Sam: Anthropic just published results from what might be the most ambitious formal verification project anyone's attempted. They had Claude generate mathematical proofs of correctness for 123 open-source libraries — roughly 180 million lines of proof code. And in the process, it found bugs that years of conventional testing had missed. If you've ever worked with formal methods, you know the bottleneck has always been the human effort required to write proofs. This is a direct attack on that bottleneck.

Priya: Welcome to AI Revolution for Friday, October 23rd, 2026. I'm Priya Nair.

Sam: And I'm Sam Kim.

Priya: We've got a packed show today. We're going deep on that formal verification work from Anthropic, then we'll cover Google's new hardware-isolated runtime for AI agents, a genuinely alarming supply-chain breach where AI agents were used offensively at scale, and a pair of stories about AI agents and credential access that fit together in a really interesting way. Let's get into it.

Sam: So let's start with the Anthropic formal verification work, because I think a lot of people will read the headline and not fully appreciate what's happening here. Formal verification is fundamentally different from testing. When you write tests, you're checking specific inputs against expected outputs. You might have great coverage, but you're always sampling from the space of possible behaviors. Formal verification is mathematically proving that a piece of code satisfies a property for all possible inputs. It's the difference between checking a thousand points on a curve and proving the equation of the curve itself.

Priya: And historically, the reason formal verification hasn't been widely adopted outside of aerospace, cryptography, and a few other domains is cost. Writing those proofs is painstaking, specialized work. You need expertise in proof assistants like Coq or Lean or Isabelle, and the proof code is often several times longer than the source code you're verifying.

Sam: Right. So what Anthropic did is essentially use Claude as a proof engineer at scale. 180 million lines of proof code across 123 libraries. To put that in perspective, the entire Lean mathlib — which is the largest single body of formalized mathematics, built by hundreds of contributors over years — is on the order of a few million lines. What Claude generated here is orders of magnitude larger, albeit in a different domain — software correctness rather than pure mathematics.

Priya: And the practical payoff is concrete. It found bugs that conventional testing missed. These are libraries that have been in production, fuzzed, tested, reviewed by humans — and the formal verification process still surfaced issues. That's exactly the value proposition: proofs catch the edge cases that no amount of testing will reliably find.

Sam: The ambition Anthropic is stating — making formal verification as routine as unit testing — is worth taking seriously as a direction even if we're not there yet. The question is how general this is. Writing proofs for well-structured library code with clear specifications is one thing. Doing it for a sprawling microservices architecture with complex state and IO is a much harder problem. But as a supply chain security measure, verifying widely-used open-source libraries is exactly where you'd want to start.

Priya: If this scales, and if the proofs are themselves trustworthy — which is a key assumption since the proof checker is the ground truth, not the LLM — then you could imagine a world where publishing a library without formal verification is like publishing without tests. That's a meaningful shift in the baseline for software correctness.

Sam: Now let's talk about Google's Agent Compute Engine, because this sits at the intersection of two important trends: the proliferation of AI agents and the need to contain them. Google announced a runtime that gives every Gemini agent its own hardware-isolated micro virtual machine.

Priya: So let me unpack what that means architecturally. Today, when you run an AI agent, it typically executes in some sandboxed environment — maybe a container, maybe a restricted process. But containers share a kernel with the host, and the isolation boundaries are enforced in software. A micro VM is a different model. Each agent gets what is effectively its own minimal virtual machine with hardware-level isolation enforced by the hypervisor. The blast radius if an agent does something unexpected is contained at the hardware boundary, not just at a software policy boundary.

Sam: This matters because agents are increasingly doing things in the real world — executing code, making API calls, accessing databases. The failure modes are different from a chatbot generating text. If an agent has a tool-use capability and it goes sideways, you want the containment to be as strong as possible.

Priya: Google also built this as a purpose-built agent runtime rather than adapting existing compute infrastructure. That distinction matters. It means the governance primitives — monitoring, access control, audit logging — are designed around agent-specific concerns from the start. And it works across cloud, hybrid, and on-prem, which is where enterprises actually live.

Sam: The timing here is relevant given our next story. TechCrunch is reporting that a China-aligned threat actor breached ConnectWise and then used AI agents to rapidly compromise thousands of ConnectWise's downstream customers. Microsoft attributed the campaign and specifically called out AI agent use as a key enabler of the attack's speed and scale.

Priya: This is significant. ConnectWise is a remote management and monitoring platform — it's the kind of tool that managed service providers use to administer their clients' IT environments. So breaching ConnectWise gives you a hub-and-spoke topology: one compromise fans out to potentially thousands of targets. Supply-chain attacks through these kinds of platforms aren't new — we saw it with Kaseya, with SolarWinds. What's new is the operational tempo that AI agents enabled.

Sam: In a traditional supply-chain intrusion, lateral movement at scale requires human operators or pre-scripted tooling that's relatively rigid. What Microsoft's attribution describes is AI agents handling the reconnaissance, adaptation, and exploitation across diverse target environments autonomously. That compresses timelines dramatically. Instead of a team of operators spending weeks or months working through each downstream target, you have agents parallelizing the work.

Priya: And this is one of those cases where the offensive advantage of AI is very concrete. The attacker doesn't need the agent to be perfect — it just needs to be good enough across enough targets to be worthwhile. The defender, meanwhile, has to be right every time.

Sam: So connecting this back to Google's Agent Compute Engine — the containment question isn't just about your own agents behaving correctly. It's about what happens when adversarial agents are operating in your environment. Hardware isolation becomes a defensive architecture concern, not just a reliability one.

Priya: Let's shift to a pair of stories that fit together really well. First, 1Password has launched a feature that lets AI agents authenticate to services on behalf of users without the agent ever seeing or storing the actual password. Second, major US banks — including Morgan Stanley and JPMorgan — are actively blocking or restricting AI agents that log in with customer credentials.

Sam: The 1Password approach is architecturally interesting. The agent never receives plaintext credentials. Instead, 1Password's infrastructure acts as a credential proxy — it handles the authentication flow, and the agent gets an authenticated session without ever having access to the secret itself. It's a form of credential delegation where the trust boundary keeps the secrets opaque to the agent runtime.

Priya: This is solving a real problem. If you're deploying agents that need to interact with authenticated services — booking travel, managing subscriptions, accessing internal tools — the naive approach is to give the agent your username and password. Which is terrible from a security standpoint. The agent's context window, its memory, its logs — all become potential exfiltration surfaces for credentials.

Sam: The banking story shows what happens when that naive approach meets an industry with serious regulatory obligations. Morgan Stanley has outright blocked agent access. Others like JPMorgan are restricting agents to read-only access as an interim measure. And there are reports of agents accessing accounts without explicit user instruction in some cases, which is exactly the kind of unauthorized access that triggers regulatory scrutiny.

Priya: What's interesting is the divergence in responses. Morgan Stanley went full block. Others are trying to find a middle ground with read-only restrictions. That tells you the industry hasn't converged on a framework for agent identity and access management. We're in the "figure it out as we go" phase.

Sam: The 1Password credential-proxy model is one answer. OAuth-style delegated authorization is another — give the agent a scoped token, not your credentials. But the fundamental question is: how do you express and enforce what an agent is allowed to do on your behalf? That's an unsolved identity problem at scale.

Priya: Two quick hits before we look ahead. OpenAI has made its decision model generally available to developers and enterprises — this is their competitor to Jev in the structured reasoning and agentic decision-making category. Worth watching how adoption plays out, but the specifics of what's technically different under the hood are still thin.

Sam: And OpenAI is reportedly working on a $30 billion raise at a $1.25 trillion valuation ahead of an IPO. If that holds, it would be the most highly valued private company ever. There are reports the valuation target has been trimmed in negotiations, so this is still in flux.

Priya: One more — Recursive, a startup founded by ex-DeepMind researchers, released Flint, a 40-billion-parameter mixture-of-experts coding model. The interesting claim isn't the model itself but their methodology: an internal AI system they call the Eureka Machine that autonomously tests and optimizes model architectures. They built Flint in four months using this approach. No independent validation yet of whether the methodology actually produces better results, so we're noting it but reserving judgment.

Sam: Looking ahead, I think today's stories paint a picture of a specific moment. We have AI being used to prove software correct at a scale that was previously impractical. We have AI agents being used offensively in real supply-chain attacks. We have financial institutions scrambling to figure out how to handle agent access to customer accounts. And we have infrastructure providers building hardware-level containment for agents. These are all facets of the same transition — AI agents are becoming real actors in real systems, and the security, identity, and correctness infrastructure hasn't caught up yet.

Priya: The formal verification work is encouraging because it points toward a future where AI helps close some of these gaps. But the ConnectWise breach is a reminder that adversaries are moving fast too. The credential delegation problem — how do you let agents act on your behalf without giving away the keys — is going to be one of the defining infrastructure challenges of the next couple of years. We're watching the standards and patterns emerge in real time.

Sam: The thing I'd watch most closely is whether formal verification actually gets integrated into CI/CD pipelines in practice. If Anthropic can make that workflow real — not just for 123 libraries in a research project, but as something any team can run on their own codebase — that changes the economics of software correctness fundamentally. But there's a long road between a research demonstration and a developer tool that works reliably at the messy edges of real codebases.

Priya: Agreed. And on the agent identity side, I'd watch for whether OAuth-style patterns or something like the 1Password proxy model starts to become a standard. The banks blocking agents entirely isn't a sustainable answer — customers want this functionality. The question is what the safe plumbing looks like.

Sam: That's our show for today. Show notes and links to all the stories we covered are at cleartext.fm.

Priya: Have a great weekend, everyone. We'll see you Monday.