Finding bugs with Claude and property-based testing
Anthropic has developed an AI agent, built on Claude, that uses property-based testing to efficiently identify bugs in large software projects, successfully finding hundreds in popular Python libraries like NumPy, SciPy, and Pandas.
Intelligence analysis by Gemini 2.5 Flash
The AI agent infers general properties that code should uphold and then applies property-based testing, a technique similar to fuzz testing, to automatically generate diverse inputs and discover counterexamples. This method has uncovered numerous bugs, several of which have already been patched after a rigorous human validation process.
Imagine you have a super smart robot, like a helpful friend, that can read all the instructions for how a toy works. Instead of just checking if the toy works with one specific battery, this robot figures out all the general rules the toy should follow, like 'it should always roll forward on wheels.' Then, it tries the toy with all sorts of different batteries and surfaces to see if it ever breaks a rule. Anthropic's AI, Claude, does this for computer programs, finding hidden mistakes in big software like the ones used for math and data.
Analysis
Claude Code Command
Anthropic's research introduces an AI agent, built as a custom Claude Code command, designed to autonomously generate property-based tests. This agent is tasked with understanding target code—whether a single file, module, or function—by analyzing its structure, documentation, and relationships within the codebase. Its primary function is to propose general properties that the code should satisfy, based on its understanding.
Once properties are inferred, the Claude agent proceeds to write corresponding property-based tests using frameworks like Hypothesis. This approach moves beyond traditional example-based testing, where developers manually specify inputs, by allowing the AI to operate at a higher level of abstraction. The agent's ability to infer and test general invariants significantly reduces the burden on human developers to anticipate every possible edge case.
Property-Based Testing
Property-based testing represents a paradigm shift from example-based testing, focusing on verifying that general properties or invariants of a program hold true across a wide range of inputs. Unlike specific test cases, a property defines a fundamental characteristic, such as JSON deserialization being the inverse of serialization. The testing framework then automatically generates valid inputs, akin to fuzzing, to search for counterexamples that violate the specified property.
This methodology is particularly effective at uncovering logic bugs and edge cases that human developers might overlook during manual test case creation. The article highlights its application not just for general bugs but also for classes of logic bugs that can lead to security vulnerabilities, as demonstrated in previous work on smart contracts. By automating the generation of diverse test inputs, property-based testing, powered by AI, offers a more exhaustive and efficient bug-finding mechanism.
NumPy, SciPy, and Pandas
The efficacy of Anthropic's AI agent was demonstrated by its success in identifying hundreds of potential bugs within popular open-source Python repositories, specifically mentioning NumPy, SciPy, and Pandas. These libraries are foundational to data science, scientific computing, and numerical analysis, making their reliability critical across numerous applications and industries. The discovery of bugs in such widely used and well-maintained projects underscores the power of this AI-driven testing approach.
The process of disclosing these bugs involved a meticulous, multi-stage human validation to minimize false positives and avoid overburdening maintainers. Potential bugs were reviewed by multiple expert humans, and only those with high confidence in their validity were manually filed as issues with the respective repository maintainers. This rigorous validation ensures that the AI's findings are actionable and contribute positively to the open-source community, with several bugs already patched and many more in the disclosure pipeline.
Key points
- Anthropic developed an AI agent, built on Claude, to autonomously write property-based tests for existing code.
- The agent infers general code properties by analyzing type annotations, docstrings, function names, and comments.
- It successfully discovered hundreds of potential bugs in major open-source Python libraries including NumPy, SciPy, and Pandas.
- A rigorous multi-stage human validation process was implemented to ensure bug validity and reduce false positives before reporting.
- Property-based testing aims to verify general code invariants across diverse inputs, contrasting with example-based testing's specific test cases.
This development could lead to significantly more robust and secure software, as AI agents become adept at proactively identifying complex bugs and vulnerabilities that human developers might miss. It promises to accelerate the development cycle by automating a critical, time-consuming aspect of quality assurance, freeing up developers for more creative tasks.
Despite the AI's capabilities, the need for extensive human validation to filter false positives suggests that fully autonomous bug detection remains a challenge, potentially shifting the burden from bug discovery to bug verification. There's also a risk that AI might miss certain classes of subtle, context-dependent bugs, creating a false sense of security.
