Project Formalization

Project Formalization is a self-reported project that claims to use AI-powered formal verification techniques to identify software vulnerabilities in open-source systems. The author states it combines frontier AI models with formal methods to scale vulnerability detection, particularly targeting C-based critical software. It operates through a multi-agent system using tools like CBMC, Lean, and SV-COMP.

The project is described as having been developed over a short timeframe (during an OpenAI hackathon) and has reportedly reproduced known vulnerabilities and found novel ones in projects such as curl and wolfSSL. The author emphasizes that the approach can scale to many subsystems with relatively low cost per run.

The description states that Project Formalization is a multi-agent system that uses AI models and formal verification tools (CBMC, Lean, SV-COMP) to detect software vulnerabilities. It operates by:

• Using a coordinator agent that spawns two agents with different framings:
  • One agent assumes there is a vulnerability and attempts to find it.
  • The other agent verifies if the subsystem satisfies safety properties.
• It targets specific subsystems or components of software, particularly in C-based systems.
• It claims to be able to replicate previously found vulnerabilities without internet access in 34 minutes and find novel 0-days in critical open-source software in less than an hour.

The system is described as being built using tools such as C, CBMC, Codex, Frama-C, KLEE, Lean, sanitizers, SOL, SV-COMP, Valgrind, and it was inspired by personal experiments with verifying a small application (tercih24.com) in Lean.

Inference: The system appears to be an experimental framework for combining AI reasoning with formal verification methods. It is not described as a commercial product or service but rather as a skill or pipeline built from experimentation.

The author states that Project Formalization operates at the intersection of AI cybersecurity and formal verification, aiming to democratize software defense by making it more scalable and cost-effective.

It positions itself as:

• A way to scale vulnerability detection in critical open-source software.
• A tool that can replicate known vulnerabilities and find novel 0-days.
• An approach that shifts the landscape of formal verification from being reserved for high-cost, high-stakes systems (like avionics) to a more accessible method.

The project is described as:

• A first concrete step toward a future with robust software.
• A tool that can be used to defend software before release, closing entire bug classes.
• An approach that uses AI to democratize formal verification.

Inference: The positioning is aspirational, suggesting a shift in how formal verification is approached. However, the claims are based on limited experimentation and not validated at scale or in production environments.

The description states that Project Formalization is aimed at:

• Developers and security teams working with critical open-source software.
• Users who want to defend their software before release, particularly in systems where vulnerabilities can have large-scale impacts (e.g., software running on billions of devices).

It specifically targets:

• C-based open-source projects due to the mature formal verification ecosystem for C.
• Systems that are memory-intensive or traceable, as these are easier for agents to reason about.

The author notes that the system is currently scoped narrowly, but plans to scale to other languages and tools (e.g., Lean).

Inference: The target customer appears to be security-focused developers or teams working with open-source software, particularly in environments where formal verification is needed but not yet widely adopted. However, no specific customer names or use cases are provided.

There is no evidence of a business model or pricing structure in the description. The author states that the project was built as part of a hackathon and is not yet a commercial product.

The description mentions:

• A single run with the harness is relatively cheap.
• Stacking many runs across subsystems converts into coverage.

However, there is no mention of:

• Pricing tiers
• Subscription models
• Licensing or usage fees
• Revenue streams

Inference: The business model is not described. It is unclear whether this will be offered as a SaaS product, a tool for internal use, or something else entirely.

The project uses:

• AI models (e.g., GPT 5.6 Sol)
• Formal verification tools: CBMC, Frama-C, KLEE, Lean, SV-COMP, Valgrind
• Multi-agent architecture with different framings to detect vulnerabilities
• A harness that can be applied across subsystems

It claims:

• To replicate known vulnerabilities without internet access in 34 minutes.
• To find novel 0-days in critical open-source software in less than an hour.
• That it can scale to many environments with minimal effort.

The system was built through iterative experimentation and is described as being "carefully crafted to a 'skill' with detailed transcript and result analysis."

Inference: The technical approach is experimental and based on combining AI with formal verification. It shows potential for automation but lacks evidence of production-ready delivery or scalability beyond the hackathon context.

The description states:

• The project was built during a short timeframe (OpenAI Build Week).
• It has reproduced known vulnerabilities and found novel ones in projects like curl and wolfSSL.
• It can replicate previously found vulnerabilities without internet access in 34 minutes.
• It can find 0-days in less than an hour.

However, there is no evidence of:

• Customers or users
• Revenue or monetization
• Product adoption or usage metrics
• Any commercial traction beyond the hackathon submission

The author notes that the project is still in an early stage and is aiming to scale to different languages and tools.

Inference: The project shows potential but lacks any evidence of traction, adoption, or commercial viability. It remains a proof-of-concept or experimental framework.

The description does not mention specific competitors. However, it positions itself in the intersection of AI and formal verification, which is a niche area with limited direct competition.

It claims to be:

• The first concrete step toward democratizing formal verification.
• A tool that can find vulnerabilities at scale using AI.

The broader context includes:

• Formal verification tools (e.g., CBMC, Frama-C, KLEE)
• AI-powered security tools
• Vulnerability detection in open-source software

There is no evidence of direct competitors or market positioning beyond the self-reported claims.

Inference: The competitive landscape is unclear. The project appears to be in a nascent space with limited known players, but there is no evidence of market presence or competitive differentiation.

• No traction or commercial viability: The project is described as a hackathon submission and lacks any evidence of customers, revenue, or adoption.
• Limited validation: Claims are based on experiments with limited scope and not validated at scale.
• Unclear business model: No pricing, licensing, or monetization strategy is provided.
• Highly experimental: The system is described as a skill built from experimentation, not a product ready for production use.
• Dependency on AI models: Reliance on AI models that may not be stable or scalable in real-world settings.
• No evidence of scalability beyond hackathon context: No indication that the approach can be scaled to enterprise or large-scale software.

Inference: The project is experimental and lacks commercial readiness. Risks include lack of traction, unclear monetization, and dependency on AI model performance.

1. What is the current state of the system beyond the hackathon? Is it being used internally or tested in any real-world environments?
2. How does the multi-agent approach handle false positives or false negatives? What validation steps are in place?
3. Are there plans to monetize this tool, and if so, what is the business model?
4. What are the limitations of the current system in terms of scalability and performance across different software types?
5. How does the project plan to evolve from a hackathon prototype into a product or service?
6. Are there any partnerships or collaborations with open-source projects or security teams that could validate its use?
7. What are the risks associated with relying on AI models for formal verification, especially in terms of model hallucination or inconsistency?