Claude Fable 5 wrote a booting, NT-shaped Rust kernel in 38 minutes

[WhoCares]

Claude Fable 5 wrote a booting, NT-shaped Rust kernel in 38 minutes, with later work on Claude Opus growing it to run real Windows binaries.

Security startup Tolmo published a transcript-level account of Claude Fable 5 writing a booting, NT-shaped kernel in Rust from an empty directory in 38 minutes of active model work.

By the company's account it built the trusted computing base, booted in an emulator, passed its own self-tests, and root-caused its own low-level bugs, then over 8 more days, mostly on Claude Opus 4.8, grew to load unmodified Windows drivers and run real Windows binaries.

https://github.com/msuiche/nanokrnl

An NT-compatible kernel written in Rust: the architecture, abstractions, and (where it matters) the exact constants and layouts of the Windows NT kernel, rebuilt as a modern, memory-safe, freestanding Rust codebase. It boots on x86-64, runs real, unmodified Microsoft user binaries (cmd.exe, more.com, …) on its own NT syscalls, loads a genuine null.sys PE driver, and proves itself with a self-test suite on every boot.

It runs natively under QEMU and in your browser, via nanox, a bespoke ~60 KB x86-64 WebAssembly emulator that boots the unmodified kernel image directly in long mode, with no threads, no SharedArrayBuffer, and no COOP/COEP headers.

https://nanokrnl.ai

[chants]

Very cool. In terms of safety, I do see 53 .rs files with "unsafe": https://github.com/search?q=repo%3Am...pe=code&l=Rust

So it seems safety guarantees are still not assured - there should be some sort of formal proof/verification metadata extension for Rust that allows unsafe regions to be proven safe. Otherwise I consider these to be "cheating"

[Ibrahim_Mihai]

Originally Posted by chants

Very cool. In terms of safety, I do see 53 .rs files with "unsafe": https://github.com/search?q=repo%3Am...pe=code&l=Rust

So it seems safety guarantees are still not assured - there should be some sort of formal proof/verification metadata extension for Rust that allows unsafe regions to be proven safe. Otherwise I consider these to be "cheating"

Cheating? Look who's talking!

Well, there is still the same "unsafe code" issue with the vibe-coded decompilers you posted last week:
https://forum.exetools.com/showthread.php?t=21666
This is always a problem with vibe-coded content.

OTOH, at least the nanokrnl above is a excellent proof-of-concept of something that was only a pipe dream for many years.
If you've actually read the whole article carefully, you can see that it was meant only as a PoC and not for production use anyway!

A nano Windows kernel booting through a hand-built emulator in the browser, on its own NT syscalls, is quite an achievement.

Kudos to the creators of the nanokrnl projext!