Machine-checked security proofs leave the lab as Claude proves 100+ libraries
Proofs of security properties in assembly code, at library scale. Clouds and regulated software vendors pay.
Competitive · Theorem and Claude prove 100+ libraries
Written for: Investor or analyst
Next step
Thesis: as AI makes bug-finding a commodity, proof of bug absence becomes the premium security product for critical code. Confirming signal: a regulator or major procurement standard accepting machine-checked proofs as evidence, or Theorem raising a large round. Already building: Theorem, AWS Automated Reasoning, Galois, Certora.
Why now
Finding bugs is now cheap and contested, as the PHP flaws found by two labs show. That makes proving the absence of a bug class the scarcer thing to sell. Formal methods such as seL4, CompCert and AWS's automated reasoning were always correct but too slow and costly, because humans had to write the proofs. Models now draft those proofs. That is why the field is returning to them.
What became possible
Anthropic and Theorem used Claude to formally prove security properties at the assembly level across more than 100 real open-source libraries. Developers on Hacker News describe LLMs making verification feasible at a scale that was never practical before.
Two ways in
- Proof-backed library registry
Versions of common dependencies that ship with machine-checked memory-safety proofs, kept up to date as code changes.
- Customer
- Fintech and defence software vendors
- Model
- Enterprise subscription per dependency set
- Spec authoring service
Turning security requirements into formal specs that a prover can check against.
- Customer
- Cloud and payment platform security teams
- Model
- Services moving to tooling
Competition
The proof-backed library registry does not exist as a product yet. Theorem and Anthropic have shown the technique at the scale of 123 libraries, but only for single-threaded static RISC-V binaries linked against musl, which is not how fintech or defence customers run these libraries.
Full competition notes (11 competitors)
The proof-backed library registry does not exist as a product yet. Theorem and Anthropic have shown the technique at the scale of 123 libraries, but only for single-threaded static RISC-V binaries linked against musl, which is not how fintech or defence customers run these libraries. A newcomer could win by covering the x86 and ARM builds, linkage setups and concurrency of real deployments, keeping proofs current with every upstream release, and packaging the proofs as compliance evidence auditors accept under FedRAMP, PCI or DO-178C. Nobody I found sells that today. The risk is that Theorem productizes first, or that Chainguard partners with a prover and bundles proofs into a catalog it already sells, so proof generation itself is unlikely to be a lasting advantage. The spec-writing service is less crowded commercially: Galois and Atlas Computing are building AI spec tools, but I found no productized service aimed at cloud or payment security teams. Turning messy security requirements into specs that experts review and sign off on is still the slow, human-heavy step, and a services-led company with domain expertise in payments or cloud isolation could get in there before the well-funded Lean prover companies move down the stack.
- Theorem (with Anthropic)
This is the work the opportunity describes, announced Oct 22, 2026. Claude produced machine-checked proofs of crash-freedom at the RISC-V assembly level for 239 entry points across 123 OSS-Fuzz libraries, about 180M lines of Rocq, with fuzz tests turned into specs. It is limited to single-threaded static RISC-V binaries linked against musl. I found no public product or pricing, but Theorem is the obvious party to turn this into a registry.
- AWS s2n-bignum
AWS has verified cryptographic assembly in HOL Light, including super-optimized AArch64 code, ML-KEM and ongoing constant-time proofs. It says neurosymbolic AI accelerates its proof engineering and that proofs are kept in step with code through CI. This is a big-company in-house capability, not a product sold to others.
- s2n-bignum-bench
A public benchmark of 2,301 HOL Light proof obligations for industrial assembly routines. It lowers the barrier for anyone training AI provers on assembly-level proofs.
- Axiom
Raised a $200M Series A at a valuation above $1.6B to verify code with Lean proofs, which puts it in a position to move into verified libraries or spec work.
- Harmonic
A Lean-based AI prover company that has raised over $220M, valued at $1.45B. It is an adjacent competitor that could move toward software verification.
- Pramaana Labs
Reported $27M seed led by Khosla Ventures in June 2026 to combine formal verification with LLMs. Product details are undisclosed and the source is an aggregator.
- Galois
Building generative-AI tools to produce accurate system specifications and fold formal methods into DevSecOps pipelines. It is a direct competitor for the spec-writing service and has long-standing defence and government clients.
- Atlas Computing
A nonprofit funded by Schmidt Sciences to prototype AI tools for generating, reviewing and validating formal specs for code. It overlaps with the spec-writing idea but is not commercial.
- Cryspen
Sells formally verified cryptographic libraries and services using F* and Rocq. It is a narrow, crypto-only version of the proof-backed library idea.
- Chainguard Libraries
A curated, provenance-signed catalog of open-source dependencies with no formal proofs. It already has the enterprise buyer relationship and could add proofs or partner with a prover.
- liblzma memory-safety verification (VST)
An academic case study in which AI agents proved memory safety for 22 liblzma decoder functions in Rocq/VST, with humans approving spec changes. It shows the technique works but is not a product.
Checked 2026-10-23
Risks
- A proof is only as good as its spec, and human review of specs remains the bottleneck
- Big clouds may keep this in-house, as AWS already does
- Buyers may not yet pay for proofs over cheaper scanning
Best on open space and team fit; buildability is the weak point (4).
tech 5 · pull 5 · space 7 · fit 7 · build 4
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
- Anthropic says it partnered with Theorem to use Claude to formally prove security properties at the assembly level across 100+ real-world open-source libraries (Anthropic)Techmeme
- LLMs are making formal software verification feasible at a much larger scaleHacker News
- [AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 monthsLatent Space
Status history
- 2026-10-23 Added to the watchlist