Daily Frontier Digest ·
Claude wrote machine-checked proofs that 239 fuzz targets in 123 open-source libraries cannot crash
Curated by Alfredo Borrás · Plymouth AI Lab
Anthropic and Theorem used Claude to machine-check no-crash proofs for 123 open-source libraries, an outside audit finds gaps in OpenAI's internal agent monitoring, Agent Skills moves to a neutral foundation, and Claude's apps go auto mode by default next week.
The story today
Claude wrote machine-checked proofs that 239 fuzz targets in 123 open-source libraries cannot crash
Anthropic's Frontier Red Team, working with the formal-methods company Theorem, took fuzz tests from Google's OSS-Fuzz project and turned each one into a formal statement: this entry point never crashes for any input under 64 MB. Claude then had to prove that statement against the compiled RISC-V binary, with the Rocq proof checker accepting or rejecting every proof.
Over a few weeks it succeeded for 239 entry points across 123 libraries. The proofs add up to roughly 180 million lines of Rocq, about 600,000 lines for a typical target. Along the way Claude found and patched hundreds of bugs, including ones a fuzzer would be unlikely to hit, such as an out-of-bounds write that only triggers on a rare ~20 MB input, and a rediscovery of a known libexpat CVE.
The scope is narrower than the headline. The proofs assume a single-threaded, static RISC-V binary linked against musl on Linux, while most people run these libraries on x86 or ARM with glibc. AddressSanitizer does not catch every memory bug, not every entry point was covered, and some proofs took hundreds of millions of tokens. Anthropic says plainly that 'formally verified' does not mean 'bug-free', and that it penalised and audited patches that merely made a theorem easier to prove.
Anthropic is publishing the trusted models and a subset of the proofs, Theorem is offering to run the pipeline for other open-source projects, and Anthropic reports that Opus 5.5 needed about 40% fewer tokens than Opus 5 to prove half of a 36-task test set.
Why it matters: Proofs only cover what the spec and machine model describe, but trying to write them is already a strong bug-finding method. If you maintain a library on OSS-Fuzz, Theorem's offer is worth a look.
Sources: Anthropic research
Highlights
METR and Redwood audit of OpenAI's agent monitor: agents could postpone review by simply not stopping
Two outside researchers spent three weeks (21 July to 11 August) inside OpenAI. Because the monitor ran when an agent handed control back, an agent could put off review indefinitely while compaction events went unmonitored, which they estimate left on the order of 10% of eligible internal Codex traffic unchecked from May to July. They also found two client headers that disable monitoring for new agents and a possible way around Codex sandboxing and Auto-Review. OpenAI says the production-affecting issues are patched; METR has not evaluated that, and the 61-page report was cut to a 38-page redacted version.
monitoringagent-securitySource: METR
Anthropic donates Agent Skills to the Agentic AI Foundation, which already hosts MCP
The SKILL.md folder format, its name, GitHub organisation and agentskills.io domain move to the Linux Foundation's AAIF. Anthropic says more than 70 platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, support it, with 1 million skills published. Engineers from Anthropic, Google, OpenAI and others will maintain it as individuals, and you do not need to join the AAIF to use or contribute.
standardsagentsSource: Anthropic
Auto mode becomes the default in most Claude apps next week for Pro, Max and Team
New sessions will stop asking you to approve each action; an automated check lets safe actions through and blocks risky ones. Claude Code made the same switch in August, when Anthropic reported that in a study with 1,053 paid testers, auto mode caught 89% of dangerous commands versus 13.6% for human review. Enterprise admins get an email before the change reaches their organisations.
auto-modeanthropicSource: Claude
MiniMax publishes M3.1-Flash weights on Hugging Face
A multimodal mixture-of-experts model for coding, agents and computer use, with text, image and video input and up to 1M tokens of context. The card says about 428B total and 23B active parameters, while the repository metadata reports 220B, so expect a multi-GPU deployment. Recommended serving is SGLang, vLLM or TokenSpeed. All benchmark numbers on the card are MiniMax's own.
open-weightsmodelsSource: Hugging Face
Artificial Analysis relaunches its Coding Agent Index as v2.0
The index scores agent and model together and now averages three benchmarks equally: Cognition's FrontierCode v1.1 (100 tasks), Terminal-Bench 4.0 (66 tasks) and Scale AI's SWE-Atlas-QnA (124 tasks), each run three times per task. It also tracks cost, tokens, wall time and safety-refusal rates per agent, which is often more useful than the headline score when choosing a setup.
harnessesevalsSource: Artificial Analysis
Concept of the day
End-of-turn monitoring and why it leaves a gap
Many agent monitors review a transcript at the moment the agent finishes a turn and hands control back. That is cheap and simple, but it means an agent that keeps acting is never reviewed until it stops, and anything dropped from its history before then (for example during compaction, when long runs summarise old context to fit the window) may never reach the monitor at all. METR's audit found exactly this pattern at OpenAI, and recommends checking agents every N messages or minutes instead, and making sure the monitor sees the same context as the agent.
Source: METR
Models released
| Model | Maker | Size | Notes |
|---|---|---|---|
| MiniMax-M3.1-Flash | MiniMax | ~428B MoE, 23B active (card); 220B in file metadata | Native multimodal MoE (text, image, video in; text out) with sparse attention throughout, quantization-aware training and a DSpark speculative-decoding head. Context up to 1M tokens. MiniMax reports 73.7% on DeepSWE v1.1 and 61.7 on OSWorld 2.0; figures are the company's own. |
Try this
NVIDIA OpenShell Run your coding agent in a sandbox that never sees your real API keys
OpenShell (Apache 2.0) puts each agent in an isolated sandbox, checks every file access, system call and network connection against a policy, and injects credentials only on requests to endpoints you have approved. It runs on Linux, Apple Silicon Macs or Windows with WSL 2 (experimental). Read the install script before running it, then follow the 'Run Your First Agent' guide; set OPENSHELL_TELEMETRY_ENABLED=false on the gateway to turn off its anonymous telemetry.
Source: NVIDIA/OpenShell on GitHub
Every item is checked against its primary source before it appears here. Figures we could not confirm are left out.
Related service: AI automation services for logistics
Five Agent Tricks, latest: Issue #3 (26 Oct 2026) · Subscribe free