AI Code Proofs Run About $40 per KB; Reuse Cuts the Bill 30x

Anthropic said on 22 October 2026 that large language models are making formal software verification feasible at a much larger scale: over the span of a few weeks, Claude proved that 239 entry points across 123 open-source libraries do not crash on any input up to 64 MB, under stated assumptions. The same post names the constraint. “One of the key limitations of LLM-assisted formal verification is that the proofs can take hundreds of millions of tokens to produce,” Anthropic wrote.

Theorem, Anthropic’s collaborator on the project, has put a price on that. Its cost model starts at about $40 per kilobyte of machine code at today’s rates, and it estimates that verifying the whole nixpkgs software collection would cost about $190 billion if every package proved its own dependencies, against about $6.4 billion if proofs are shared. By our arithmetic, reuse cuts the bill about 30 times.

Business Pill · TOTAL COST OF OWNERSHIP

A short Business Engineer explainer on total cost of ownership: why the price of a tool is only part of what it costs to run. It teaches the general idea only and says nothing about any company in this piece.

What Anthropic Reported

Formal verification means translating code into a mathematical model and proving that it always follows a defined set of rules; if the proof fails, the failure points to a possible bug, Anthropic explains. The proofs here are written in Rocq, a proof assistant whose kernel mechanically checks every step, so the proofs themselves do not need human review.

• The old price. Anthropic cites seL4, an operating system kernel that took two person-years to build and 20 person-years to formally verify, about ten times as long by our arithmetic. That cost kept the method to mission-critical code such as Airbus avionics, the post says.
• The new scale. The proofs run to about 180 million lines of Rocq, with a typical proof of about 600,000 lines for a binary with a median length of 18,000 RISC-V instructions, Anthropic said.
• The bugs along the way. Claude patched the bugs it found before proving the rest. Anthropic lists a decompressor bug that appeared only on inputs of around 20 MB, beyond the 1 MB typical cap of fuzzers. “During an effort to verify a widely used PDF reader, we found as many security bugs in one week as are typically reported in a year,” the post says.

The Bill Is Tokens, and It Is Falling

Anthropic gives three data points on cost. On 36 small verification tasks built from real OSS-Fuzz code, “Opus 5.5 proves half of them with about 40% fewer tokens than Opus 5.” When agents could copy each other’s proofs in a shared workspace, they “needed 17% fewer tokens than when they worked alone.” And at scale, agent teams copied another team’s finished proof and adapted it, because most of a proof concerns code every program contains, the post says.

Theorem measures speed rather than tokens. On its own proof-efficiency eval of 36 small C programs, across seven Anthropic and OpenAI models released between May and September 2026, verification speed doubled about every two months, from about 0.12 KB per hour for Opus 4.8 to between 0.6 and 0.9 KB per hour for the September models, Theorem wrote.

The Number: What Reuse Saves

Theorem’s argument is that a proof, like a software library, only has to be written once. “Prove a component once, and everything that runs on it reuses the proof,” it wrote.

Theorem’s estimates, from its 29 September 2026 post (edited 19 October), at today’s rates. The ratio of about 30 times between the two nixpkgs figures is our arithmetic. These are estimates and a projection, not invoices.

Theorem says its total-cost projection assumes the measured trend holds, with capability on this task doubling every two months, which it notes is four times as fast as Epoch AI’s eight-month estimate for language models in general. On that assumption, a $100 million a year budget would verify 95% of the machine code by the end of 2027, Theorem estimates.

Who Pays

For now, not the maintainers. Theorem’s OSS Verify programme offers the same pipeline to open-source projects, and its page says: “Qualifying open source projects pay nothing.” Enrolment works like Google’s OSS-Fuzz, by pull request, and bugs found while proving are reported to the project privately, Theorem says. Anthropic is publishing a subset of the proofs and the RISC-V and Linux semantics they rely on, and Theorem is publishing a Claude skill to help developers verify their own code.

What the Proofs Leave Out

Anthropic is explicit that a formal proof is not a clean bill of health. The proofs assume a single-threaded, static RISC-V binary linked against musl libc, while most people run these libraries on x86 or ARM and link them dynamically against glibc, the post says. AddressSanitizer, the tool whose crashes the proofs rule out, does not detect all memory safety bugs, and not every entry point of each library was verified.

Any remaining bugs sit in the trusted components, the RISC-V and Linux models and the Rocq checker, or outside the scope of the proof, Anthropic wrote.

Connecting the Coverage

Our defender piece led with the same Anthropic post on 22 October, reporting that Claude, working with Theorem, proved 239 entry points across 123 open-source libraries will not crash on any input up to 64 MB, under stated assumptions. Its 23 October update added Anthropic’s attack-surface research, in which Claude discovered 493 issues across 25 projects. What’s new here: the cost per kilobyte and what reuse does to the total.

Our PHP piece reported that about 758,000 internet-facing servers run an end-of-life PHP branch that no longer receives security fixes, according to VirusTotal, after OpenAI said researchers working with its models helped uncover two critical flaws; its update added a Node.js flaw credited to OpenAI Codex Security. Our security week explainer counted nine AI-linked security cases reported between 19 and 22 October 2026.

Our Agent Skills piece reported that Anthropic says 1 million skills have been published and nearly 280 million installed, and that more than 70 agent platforms have integrated the standard. For verification, Theorem is publishing a Claude skill to help developers get started with verifying their own code, Anthropic said.

The Structural Read

As we read it, the post moves the question from whether AI can write formal proofs to who pays for them. Anthropic names hundreds of millions of tokens as the key limitation, and Theorem’s answer is reuse: a proof of a shared library such as OpenSSL can be reused by every package that depends on it.

As we read it, the sources show the cost falling on two measures at once. Anthropic reports that Opus 5.5 needed about 40% fewer tokens than Opus 5 to prove half of 36 tasks, and Theorem measured verification speed doubling about every two months between May and September 2026.

As we read it, the limits Anthropic lists matter to anyone relying on the proofs: they assume single-threaded static RISC-V binaries linked against musl libc, while Anthropic says most people run these libraries on x86 or ARM, dynamically linked against glibc.

Three Implications

FOR OPEN-SOURCE MAINTAINERS Theorem says qualifying projects pay nothing to enrol in OSS Verify, and that bugs found while proving are reported to them privately.

FOR SOFTWARE BUYERS Anthropic says the proofs assume single-threaded static RISC-V binaries linked against musl libc, while most people run these libraries on x86 or ARM with glibc.

FOR MODEL MAKERS Theorem’s total-cost projection assumes verification capability keeps doubling every two months, which it notes is four times as fast as Epoch AI’s eight-month estimate for language models in general.

The Business Engineer Lens

This story maps onto the Business Engineer framework The CFO’s Guide to the Token Economy.

The framework’s thesis: “The cost of intelligence is collapsing” while the cost of deploying intelligence is exploding.

As we read it, AI-written proofs fit that split: Anthropic reports fewer tokens per proof with each model, while Theorem’s estimate for verifying one software collection without reuse runs to about $190 billion. The framework was published in June 2026 and does not discuss formal verification.

What Is Not Established

The dollar figures are Theorem’s estimates at today’s rates, and the $134 million total is a projection that assumes model speed keeps doubling every two months; Theorem’s cost model measures x86 machine code in nixpkgs, while Anthropic’s proofs cover RISC-V binaries. Anthropic’s post describes the cost of its proofs in tokens; the dollar figures in this piece are Theorem’s. The 30 times and ten times ratios are our arithmetic. Nothing here is investment advice.

The Bottom Line

Anthropic said Claude proved 239 entry points across 123 libraries do not crash on inputs up to 64 MB in a few weeks, under stated assumptions, and named tokens as the key limitation. Theorem puts today’s cost at about $40 per kilobyte of machine code and estimates that sharing proofs cuts the cost of verifying all of nixpkgs from about $190 billion to about $6.4 billion, about 30 times by our arithmetic.