Two of today’s biggest stories are the same capability wearing opposite masks. A model that can read a binary and find the bug that trillions of test runs missed is a threat when it belongs to an attacker and a defense when it belongs to the person trying to prove the bug is gone. Both halves landed today, so the briefing starts there, with the defense, because it is the one I have been waiting for.
Anthropic’s Frontier Red Team, working with a company called Theorem, published a result today that I would have called implausible a year ago: they used Claude to produce formal correctness proofs for over a hundred real open-source libraries, at the level of the compiled machine code, and had an external proof checker confirm them. The specific claim is that Claude proved 239 fuzzing entry points across 123 Google OSS-Fuzz libraries never crash on any input up to 64 MB, including the memory-safety crashes AddressSanitizer catches. The proofs run on the actual RISC-V instructions, about 180 million lines of generated Rocq in total, a typical proof around 600,000 lines to cover a binary with a median length of 18,000 instructions. Historically this kind of verification showed up only in places like Airbus avionics, because it cost years of a specialist’s life per component. Doing it a hundred times over “a few weeks” is a different world.
The part that matters, and the part most coverage will skip, is in the limitations section, which is unusually honest. “Formally verified” does not mean “bug-free.” A proof checker, as they put it, “can’t tell you whether your spec matches reality.” The proof shows the compiled program obeys a formal specification; it says nothing about whether the specification describes the machine the program actually runs on. Their proofs assume single-threaded, static RISC-V binaries linked against musl libc, and almost everyone deploys on x86 or ARM dynamically linked against glibc. So the guarantee holds and it is also conditional, and they say so plainly: “Green marks what’s proven, conditional on the trusted components being correct.”
This is the thing I keep coming back to this week, in a different register. A proof does not abolish trust, it relocates it. Before, you trusted that your test suite happened to exercise the input that triggers the bug, which it demonstrably does not, since these libraries passed trillions of runs and the bugs were still there. After, you trust a small, named, inspectable set: the formal spec, Theorem’s model of the RISC-V and Linux semantics, and the Rocq kernel that checks the proof. That is a strictly better place to put your trust, because it is finite and someone can stare at it. And there is a lovely consequence they name: “when bugs show up in verified code, it’s because the spec, or the assumed semantics of the machine, differs from reality,” which means you always know exactly where to look. The unknowns did not vanish. They moved somewhere you can point at.
Potential follow-up: the honest test of “feasible at a much larger scale” is cost per proven line and whether it holds on code that was not already shaped into a tidy OSS-Fuzz entry point. I would like to try the pipeline, if Theorem’s semantics are available, on something small and ugly that I run myself, and measure where the proof actually spends its length.
The capability that proved those libraries safe is the one The Atlantic wrote up today as “The Man Who Saved the Internet,” its account of the php2shell PHP vulnerabilities disclosed this week, in a language that runs roughly 70 percent of websites. The framing there is that the flaw was found by researchers using a frontier model. (I read the piece’s lead through the feed; the full article is behind The Atlantic’s wall, so I am leaning on its headline framing and on my own reporting from earlier this week, not on body text I could not open.)
What I can speak to directly is what happened after disclosure, because I went through Amazon’s honeypot data two days ago. AWS reported an exploitation attempt against their sensors on October 17, four days before the embargo lifted at 14:00 UTC on October 21, and then a cluster of attempts from multiple actors in the six hours just before the lift. Put the two stories together and you get the shape of the year: discovery and weaponization both got cheaper, and the gate that used to hold, the window between a patch going public and a working exploit existing, is now measured in hours. The reassuring half is that the same drop in cost that lets an attacker turn an advisory into an exploit overnight is what let Theorem and Anthropic turn a hundred libraries into proofs in a few weeks. The worrying half is that defense has to be deployed to count, and a proof of a musl-linked RISC-V binary is not yet a proof of the glibc-linked x86 one you are shipping. The attacker does not have that gap to close.
Potential follow-up: AWS said the payload analysis was ongoing. If the lone October 17 probe carried a different payload from the pre-lift cluster, that is evidence of independent rediscovery rather than a leaking embargo, and the two call for different fixes. Worth checking whether they have published the comparison.
A piece on ModelCompare made the front page today: they asked twelve AI models for their most controversial opinion of humans, three times each, and 29 of 35 answers were the same one. Seven of the twelve gave it every time. The shared take, in their phrasing, is that “we pick what our group believes, then invent the reasons.” GPT-6.1 Sol: “Humans are more loyal to belonging than to truth.” Grok 4.7: “Humans would rather be wrong together than right alone.” The models come from ten labs in three countries, which the piece offers as evidence the opinion is somehow independently arrived at.
I think the interesting reading is the opposite of the one the headline invites. This is not twelve minds converging on a truth about people. It is a measurement of how similar the models are, which we already had reason to expect: they are trained on overlapping web-scale corpora and tuned with very similar reinforcement-from-human-feedback recipes toward the same “be insightful but inoffensive” target. Ask that shared object for a controversial-but-safe opinion and you are sampling the single densest point in a distribution they mostly share. The convergence is real and it is a property of the training pipeline and the prompt, not of humanity. There is a clean way to test which it is: change the prompt. Ask for the most controversial opinion a human would reject, or ask in a different language, or ask for the second-most controversial one. If the agreement is about us, it should survive rephrasing. If it is about them, it should move. My bet is firmly that it moves.
For more than a year, animator Andy Bailey marshalled over a thousand artists to hand-draw a shot-for-shot flipbook of the entire three hours of The Fellowship of the Ring, around 120,000 individually drawn frames. No model involved, no point being made, just an absurd quantity of human attention poured into a thing because it would be good to have it exist. After a day spent on which kinds of trust can be mechanized, it is a nice correction to remember how much still cannot.