On October 16, 2026, Anthropic’s Frontier Red Team published “Claude reveals ECDSA curve origins”. The NIST elliptic curves adopted in 2000, including the widely used P-256, were each defined from a “seed” value supplied by the NSA with no explanation. That gap fed decades of suspicion that the curves might have been chosen to hide a weakness, and a public bounty was offered for the answer. The leading story, that the seeds were hashes of a joke phrase, had come to nothing.
In October 2026 an Anthropic employee asked an internal research model to work out how the seeds were made, without pointing it at that clue. Claude guessed the generating software had used a weak pseudorandom number generator from 1990s C libraries and wrote a scanner testing 34 generator and output-slice combinations. It spotted that four of the ten seeds had a zero top bit in all 20 words, a 1 in 5,810 chance, which is the signature of lrand48. Using lattice basis reduction it recovered the generator state for the prime-curve seeds and stepped it back to the initialization. For all ten prime-curve seeds (five NIST, five ANSI X9.62) the starting points were Unix timestamps between May 1997 and April 1998. P-256’s published seed was candidate number 1,842 of its run. Claude also explained the base points of six curves generated in May 1997, which the authors believe is the first explanation of any NIST base point.
The work is credited to John Wood, Henry de Valence, Ava Howell, Zack Voase, Lucy Sweet, Amir Omidi, Paul Crowley, Iain McGinniss, Nicholas Carlini and Steve Weis. The $36,864 bounty is being donated.
Why it matters: it is a clean example of AI settling an old, well-known open question through a new angle of attack, and the answer increases confidence in the curves. Anthropic says plainly there is no break and nothing for users to change.
What it does not show: one binary-curve seed (B-163) remains unexplained, as do the base points of P-224, P-256, P-384 and P-521. Some viable candidate curves were skipped in the runs for reasons nobody knows, though the authors judge deliberate selection of weak curves implausible.