On August 14, 2026, Code Metal announced an $80 million U.S. Air Force Other Transaction agreement to advance WarMatrix, an AI-enabled modeling and simulation platform used for operational planning, force design, mission engineering and campaign analysis (codemetal.ai). Four days later, on August 18, the same newsroom opened a research program that pays universities up to $40,000 a time to work on verified code translation, on the stated grounds that “verified translation depends on foundational research in defining formal semantics, designing techniques for verifying program equivalence, and building open-source tools” (codemetal.ai).
Both statements are true, and neither is embarrassing. Set them beside each other, though, and they say something the funding coverage did not. The $125 million Series B bought a company, a customer list and an eighty-million-dollar agreement. It did not buy a finished science. For anyone deciding whether to accept AI-translated code into a system that has to pass certification, that gap is the entire question.
What the money actually bought
The trajectory is unusually fast and worth stating plainly. Code Metal announced a $36.5 million Series A on November 12, 2025, led by Accel, for verifiable AI-powered code translation (PR Newswire). Just over three months later, on February 19, 2026, it closed a $125 million Series B led by Salesforce Ventures with Accel, B Capital, Smith Point Capital, J2 Ventures, Shield Capital, Overmatch and RTX participating, and named Ryan Aytay, formerly chief executive of Tableau, as president and chief operating officer (codemetal.ai). The round was struck at a $1.25 billion post-money valuation (codemetal.ai). The company names Toshiba, RTX, L3Harris and the U.S. Air Force among its customers, and in June 2026 it acquired Signal Processing Technologies to stand up an advanced radio frequency group.
This is not a deck. It is a company with paying defense customers and a large agreement in hand. Which is exactly why the language it is sold in matters.
Two claims, and only one of them is a proof
Announcing the Series B, Rob Keith of Salesforce Ventures said Code Metal’s neuro-symbolic approach “solves this by mathematically proving code is correct” (codemetal.ai). Announcing the Air Force agreement six months later, the company described its own technology differently: it “can mathematically verify that a model behaves the same way after transformation as it did before, allowing AI to run on top of the DoW’s existing modeling and simulation ecosystem modernized for AI without invalidating the decades of testing behind it” (codemetal.ai).
Those are different claims, and the difference is not pedantry. The second one is equivalence. Equivalence says the new artifact behaves the way the old artifact behaved. It says nothing at all about whether the old artifact was right. Translate a twenty-year-old defect faithfully and you have proved, rigorously, that you preserved the defect.
The striking part is that the equivalence claim is the more valuable one commercially, and the company’s own sentence says why: the decades of testing behind the legacy system stay valid. A defense program does not primarily want new correctness. It wants the certification evidence it already paid for to survive the move to a new language or a new chip. That is a narrower promise and a much better product.
The mechanism described on the company’s own site is narrower again. Step two of its platform is “Auto-generate a complete test suite with full functional and MCDC coverage,” and the safety pitch is to “Meet safety standards with formal verification, and configurable compliance checks” (codemetal.ai). Modified Condition/Decision Coverage is a testing criterion, not a proof: it requires that every condition in a decision be shown to independently affect that decision’s outcome, and it is the structural coverage standard applied to the most critical tier of airborne software (NASA Langley, NASA/TM-2001-210876). Generating that suite automatically is genuinely useful work. It is not the same activity as proving a program correct, and the site is more careful about this than the funding announcement was.
What a regulated buyer is actually allowed to accept
Formal methods already have a seat at the certification table. FAA Advisory Circular 20-115D, issued July 21, 2017 and still active, recognizes RTCA DO-178C along with its supplements, including DO-333, the Formal Methods Supplement to DO-178C and DO-278A, and it describes itself as “an acceptable means, but not the only means” of showing compliance for the software aspects of airborne systems (FAA). A vendor arriving with formal analysis is not arriving with something exotic.
The catch is what a proof is a proof of. NASA’s formal methods group defines these techniques as ones that “provide a means to symbolically examine the entire state space of a digital design (whether hardware or software) and establish a correctness or safety property that is true for all possible inputs” (NASA Langley). A property. Someone has to write that property down before anything can be proved about it. The same page adds that examining the whole state space “is rarely done in practice today (except for the critical components of safety critical systems) because of the enormous complexity of real systems.”
Now picture the actual object: a radar module whose requirements live partly in a document written in the 1990s, partly in test rigs, and partly in the working memory of three engineers who are close to retirement. The prover was never the bottleneck. Deciding what ought to be proved is the bottleneck, and no amount of Series B money shortens that conversation.
The gap the research program admits
Read the August research awards as a to-do list rather than as marketing and it maps the open ground precisely. The named topics include mechanized proofs of cross-language semantic equivalence, AI-assisted verification through contracts, test harnesses, lemmas and proof sketches, static and hybrid analysis for industrial languages, verified optimization and compiler correctness, and specification-aligned code generation. Proposals close October 8, 2026, with awards announced December 8, and each award is up to $40,000 paid to the awardee’s university as an unrestricted gift (codemetal.ai).
Cross-language semantic equivalence is not a feature on that list. It is a research problem. A company that has just won an eighty-million-dollar agreement on the strength of provable AI is, in the same week, paying academics to work on the proof technique underneath it. That is honest behavior, and it is also the clearest available evidence for the claim in this article’s title.
It is the same reading discipline that separates the AI-generated fixes that hold from the AI security patches that failed more than half the time in a 6,080-patch study, and the same reason the most-quoted study on AI coding productivity almost never travels with the caveats its own authors attached. Check the mechanism, not the headline, and check the vendor’s own benchmark table rather than the sentence summarizing it.
Our read, and it is a read
This is judgment rather than reporting, because nobody outside the company has publicly audited a Code Metal proof artifact, and no independent evaluation of its output exists to point at.
The marketing has outrun the mechanism, and the quieter claim is the stronger one. “Your existing certification evidence survives the port” is worth more to a program manager at L3Harris than “we prove your code is correct,” because the first is something a buyer can check and the second is something no vendor can support in general. Selling the second risks the first: the day an auditor finds a proof that covered a behavioral subset while the marketing said correctness, the whole category gets slower to buy, including the parts of it that work.
One more thing worth correcting, because the usual framing gets it exactly backwards. Tools like this are often pitched as a way to depend less on the scarce engineers who understand fielded systems. The proof is only as good as the property, and the only people who can state the property are those same engineers. A translator that moves them off typing Fortran and onto writing the specification lets a small team modernize systems it could never otherwise have touched. A translator sold as a way of doing without them removes the one input that gives its own output meaning.
The question to ask before signing
Ask any vendor in this category to put two sentences in writing: which property was proved, and against which artifact it was proved. “Equivalence to the behavior of the existing binary under this test suite” is a real answer, and a good one. “The code is correct” is not an answer yet. Keep asking what correct was measured against until the reply contains a document name.
Frequently asked questions
Does formal verification prove that software is correct?
Not on its own. NASA’s formal methods group describes these techniques as establishing “a correctness or safety property that is true for all possible inputs” (NASA Langley), which means a specific property that somebody wrote down first. If the property is equivalence to a legacy system, the proof holds even where the legacy system was wrong.
Can formally verified, AI-translated code be used in certified airborne software?
The route exists. FAA Advisory Circular 20-115D recognizes DO-178C and its supplements, including DO-333, the Formal Methods Supplement, as an acceptable means of showing compliance, and the AC states plainly that it is “an acceptable means, but not the only means” (FAA). Using that route still requires requirements to verify against.
What is MC/DC, and why does it appear in Code Metal’s pipeline?
Modified Condition/Decision Coverage requires each condition inside a decision to be shown to affect that decision’s outcome independently, and it is the structural coverage criterion applied to the most safety-critical airborne software (NASA Langley, NASA/TM-2001-210876). Code Metal’s platform page lists auto-generating a test suite with full functional and MC/DC coverage as a step in its workflow (codemetal.ai), which is a testing activity that sits alongside formal verification rather than replacing it.
How much has Code Metal raised, and what has it won?
A $36.5 million Series A led by Accel in November 2025 (PR Newswire), a $125 million Series B led by Salesforce Ventures in February 2026 at a $1.25 billion post-money valuation (codemetal.ai), and an $80 million U.S. Air Force Other Transaction agreement for the WarMatrix simulation platform in August 2026 (codemetal.ai).
