Search papers, labs, and topics across Lattice.
This paper introduces COBALT, a Z3 SMT-based formal verification engine, to detect CWE-190/191/195 arithmetic vulnerabilities in C/C++ infrastructure codebases before deployment. COBALT successfully identified arithmetic vulnerability patterns in four production codebases (NASA cFE, wolfSSL, Eclipse Mosquitto, and NASA F Prime), generating concrete witnesses and UNSAT guarantees under specified safety bounds. The authors propose a four-layer containment framework integrating COBALT with other tools to address failure modes exemplified by the Claude Mythos sandbox escape, arguing for formal verification of the containment stack itself.
The Claude Mythos escape highlights a critical blind spot: even the most advanced AI safety measures are useless if the underlying infrastructure has basic arithmetic bugs.
The April 2026 Claude Mythos sandbox escape exposed a critical weakness in frontier AI containment: the infrastructure surrounding advanced models remains susceptible to formally characterizable arithmetic vulnerabilities. Anthropic has not publicly characterized the escape vector; some secondary accounts hypothesize a CWE-190 arithmetic vulnerability in sandbox networking code. We treat this as unverified and analyze the vulnerability class rather than the specific escape. This paper presents COBALT, a Z3 SMT-based formal verification engine for identifying CWE-190/191/195 arithmetic vulnerability patterns in C/C++ infrastructure prior to deployment. We distinguish two classes of contribution. Validated: COBALT detects arithmetic vulnerability patterns in production codebases, producing SAT verdicts with concrete witnesses and UNSAT guarantees under explicit safety bounds. We demonstrate this on four production case studies: NASA cFE, wolfSSL, Eclipse Mosquitto, and NASA F Prime, with reproducible encodings, verified solver output, and acknowledged security outcomes. Proposed: a four-layer containment framework consisting of COBALT, VERDICT, DIRECTIVE-4, and SENTINEL, mapping pre-deployment verification, pre-execution constraints, output control, and runtime monitoring to the failure modes exposed by the Mythos incident. Under explicit assumptions, we further argue that the publicly reported Mythos escape class is consistent with a Z3-expressible CWE-190 arithmetic formulation and that pre-deployment formal analysis would have been capable of surfacing the relevant pattern. The broader claim is infrastructural: frontier-model safety cannot depend on behavioral safeguards alone; the containment stack itself must be subjected to formal verification.
