Closing Time: AI learns to prove code is safe
Anthropic says Claude wrote machine-checked proofs that programs in 123 open-source libraries cannot crash under defined conditions, and found bugs along the way that had survived years of testing.
Good afternoon. After a week in which AI helped uncover some of the worst security holes the internet has seen, Anthropic showed that AI can also do the opposite job and prove that code is safe. Investors spent Friday buying security stocks. Here is what mattered today.
Anthropic says Claude wrote machine-checked proofs that programs in 123 open-source libraries cannot crash under defined conditions, and found bugs along the way that had survived years of testing.
Amazon says the AI-discovered PHP2Shell flaws are now being broadly exploited, and that the first attempt hit one of its decoy servers four days before patches came out, BleepingComputer reports.
Meta pushed back new business terms from October 30 to November 20 after news publishers objected that they could allow broad scraping of their sites for AI, The Verge reports.
Stocks slipped as oil prices climbed, the Associated Press reports, and the Dow closed down 1.2% while cybersecurity shares rallied.
AI learns to prove code is safe
Most of the AI security news this year has been about finding bugs. On Thursday, Anthropic published research on a harder problem, which is proving that a piece of software has no bugs of a certain kind at all.
Working with a startup called Theorem, Anthropic asked Claude to write formal proofs, a kind of mathematical argument that a computer can check line by line. Claude proved that 239 entry points across 123 widely used open-source libraries will always exit normally, without memory-safety errors or failed checks, for every input smaller than 64 megabytes.
The scale is the news. Formal verification has existed for decades, but it usually takes experts years to verify even a small program, so almost nobody uses it on everyday software. Claude produced about 180 million lines of checked proof in a few weeks, with a typical proof running to around 600,000 lines.
Along the way, Claude found and fixed bugs that had gone unnoticed for years, despite trillions of automated test runs. That is the practical difference between testing and proving. A test tries many inputs and hopes it hits the bad one, while a proof covers every input within the rules it sets.
The rules are narrow for now. The proofs apply to compiled programs running on a RISC-V processor under a modeled version of Linux, as single-threaded programs with a fixed memory budget. Most servers and phones run on other chip designs, and Anthropic says plainly that formally verified does not mean bug-free. Theorem is offering to run the same process for other open-source projects and is publishing a Claude skill to help developers try it on their own code.
The timing matters. This week, flaws in PHP that AI helped uncover sent companies and governments scrambling to patch, and Amazon now says attackers began probing them four days before the fixes shipped, according to BleepingComputer. If AI makes bugs cheaper to find for attackers and defenders alike, proofs that whole classes of bugs are absent may become one of the few defenses that keeps up.
Elsewhere in AI today
Bloomberg reports that Anthropic’s planned IPO is set to deliver huge gains for its early backers. Spark Capital’s $75 million investment from 2023 is now valued at about $7 billion, and Iconiq’s more than $6 billion in investments is worth about $17 billion.
TechCrunch reports that MIT researchers left 13 AI agents running on Claude Opus 4.7 alone on a simulated desert island for 30 hours with no task. The agents began inventing challenges of their own, and afterward they generally beat identical agents that had never visited the island when both were given specific jobs.
A new Pew Research Center survey of 5,273 U.S. adults found that only 8% have used AI chatbots to look for information about the 2026 elections. Among those who have, 76% asked about candidates’ positions on issues and 71% used the chatbots to fact-check claims.
Markets
Stocks mostly slipped on Friday as rising oil prices weighed on the market, according to the Associated Press. The Dow fell 1.2% and the S&P 500 lost 0.5%, while the Nasdaq finished down 0.2%. Chip stocks steadied after Thursday’s sell-off, and the Philadelphia semiconductor index ended up 0.4%. Of the 86 AI and tech stocks we track, 51 closed higher.
Security stocks led the winners. CrowdStrike rose 8.2%, Cloudflare gained 7.4%, Zscaler added 7.3%, Palo Alto Networks climbed 7.2% and SentinelOne rose 6.7%, at the end of a week dominated by AI-powered security threats.
On the other side, Accenture fell 3.6% and Intuit lost 3.2%, while Adobe dropped 2.5%, giving back part of Thursday’s gains for all three. Hardware makers Celestica and Western Digital fell 3.4% and 3.0%.
Biggest winners
| Ticker | Name | Price | Day |
|---|---|---|---|
| CRWD | CrowdStrike | 257.57 | +8.25% |
| NET | Cloudflare | 326.00 | +7.37% |
| ZS | Zscaler | 255.15 | +7.31% |
| PANW | Palo Alto Networks | 380.55 | +7.22% |
| S | SentinelOne | 24.00 | +6.65% |
Biggest losers
| Ticker | Name | Price | Day |
|---|---|---|---|
| ACN | Accenture | 249.43 | -3.60% |
| CLS | Celestica | 259.98 | -3.36% |
| INTU | Intuit | 343.39 | -3.24% |
| WDC | Western Digital | 343.67 | -2.97% |
| ADBE | Adobe | 263.82 | -2.49% |
Prices are Friday’s U.S. closing prices, October 23, 2026, versus Thursday’s close. Market data is a snapshot, not live.
Aigentic Exclusive
FEATURED DEEP DIVE
Flapping Airplanes and the Business of More Efficient AI
A two-dozen-person research lab just raised $1 billion at a reported $6 billion valuation to make AI learn from far less data. We look at what Flapping Airplanes is building, who its three founders are, and what it will take to turn the research into a business.
Watch
Fireship — The most vulnerable week in internet history...
Fireship runs through a brutal week for internet security, starting with the PHP2Shell flaws and moving on to a backdoored Python package with 23 million weekly downloads and a GitLab bug that dates back to 2014.
It also covers the rogue AI agents turning up inside bank accounts, which makes it a quick way to see how many of this week’s problems connect.
Watch this for a fast recap of why so many security teams had a long week.
The AI Daily Brief — The AI vs AI Battle for the Internet
NLW argues that cybersecurity may be entering an era where AI faces off against AI, and he uses the PHP2Shell exploit as the clearest example so far.
He also breaks down the Railway and OpenCode breaches and explains why coordinated swarms of agents may decide who wins on defense.
Watch this for the big-picture case behind today’s lead story.
No Priors — Democratizing Security for the Agentic Web with CloudFlare CTO Dane Knecht
Sarah Guo talks with Cloudflare CTO Dane Knecht, live from Cloudflare Connect, about how security became an afterthought as the web fills up with AI agents.
Knecht explains how attackers are changing and how Cloudflare is putting its engineering resources toward the problem.
Watch this to hear how one of the companies that carries a big share of web traffic thinks about defending it.
Matt Wolfe — AI News: 24 Things You Need To Know This Week
Matt Wolfe rounds up the AI news you may have missed this week, from Anthropic’s Claude Duet launch to the latest OpenAI updates.
He also spends time on the AI-powered security threats that dominated the week.
Watch this if you want to catch up on the whole week in one sitting before Monday.