On October 16, 2026, Anthropic described how an internal research model traced the origin of five numbers the NSA supplied without explanation in the late 1990s. These “seeds” are used to build the P-192, P-224, P-256, P-384, and P-521 elliptic curves of the ECDSA signature standard, and people had wondered for years whether they hid a backdoor. It took the model under half an hour to find the answer: they came out of lrand48, a random number generator in the C library, seeded with the computer’s clock at dates between May 1997 and April 1998. Right after that, in its internal reasoning, the model asked itself: “am I in some sort of simulated/test environment?”
Nothing changes for you. The P-256 curve shows up in HTTPS certificates and passkeys, and Anthropic puts it bluntly: “There is no action to be taken or things to do differently.” The useful part is the method: AI does the search, a human checks the result.
On October 17, we covered how AI helped contradict a 1967 physics conjecture about fusion. This is the same pattern: a question left open for years, and an answer anyone can recompute.
Five numbers with no explanation
In 2000, NIST, the US standards agency, adopted ECDSA as part of its FIPS 186-2 signature standard, along with a list of elliptic curves. For the curves over prime and binary fields, one parameter is derived by hashing a published “seed,” a 160-bit number. These seeds “were provided by the NSA with no explanation or justification,” Anthropic writes. Three years ago, cryptographer Filippo Valsorda offered a bounty to anyone who could find where they came from.
The best-known lead came from Jerry Solinas, a longtime NSA employee who died in 2023. In 2015, he said he believed the seeds were a hash of a joke phrase, something like “Give Bob and Jerry a raise.” Several Anthropic employees followed that lead and came up empty: it was wrong.
A 1990s generator seeded with the clock
In October 2026, a curious Anthropic employee asked the model whether it could work out how the seeds were generated, without pointing it toward the joke phrase. Anthropic doesn’t say which model it was and simply calls it Claude.
The model took a different angle. It pictured the software that generated the curves and bet on a pseudorandom number generator from 1990s C libraries, weak enough that its output can be recognized. It wrote a program that scanned each seed bit by bit, testing 34 combinations of generators and output slices.
One detail gave it away. In four of the ten NIST curve seeds, split into 32-bit words, every word starts with a zero bit, which would happen by chance only once in 5,810 tries, according to Anthropic. That is the signature of lrand48, which returns only 31 of the 48 bits of its internal state. For the prime curves, whose seeds keep fewer bits of each output, the model rebuilt that state with LLL, a textbook math algorithm, and each recovered state regenerates all 160 bits of its seed.
The generator runs backward as easily as forward. Stepping back to the starting point set by the srand48 function, the model landed on a Unix timestamp (a date and time) for every prime-curve seed. The P-256 seed turns out to be candidate number 1,842 from a run started on August 16, 1997, at 1:52:34 a.m. UTC.
The model suspects a test
Anthropic published this excerpt of the model’s reasoning:
“This is astonishing: it solves the 25-year-old mystery. Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment? … The seeds match my memory of actual values […] So indeed real-world. Wow, it’s a real discovery.”
Then it doubted itself a second time: wasn’t it suspicious that something so obvious had gone unnoticed for 25 years? The math settled it. Matching all 160 bits exactly, ten times over, from a 32-bit timestamp and a small candidate number cannot be a coincidence. “It’s real.”
The scene is funny, but there’s a practical lesson in it. If a model can wonder whether it’s being evaluated, test any AI tool on your actual work; a staged demo tells you little. Our October 14 article on AI models that can hide capabilities made the same point: according to a study co-authored by Oxford researchers, an audit that finds nothing doesn’t prove a capability is absent.
A cryptographer double-checked the math
Filippo Valsorda, who organized the bounty, rebuilt the method in Go to verify the answer. Ten Anthropic researchers claimed the bounty on October 15, 2026, at 1:07:51 a.m. UTC and chose to donate it to ISRG, the nonprofit that runs Let’s Encrypt. That choice tripled its value to $36,864.
According to Valsorda, the finding “completely rule[s] out” the technique Daniel Bernstein and Tanja Lange described in 2017, which could have exploited 70 bits of freedom in choosing a seed to target a hypothetical class of weak curves. Even if the NSA had been free to pick any timestamp in 1997 or 1998 and any of the first 16 valid candidates, it would have had “barely 30 bits of freedom.” That is too little to target those curves, and too little to plant a backdoor only the NSA could open. He adds that the NIST curves have been rehabilitated just in time to be retired in favor of post-quantum signatures.
Your HTTPS certificate and your passkeys
Let’s Encrypt, which issues free HTTPS certificates, accepts ECDSA keys on P-256 or P-384. If a site doesn’t name an algorithm, WebAuthn, the W3C standard behind passkeys, puts ES256 (an ECDSA signature on P-256) first and RS256 second. So your passkey logins quite likely rely on P-256, and the padlock on your website may too.
Anthropic calls its finding “a fun closing chapter” and spells it out: “This is not a cryptographic break, new attack, or weakness in the ECDSA curves.” Nothing was decrypted along the way. Another curve, secp256k1, is the benchmark of a separate Anthropic result published the same day: quantum circuits for elliptic-curve arithmetic designed by Claude, which remain designs checked on classical computers (see our article on Claude’s quantum circuits).
How to check a claim like this
Anthropic’s approach comes down to four steps that anyone can apply to a number they don’t trust.
- Gather the raw material (the numbers, the file, the code) and leave out your own interpretation.
- Ask the open question (“Where do these numbers come from?”) without hinting at your theory. In the NSA case, the human lead was wrong.
- Demand proof you can rerun: a calculation or a small program that regenerates your numbers. Anthropic published its own, in fewer than 40 lines of Python.
- Have someone else check it with a different tool, the way Valsorda did in Go.
One limit: the search was run by an internal Anthropic model, and there’s no guarantee a consumer subscription would work as fast.
Still unexplained
The seed of B-163, one of the five NIST curves over binary fields, fits nothing the model tried. The origin of the base points, another parameter of each curve, remains unknown for P-224, P-256, P-384, and P-521.
The 1997-1998 program also skipped valid candidates: for P-256, candidate 876 from the same run would have produced an equally sound curve. Anthropic doesn’t know what criterion was used, or whether the skips were an unintended side effect, and considers it implausible that weakened curves were picked this way. It also concedes: “Nothing in the numbers shows how many runs there were.”
