AI NewsProductivityAnnouncement
Thomas Hales lists this year's Lean soundness bugs
Thomas Hales, writing on Terence Tao's blog, says Lean's kernel has had several soundness bugs this year, one of which produced a false disproof of the Collatz conjecture, and no public proof covers the theory Lean rests on; the warning lands as AI tools have begun writing Lean faster than any human can read it, including 13 million lines of Lean for one theorem in 11 days.
Why it mattersAn automated check is only as strong as the thing checking it. A team shipping AI-written output that passes a verifier is shipping two pieces of software, and if nobody has read the verifier the pass tells you less than it looks like it does.
A Lean proof the kernel has not checked is not a proof. That is the line Thomas Hales draws in a guest post on Terence Tao's blog on 9 October 2026, aimed at mathematicians starting to use AI tools that write Lean, and worth reading for anyone else shipping software whose output is checked by another piece of software they did not write.
Lean is a programming language and a proof assistant: a mathematician states a theorem and writes a proof in it, and a small program called the kernel reads the proof and says yes or no. The attraction, and the reason AI vendors are now writing Lean at speed, is that the yes is machine checkable and does not depend on a human reading the argument. Hales's post asks what that yes is worth in October 2026.
Several soundness bugs this summer
A soundness bug is a bug that lets Lean say yes to a proof that is wrong. Hales lists two pre-release ones in Lean 4 (which shipped in September 2023), one overflow bug in May 2025, and "several soundness bugs in Lean were uncovered in July and August", including by Ramana Kumar and Dan Selsam at OpenAI. One of them, Hales writes, "led to an illicit disproof of the Collatz conjecture. I learned of the bug this summer when it produced a short illicit proof of the Kepler conjecture in Lean." Kepler is a theorem Hales himself proved and then spent 11 years formalising in a different system.
He also notes that the type theory Lean sits on top of is not yet proved consistent in a stronger system. "As of October, 2026, I know of no complete, public relative-consistency proof covering Lean abstract type theory." Mathlib, the main library, is "nearly 300,000 theorems, over 100,000 definitions, 2.5 million lines of code, with over 700 contributors", so the places a soundness bug can hide are many.
Thirteen million lines in eleven days
Hales also notes what AI has started doing with Lean. "Particularly noteworthy is the autoformalization of Fermat's Last Theorem, announced by Anthropic on September 4. This project generated 13 million lines of Lean in 11 days." A sphere-packing project generated "about 500K SLOC that golfing (or code pruning) later reduced to about 200K lines". A mistranslation keeps the Lean proof valid as Lean code and still fails the task, Hales writes, because the Lean proof then proves a different theorem than the one in the paper.
Two recommendations follow, and the second is the one that generalises past mathematics. The first: Lean proofs should never be believed until they have been checked by the kernel. The second: a human audit must then confirm that the formal statement is the one the paper's author meant. Hales notes that about 25 independent Lean kernels have been written, so a proof can be run through several, and a bug in any one of them is caught by the others.
One hypothetical in the post reaches past Lean. There is work under way on a smaller "Con-Leche" kernel verified in Lean itself. "What if that very bug was exploited in the Lean verification of the Con-Leche checker, leaving a soundness bug in Con-Leche too?" Everyone running software that checks the output of other software is one layer up from that question.
Source
What mathematicians should know about the Lean Theorem Prover: questions of reliability and AI, Thomas Hales, guest post on Terence Tao's blog.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
