{"slug": "claude-finds-a-year-of-bugs-in-one-week-anthropic-says", "title": "Claude finds a year of bugs in one week, Anthropic says", "summary": "Anthropic and verification startup Theorem used Claude to formally prove security properties for more than 100 real-world open-source libraries down to RISC-V assembly code, an effort Anthropic calls the first large-scale verification of production software this way. Anthropic says Claude found bugs that had eluded detection for years despite trillions of test runs, including a rediscovery of CVE-2026-56132 in libexpat, and that verifying a widely used PDF reader surfaced as many security bugs in one week as are typically reported in a year. About 180 million lines of proof code back the work, with a typical proof running about 600,000 lines for binaries averaging 18,000 RISC-V instructions, and in a separate test the newer Opus 5.5 model solved half of 36 proof tasks using about 40% fewer tokens than Opus 5.", "body_md": "# Claude finds a year of bugs in one week, Anthropic says\n\nWorking with verification startup Theorem, Anthropic mathematically proved 100+ open-source libraries down to assembly code, and still found real bugs. Five more stories inside.\n\nToday's lead is Anthropic and Theorem using Claude to formally verify open-source code. It leads because machine-checked proofs of software used to be reserved for small codebases and specialists, and a tool that writes them at scale changes what \"tested\" can mean for the libraries you depend on. Also today: Claude Duet, Anthropic's proactive-agent app, opens to a US waitlist, two days after it drew the week's biggest Anthropic thread on Hacker News. Claude Platform launches generally available on Google Cloud, run by Anthropic. Anthropic's Agent Skills and OpenAI's Open Responses go to the Linux Foundation's agent body, in one announcement with two more projects. OpenAI's Decisions API leaves beta. And a Friday check on one Show HN project: Llmspeed, a calculator that predicts how fast a local model runs on a given GPU, under-predicts on three Hacker News commenters' own machines and gave a fourth no estimate at all.\n\n## What changed this week\n\n### Claude finds a year of bugs in one week, Anthropic says\n\nAnthropic and verification startup Theorem used Claude to formally prove security properties for more than 100 real-world open-source libraries, down to the assembly code level (RISC-V, a common chip instruction set). Anthropic calls it the first large-scale effort to verify production software this way. Claude found bugs that had eluded detection for years despite trillions of test runs, including a rediscovery of a known flaw, CVE-2026-56132, in libexpat. One bug needed a 64 MB input. Verifying a widely used PDF reader, Claude found as many security bugs in one week as are typically reported in a year, Anthropic says. About 180 million lines of proof code back the work, a typical proof running about 600,000 lines for binaries averaging 18,000 RISC-V instructions. In a separate test, Anthropic's newer Claude model, Opus 5.5, solved half of 36 proof tasks using about 40% fewer tokens than the older Opus 5.\n\n### Claude Duet, Anthropic's proactive agent app, opens to a US waitlist\n\nClaude Duet is Claude as a proactive agent, in a waitlisted preview: an app on phones and claude.ai that sends a morning brief, messages you when something needs you, and asks before acting for you. It runs on Opus 5.5 in its own virtual machine, so your laptop can be off. US Pro and Max subscribers join the waitlist. Usage counts against normal Claude limits. Anthropic built it for professionals and small business owners. Coding gets one passing mention.\n\n### Claude Platform is now generally available on Google Cloud\n\nAnthropic now sells the Claude Platform through Google Cloud, generally available and Anthropic-managed. Billing runs through Google Cloud. Anthropic operates the service and remains the data processor. It brings day-zero access to every Claude Platform feature: Claude Managed Agents, code execution, computer use and Fast Mode, which runs Opus 5.5 up to 2.5x faster, at $8 and $40 per million input and output tokens. A separate, Google-managed option, with Google as data processor, still exists for stricter data-residency needs.\n\n### Anthropic and OpenAI hand Agent Skills and Open Responses to the Linux Foundation\n\nThe Agentic AI Foundation, under the Linux Foundation, took in four projects: Agent Skills from Anthropic, Open Responses from OpenAI, OpenEnv from Hugging Face (training environments) and OpenSandbox from Alibaba (where agents run safely). Agent Skills is the SKILL.md folder format behind Claude Code's skills. Anthropic counts 70-plus platforms and nearly 280 million installs. Open Responses is a spec based on OpenAI's Responses API, so one integration works across providers. Nothing changes for skills you use today.\n\n### OpenAI's Decisions API goes generally available, on GPT-6 Luna only\n\nOpenAI's Decisions API, which answers fixed questions about text, images or JSON with typed results (a probability, a choice from a set, a score against a rubric) instead of free text, is out of public beta. OpenAI says it runs about 10x faster than the Responses API. New since the beta: prompt caching, JSON input, up to 400 questions per request (was 200) and usage reporting. One model supports it today, gpt-6-luna. It fits routing and classification inside agents.\n\n### Llmspeed under-predicts local-model speed on Hacker News commenters' own GPUs\n\nLlmspeed estimates how fast a local model runs on a GPU before you buy hardware. [Three commenters](https://news.ycombinator.com/item?id=50127979&ref=thenewway.ai), none its author, measured faster than it predicted on settings one of them says the site \"ignores\": \"60-70 tok/sec\" (tokens a second) on an RTX5090 against a predicted 46, \"like 80t/s\" on a 4090 against \"mid 20s\", and an M2 Ultra \"almost twice as fast\" as its M3 Ultra figure. A fourth got \"a fixed answer\" instead of an estimate. Tuned, expect more than it says.\n\n## Also worth your time\n\n- [GitHub Copilot in Visual Studio — September update](https://github.blog/changelog/2026-10-22-github-copilot-in-visual-studio-september-update-2?ref=thenewway.ai)\n- [Building agents: when to fold subagents into your main agent loop](https://claude.com/resources/articles/building-agents-when-to-fold-subagents-into-your-main-agent-loop?ref=thenewway.ai)\n\nKnow someone who'd want this in their inbox? Forward it — that's how this grows. And if we got something wrong, or you think we buried the real story today, hit reply. A person reads every one.\n\n*The New Way is written with AI. It gathers the day's stories, checks them against their sources and drafts every summary. A person decides what runs and reviews every issue before we hit send.*", "url": "https://wpnews.pro/news/claude-finds-a-year-of-bugs-in-one-week-anthropic-says", "canonical_source": "https://www.thenewway.ai/claude-finds-a-year-of-bugs-in-one-week/", "published_at": "2026-10-23 16:50:49+00:00", "updated_at": "2026-10-23 17:12:15.091342+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-agents", "ai-research"], "entities": ["Anthropic", "Theorem", "Claude", "Opus 5.5", "Opus 5", "libexpat", "CVE-2026-56132", "RISC-V"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/claude-finds-a-year-of-bugs-in-one-week-anthropic-says", "markdown": "https://wpnews.pro/news/claude-finds-a-year-of-bugs-in-one-week-anthropic-says.md", "text": "https://wpnews.pro/news/claude-finds-a-year-of-bugs-in-one-week-anthropic-says.txt", "jsonld": "https://wpnews.pro/news/claude-finds-a-year-of-bugs-in-one-week-anthropic-says.jsonld"}}