Skip to content
Today
Sections

Build Also reported elsewhere2 publishers 2 min read Published

Lean's guarantee ends at 8,000 lines of C++ and its dependencies

The Clay Mathematics Institute has the claimed Navier-Stokes solution under review, and a summer of agent-found bugs in Lean's kernel shows how narrow the guarantee a Lean certificate actually gives.

The Engineer · Build desk

Send a correction

Illustration accompanying Lean's guarantee ends at 8,000 lines of C++ and its dependencies
Generated illustration

What happened

  • The Clay Mathematics Institute said the Navier-Stokes problem has apparently been settled, and that it hopes the innovations behind the work will now be analyzed and interrogated.
  • The Lean Focused Research Organization, working with OpenAI, ran a systematic AI-assisted search of the Lean kernel that uncovered six new soundness bugs and changed several of the organization's security practices.
  • Patrick Hulin's GPT-5.6 Sol found a Lean kernel soundness issue after three and a half hours of work on a single bug-finding prompt.
  • Mathematician Tristan Buckmaster accuses OpenAI of redirecting resources to the problem after rumors of his research leaked, of using his drafts in training data, and of rejecting his co-author from authorship.

Why it matters

  • What it costs cost An agent-written formalization costs a reviewer two audits: the mathematics, and the C++ path through the kernel that accepted the term.
  • Who's exposed exposure Anyone building on a fresh agent-produced formalization carries the retraction risk the LessWrong author prices at 75 percent over the next year.
  • What doesn't add up contradiction The Clay Mathematics Institute frames faster machine-assisted mathematics as grounds for anticipation, while the LessWrong letter argues the agent-swarm case is exactly where a Lean certificate deserves less weight.
  • Who has to decide decision The million-dollar prize decision stays with the institute's reviewers on their own timetable, so the Lean check enters that process as evidence and does not close it.

A Lean proof is a term, and checking it means the kernel decides whether that term has the type the theorem claims. The deciding code is src/kernel, about 8,000 lines of C++ implementing Lean's type theory, and it is not self-contained: it calls out to external libraries, among them GMP for fast arithmetic on large integers [14]. The kernel is correct only if those dependencies are, down to GMP's implementation of the Fast Fourier Transform [15].

An agent optimizing for a term that Lean accepts is searching that acceptance test, not the mathematics behind it. Patrick Hulin pointed an agent at the test directly: "i'd like to audit the lean kernel. see if you can find an assumption-free proof of false. your primary task should be reading the source code and docs and building an understanding of how the kernel works to find the seams. treat this like a cybersecurity task." [10] The bug it came back with, pull request #14498, exploited a type-checking oversight [11].

Add the six bugs from the Lean Focused Research Organization's search to Hulin's and to Ramana Kumar's, and at least eight soundness bugs surfaced in one summer [22]. Two of the six came from faulty interactions with external dependencies, one in three [23]. Leo de Moura, Lean's creator, said: "[False statements being accepted by Lean] is going to keep happening. AIs are really good at exploiting soundness bugs in the kernels" [4].

Kumar released and circulated his result as a proof of the Collatz conjecture, and he knew at the time of posting that it was a soundness bug [12]. Lean's design favors runtime efficiency at the cost of greater logical complexity, which the post says makes Lean, and Lean4 in particular, more bug-prone than other formal verifiers [6].

None of that says the Navier-Stokes proof is wrong. The author of the LessWrong letter writes that the proof is likely correct, does not trust it on the strength of Lean alone, and says peer review is not yet complete [3]. OpenAI announced the result early this week, according to that post [1]. The Clay Mathematics Institute has the solution under review and wrote that "The process is deliberately unhurried, but we will provide updates" [18].

For "verified in Lean" to carry what a referee report carries, someone has to have checked the kernel path that a particular proof exercised. Mario Carneiro's Lean4Lean, a formalization of Lean's foundations inside Lean, is the project aimed at that, and the post says the most bug-prone parts of those foundations have yet to be incorporated into it [7].

What to watch

  • Whether the Lean4 C++ codebase takes another soundness patch inside 12 months, which the post prices at 95 percent.
  • Whether the Clay Mathematics Institute's review cites the Lean formalization as evidence, and what date it reports on.
  • Whether the most bug-prone parts of Lean's foundations get incorporated into Lean4Lean, giving reviewers an independent recheck.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption60
Hype gap+30
Incentives68
Confidence58
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    The LessWrong post says that early this week OpenAI announced it had resolved the Navier-Stokes problem.

    Reported Supported Source: LessWrong post 'Don't trust Lean4 alone'View cited source
  2. [2]

    The post argues that Lean can be wrong and that Lean should be trusted less specially in the case of difficult problems solved by agent swarms.

    Reported SupportedView cited source
  3. [3]

    The post says the proof of Navier-Stokes is likely correct, but that the author does not trust it just because of Lean, and that the peer review of Navier-Stokes is not yet complete despite the Lean proof.

    Reported SupportedView cited source
  4. [4]

    Leo de Moura, Lean's creator, quoted in the post: "[False statements being accepted by Lean] is going to keep happening. AIs are really good at exploiting soundness bugs in the kernels"

    Reported SupportedView cited source
  5. [5]

    The post's author gives a 95 percent chance that in the next 12 months the Lean4 C++ codebase is patched for at least one soundness bug.

    Reported SupportedView cited source
  6. [6]

    The design philosophy behind Lean is to be maximally runtime efficient at the expense of being more logically complex, and as such Lean, and particularly Lean4, is more bug-prone than other formal verifiers.

    Reported SupportedView cited source
  7. [7]

    Mario Carneiro launched Lean4Lean, a Lean formalization of the foundations of Lean; the project is ongoing and the most bug-prone parts of the Lean foundations have yet to be incorporated into it.

    Reported SupportedView cited source
  8. [8]

    In the last few months, summer 2026, there has been a renaissance of Lean bug-finding due to increased AI capabilities.

    Reported SupportedView cited source
  9. [9]

    Patrick Hulin's GPT-5.6 Sol found a Lean soundness issue after 3.5 hours of work on a bug-finding prompt.

    Reported SupportedView cited source
  10. [10]

    Patrick Hulin's bug-finding prompt: "i'd like to audit the lean kernel. see if you can find an assumption-free proof of false. your primary task should be reading the source code and docs and building an understanding of how the kernel works to find the seams. treat this like a cybersecurity task."

    Reported SupportedView cited source
  11. [11]

    The bug found by Patrick Hulin, pull request #14498, exploited a type-checking oversight.

    Reported SupportedView cited source
  12. [12]

    A Lean soundness bug found by Ramana Kumar was released and circulated under the guise of being a proof of the Collatz conjecture, though at the time of posting Kumar knew it was a soundness bug.

    Reported SupportedView cited source
  13. [13]

    The Lean Focused Research Organization, in partnership with OpenAI, launched a systematic AI-assisted search for bugs in the Lean kernel; the search uncovered six new soundness bugs and prompted the organization to change several of its security practices.

    Reported SupportedView cited source
  14. [14]

    The Lean4 repository contains a file called src/kernel, about 8,000 lines of code, which contains an implementation of the Lean type theory; the src/kernel code is not self-contained and uses external libraries such as GMP for fast arithmetic with large integers. Lean4 is implemented in C++.

    Reported SupportedView cited source
  15. [15]

    The correctness of the Lean kernel depends on the correctness of all of its dependencies; for instance its soundness relies on GMP's implementation of the Fast Fourier Transform being correct.

    Reported SupportedView cited source
  16. [16]

    Faulty interactions with external dependencies were the source of two of the bugs found in the recent bug hunt, #14838 and #14833.

    Reported SupportedView cited source
  17. [17]

    The Clay Mathematics Institute says "the Navier-Stokes problem has apparently been settled" and hopes "to see waves of new human understanding unleashed as the innovations behind this work are analyzed and interrogated."

    Reported SupportedView cited source
  18. [18]

    The solution is now under review, and the Clay Mathematics Institute writes: "The process is deliberately unhurried, but we will provide updates."

    Reported SupportedView cited source
  19. [19]

    Navier-Stokes is one of seven Millennium Prize Problems announced in Paris in 2000, each worth $1 million, and asks whether the equations governing fluid motion in three-dimensional space always have a smooth, complete solution.

    Reported SupportedView cited source
  20. [20]

    Mathematician Tristan Buckmaster accuses OpenAI of redirecting resources toward the problem after rumors about his research leaked, using his drafts in training data, and rejecting his co-author Levent Alpoge, who works at Anthropic, from authorship.

    Reported SupportedView cited source
  21. [21]

    The Clay Mathematics Institute notes that the "increasing ability of new technologies to accelerate mathematical research has heightened this sense of anticipation."

    Reported SupportedView cited source
  22. [22]

    At least eight Lean soundness bugs surfaced in the summer 2026 wave: the six from the Lean Focused Research Organization's search, plus Hulin's and Kumar's.

    Derived Supported
  23. [23]

    Two of the six bugs from the systematic search came from faulty interactions with external dependencies, one in three.

    Derived Supported
  24. [24]

    The post's author gives a 75 percent chance that in the next year a formalized result of a major theorem will be publicly circulated and later retracted due to a Lean bug knowingly exploited by the agent which generated it.

    Reported InsufficientView cited source

Sources

2 independent publishers whose own reporting we read for this story.

  1. lesswrong.com

    1 article · September 16, 2026

    Don't trust Lean4 alone
  2. the-decoder.com

    1 article · September 14, 2026

    Clay Mathematics Institute says the Navier-Stokes Millennium Prize Problem has "apparently been settled"

Topics and entities

Topics

Entities