The story behind the cartoon
Anthropic and verification startup Theorem report that Claude produced machine-checked formal proofs that 239 fuzz-test entry points across 123 open-source libraries can never crash — for any input under 64 MB. The proofs, written in the Rocq proof language and checked by machine, target the compiled RISC-V binary rather than the source code, and total about 180 million lines that passed the checker.
The proof hunt itself found hundreds of bugs that fuzzers had missed. One was a counter underflow in a decompressor that caused an out-of-bounds write only on inputs of around 20 MB with one rare layout; others included an out-of-bounds read in an image decoder and a rediscovery of CVE-2026-56132 in libexpat, which required deeply nested input.
Anthropic stresses the proofs do not mean the libraries are bug-free: they cover single-threaded static RISC-V binaries, while most users run the libraries on x86 or ARM, and the proof checker itself is one of only three components developers must trust. Theorem is offering the same pipeline free to qualifying open-source projects.
The joke is the demotion: after years of swatting bugs one at a time with the FUZZ flyswatter, the engineer watches proof do the whole job at once — certificate in one hand, jar full of caught bugs in the other. The flyswatter is now decorative.
THE KEY UNDER THE MAT.
THE SIDE DOOR
THE ONE CUSTOMER WHO READ THE LABEL
THE ONE-MAN DRUG COMPANY