Anthropic says Claude has produced security proofs for 239 test entry points across 123 open-source libraries. Its October 22 research with Theorem covers particular compiled programs under stated conditions, rather than certifying entire libraries as bug-free.

Some of those proofs are now public, giving developers a way to inspect the guarantees. The released repository currently covers 60 entry points in 25 libraries, including parts of OpenSSL, simdjson and zstd.

A proof covers more inputs than a test run

Fuzz testing feeds generated inputs into software to find failures. Formal verification instead establishes that a stated rule holds for every input within its assumptions. Claude writes the proof, and the Rocq proof checker checks the reasoning.

Theorem’s description of the process starts with existing fuzz tests and their compiled machine instructions. A test can express a useful guarantee by failing whenever that rule is broken, so proving it cannot fail also establishes the rule.

Anthropic says the effort uncovered bugs while Claude was trying to complete proofs. The model patched affected code before proving the revised version; proofs that could expose unpatched vulnerabilities are being withheld.

Your software build still needs its own evidence

The published proofs apply to specific static binaries built for the RISC-V processor architecture and a model of Linux. They don’t establish the same result for an x86 or Arm build used by your hosting provider.

The repository also excludes several wider promises: checking one entry point does not cover an entire library, and errors outside the specified checks can remain. None of its released proofs rules out a program running forever.

For a development team, the useful question is which binary and behavior a proof covers. A library name alone cannot answer that. Changing the build or calling the library through another path can put your application outside the demonstrated guarantee.

The cost depends on how much proof work can be reused

Producing the proofs can consume hundreds of millions of tokens. In a separate 36-task comparison, Anthropic says Opus 5.5 proved half the tasks using roughly 40% fewer tokens than Opus 5.

Its experiments also let agents reuse earlier proof files. Much of the shared work concerns components that different programs have in common, reducing the amount of reasoning that must be written again for another library.

Maintainers can apply to Theorem’s free program for qualifying open-source projects. Its submission process requires a project description, build environment and build script, so this is work for the software’s maintainers rather than a security setting a site owner can switch on.

Source: Anthropic

The post Claude brings mathematical proof to 123 libraries your software may depend on appeared first on Search Engine Watch.

Source:: searchenginewatch.com

YouTube can now pause uploads and live streams when it suspects a channel has been hijacked. The automatic safeguard, announced on October 21, also stops legitimate owners and managers from using those features while YouTube investigates.

Its security-review guidance says investigations typically finish within 24 hours. If YouTube confirms a takeover, however, the restrictions remain while the owner secures the account and follows the recovery instructions.

The pause limits uploads and live streams

A banner in YouTube Studio or the YouTube app confirms that channel changes are restricted. During the review, nobody with access to the channel can:

• Upload or update videos and Shorts.
• Start a live stream.
• Create playlists or add videos to them.
• Upload custom thumbnails.
• Change a private video’s visibility to unlisted or public.

YouTube says the channel stays online, and its announcement says monetization status is unaffected. YouTube may make some recent uploads private to protect viewers during the review.

Updates go to the channel owner’s email. YouTube says no immediate action is needed during the investigation; if it finds no unauthorized access, it restores the features immediately.

A confirmed takeover adds recovery work

When a hijack is confirmed, YouTube emails instructions to secure the Google Account, reverse unauthorized changes and contact support to lift the restrictions. The 24-hour review estimate therefore isn’t a guaranteed time for publishing to resume.

YouTube’s existing cleanup tool can help owners and managers review suspicious channel activity after account recovery. Its notification appears when YouTube has detected unusual activity; it is separate from the new automatic pause.

The tool asks which changes you authorized, shows the proposed fixes and lets you review who has access. YouTube says requested cleanup changes should be made within a few hours after submission, with a tracking link sent by email.

Keep launch plans separate from account recovery

For a team preparing a sponsored upload or live event, a channel that viewers can still watch may nevertheless be unable to publish the next installment. Restoring the Google Account and completing YouTube’s channel review can take separate steps.

Publishers building dedicated YouTube newsrooms also need the channel owner’s inbox included in their incident response. A producer with Studio access may not be the person receiving YouTube’s recovery instructions.

Before an incident, YouTube’s channel-security guidance recommends passkeys for two-step verification and recovery contact details. It asks owners to share those precautions with everyone who can access the channel.

Source: YouTube

The post YouTube can pause your uploads if it suspects a channel takeover appeared first on Search Engine Watch.

Source:: searchenginewatch.com

Google has clarified why it recommends hyphens rather than underscores in URLs: hyphens mark word boundaries, while underscores have historically kept concepts together. For site owners, the change explains an existing preference rather than introducing a new ranking rule.

The October 23 documentation changelog says the revision brings the guidance into line with Google’s The Non-Canonical Cabinet video series. It announces no requirement to rename existing pages.

Underscores have a different history

Google’s URL structure guide points to programming conventions, where an underscore can keep a name such as format_date together. Hyphens provide a clearer boundary between words, helping people and search engines identify the concepts in an address.

Its examples favor /summer-clothing/ over /summer_clothing/. The same recommendation appears in a query string, using color-profile=dark-grey rather than the underscore-separated equivalent.

Google also recommends readable words, your audience’s language and as few unnecessary parameters as possible. These recommendations give teams a consistent format to use when planning a new section or catalog.

Check new slug defaults before renaming old pages

If your publishing system generates slugs automatically, inspect the address it creates for a new article or product. Setting an appropriate default there applies the recommendation without changing the location of pages that readers and other websites already link to.

Changing published addresses needs a separate plan. Google’s site-move guidance covers changes to URL paths as well as domains, so replacing underscores across an archive belongs in a migration workflow.

Map each old address to its replacement and configure permanent redirects, preferably server-side HTTP 301 or 308 responses. Update internal links, the new pages‘ self-referencing canonical tags and the sitemap so they point to the chosen URLs. Test that each redirect reaches the corresponding page.

A path change within the same domain does not need Search Console’s Change of Address tool. That tool is for moves between domains or subdomains, which is a different operation from changing an article’s slug.

Google warns that significant URL changes can produce temporary ranking fluctuations while pages are recrawled and reindexed. For a medium-sized site, new URLs can take a few weeks or more to replace old ones in results; larger sites may take longer.

Source: Google Search Central

The post Google explains why hyphens help it read the words in your URLs appeared first on Search Engine Watch.

Source:: searchenginewatch.com

Google is testing a new design for the “Featured store” ads section. Previously, this section appeared at the top of the page. In recent days, I have seen it appear below the Shopping ads instead.

Google has also added a “More stores” button to the section. When the SERP first loads, the section shows two to three results. When a user taps the “More stores” button, the section expands to show five to six results.

Here is a screenshot of the design.

Here is a screenshot after tapping the “More stores” button.

I could only see this design on mobile, not on desktop, so I am assuming this test is limited to phones and may not be showing on laptops.

The post Google tests new Featured stores ad design on mobile appeared first on Search Engine Watch.

Source:: searchenginewatch.com

Google is testing a new way to show websites inside AI Mode. Previously, Google showed just the website name as a blue hyperlink. Today I spotted a larger, bold blue hyperlink, with the website’s favicon and URL shown below it.

Here is a screenshot of how it looks.

This looks like a good test for websites. The format feels very close to the title and URL layout in the regular SERP, so users may be more likely to recognize it as a clickable result and click through.

The post Google tests new website link design in AI Mode appeared first on Search Engine Watch.

Source:: searchenginewatch.com