The coverage was limited to single-threaded static RISC-V binaries, and individual proofs could consume hundreds of millions of tokens.
Tips
This approach is best when you can express the property as a precise spec and have a checker that can validate proofs. Expect long runs and a lot of token use, and keep human review on any code changes before they are applied.

Try it yourself with Claude

I want to formally verify that [module/library at path] cannot [specific bug class, such as crash, out-of-bounds access, or integer overflow] when given [input conditions]. Use the best fitting verification tool for [language/platform], write the needed specifications and proofs, and run the checker. If you find a failing proof or a bug, stop and show me the exact change you want before editing any code. After each proposed fix, wait for my approval before applying it. Finish with a report that says what was proven, what remained unproven, and any bugs you found.

Fill in the [brackets]. Agents can make mistakes, so review anything before it is sent, paid or deleted.

Read the original on anthropic.com ↗

Get 3 agent uses like this every morning

With the day's top AI news. Free, and one click to unsubscribe.