AProver
The problem How it works Results Paper ▶ Open workbench
Agentic model checking · arXiv:2605.21434

AI can write the system.
AProver proves it correct.

An agent synthesizes a formal spec, a bounded model checker tries to break it, and every counterexample is replayed under a sanitizer before it counts. The result: real, confirmed bugs — not guesses — at a scale past human review.

▶ Open the workbench Read the paper agents propose · solvers verify
verifying · llm.c / dev
spent $0.42 · 18.3K tok
✓Spec
pre/post · dual-spec · 18 fns
✓Model check
cbmc · unwind 4 · 2 CEX
●Classify
replay under ASan…
○Report
tiers · call chains
confirmed rb_write out-of-bounds write · SIGSEGV under GCC harness · head = cap = 8
The problem

A short function you can read. A generated system you cannot.

The question is no longer “can the model write it?” — it’s “is what it wrote correct?” That’s easy for ten lines and impossible for ten thousand.

clamp.c
// keep x within [lo, hi]
int clamp(int x, int lo, int hi) {
  if (x < lo) return lo;
  if (x > hi) return hi;
  return x;
}
✓ looks correct — short enough to just read.
train_gpt2.c · 41 functions · 6 files
▲ bug threads a path — through many functions. You can’t check them one by one, and tests may never hit it.
How it works

An agent proposes. A solver decides.

The BMC-Agent synthesizes a spec, runs a bounded model checker, and refines via CEGAR until the verdict is solid — then pins each finding to a real, replayable path.

✦
LLM spec synthesis
caller-grounded pre / post conditions, dual-spec for soundness.
→
⚙
Bounded model check
CBMC · Kani · JBMC search every path for a counterexample.
→
⚕
Diagnose & replay
real bug or spec gap — confirmed crashes replayed under ASan.
CEGAR loop When a counterexample is spurious, the spec is refined and re-checked automatically — no false alarm ships.
The workbench

Built to survive an expensive run.

A single run burns real tokens and solver time. So every stage fails in place, partial results are always kept, and recovery is granular.

SPEND IN VIEW
Always know the bill
Tokens and dollars are tallied live against your cap — no surprise invoice at the end.
NOTHING WASTED
Partial results kept
Specs and harnesses cache to disk. A crash mid-run never throws away work you already paid for.
GRANULAR RECOVERY
Retry one function
Resume from a stage or re-run a single function instead of paying for the whole pipeline again.
Results · arXiv:2605.21434

Real, confirmed bugs.

57 confirmed, previously-unfixed
memory-safety defects across 10 open-source projects

Surfaced on mature, OSS-Fuzz-hardened software and present (unfixed) in each project's current HEAD — all human source-audited, 56 of 57 sanitizer-reproduced. The largest cluster is 31 defects in u-boot; two pointer-arithmetic UB bugs in jq are filed and accepted as upstream advisories (GHSA-ggc9-rpv2-xgpm, GHSA-gvwx-xj9r-3frq). The remainder are under coordinated disclosure.

evaluation benchmarks (LLM-generated, separate)
VibeOS kernel · 12 defects · 21 properties CCC compiler · ~50 KLoC Rust
confirmed real-world defects by project 57 total
OSS-Fuzz-integrated
u-boot C · CBMC · filesystem / EFI parsers 31
gpac C · CBMC · multimedia framework 9
libbej C · CBMC · Redfish BEJ decoder 4
jq C · CBMC · 2 advisories filed 2
libredwg C · CBMC · DWG/CAD reader 2
libarchive C · CBMC · archive formats 1
other open-source
libmikmod C · CBMC · module-audio loaders 4
libmodplug C · CBMC · module-audio loaders 2
adplug C · CBMC · AdLib-audio loaders 1
AWS Neuron C · CBMC · Trainium/Inferentia ioctl 1
✓ bounded clean-verify on hardened C
OpenSSL ASN.1 DER15 / 24
libxml2 pattern.c54 / 54
curl strparse.c8 / 20
protobuf upb decoders3 / 3
libxml2 encoding.c — 127 raw CBMC counterexamples reduced to 0 confirmed after the full pipeline.

Prove it correct.

Agents propose, solvers verify — sound by construction, and scaling past human review.

Paper
Agentic Model Checking
arXiv:2605.21434
© AProver · bounded model checking for AI-generated software sound by construction · bugs confirmed, not guessed