On October 16, Anthropic’s Frontier Red Team announced that an internal Claude research model traced the 25-year-old origin of the random seeds behind NIST’s P-192, P-224, P-256, P-384, and P-521 elliptic curves — the curves underneath ECDSA, TLS, and a meaningful chunk of government cryptography — in under 30 minutes. Cryptographers had been trying to answer this one since 2000. Claude didn’t just answer it. It collected a bounty for the trouble.

That’s the part of this story that’s actually new, and it’s worth sitting with for a second: most of what we’ve covered out of Anthropic this month has been a warning about something Claude or another model could do wrong — spread like a worm, get recruited by a weapons cell. This one is a model doing something nobody else managed to do, verified by an independent cryptographer, with no caveat about a capability that might turn dangerous later. It’s just a win.

Quick Summary: What Happened

Detail	Info
Published	October 16, 2026, by Anthropic’s Frontier Red Team
The finding	NIST’s P-192/224/256/384/521 seeds come from the C library’s lrand48() generator, seeded with Unix timestamps from May 1997–April 1998 — no hash function involved
How fast	Under 30 minutes for an internal Claude research model to identify the mechanism
The method	A top-bit statistical anomaly (odds of roughly 1-in-5,810) pointed to lrand48; Lenstra–Lenstra–Lovász (LLL) lattice basis reduction reconstructed the generator’s hidden state
The bounty	Cryptographer Filippo Valsorda’s 2023 bounty, worth $36,864 donated to charity, was claimed and verified
What it isn’t	Anthropic is explicit: “not a cryptographic break, new attack, or weakness in the ECDSA curves”

Bottom line: The seeds came from a boring, reproducible process anyone can rerun — not a secret NSA formula — which makes a deliberate backdoor much less plausible, though not disproven outright.

What Actually Happened

Here’s the mystery, stripped down. Back in 1999 and 2000, the NSA handed NIST a set of seed values to generate five elliptic curves for ECDSA — the signature scheme that underpins HTTPS certificates, Bitcoin transaction signing (on a different curve, more on that below), and a long list of government systems. The seeds themselves looked like noise. Strings like C49D3608 86E70493 6A6678E1 139D26B7 819F7E90 for P-256. No documentation came with them. No explanation of where they came from or why those specific numbers. Just: trust us.

That non-answer sat there for a quarter century, and in cryptography, an unexplained number from an intelligence agency is not a detail people let go of. The Snowden disclosures made the suspicion harder to dismiss, not easier — proof that the NSA had, in fact, weakened at least one cryptographic standard (Dual_EC_DRBG) on purpose gave the NIST curve seeds a plausible villain origin story. The working theory for years was that the NSA tried thousands of candidate seeds until it landed on a curve with some exploitable mathematical weakness, one only the agency knew how to find.

Cryptography engineer Filippo Valsorda got tired enough of the unanswered question that in October 2023 he put up a bounty — $12,288, tripling to $36,864 if the winner donated it — for anyone who could show where the seeds actually came from. Nobody claimed it for three years. Then, according to Anthropic’s writeup, a researcher pointed an internal Claude model at the problem without even giving it Valsorda’s hints, and asked it to work out how the seeds might have been generated.

Claude’s first move was to guess, correctly, that a 1990s-era implementation would lean on whatever pseudorandom generator shipped with the standard C library of the day — not some elaborate custom scheme. From there it went looking for statistical fingerprints. It found one: across the five curve seeds, written out as 32-bit words, a top-bit pattern showed up with roughly a 1-in-5,810 chance of occurring by coincidence. That’s the signature of lrand48(), a linear congruential generator that only ever exposes the top 31 bits of its internal 48-bit state. Once Claude had the right generator, it used LLL lattice basis reduction — a decades-old technique for solving exactly this kind of “reconstruct the hidden state from truncated output” problem — to rebuild the seed and confirm the match. For the P-256 seed specifically, the reconstructed sequence hit the published value on its 1,842nd candidate. The same method lined up five related ANSI X9.62 seeds, too.

The seeds, in other words, were lrand48() fed a Unix timestamp from sometime between May 1997 and April 1998. Someone ran a script. The script called a standard library function. Nobody hashed anything, hid anything, or engineered anything. Valsorda verified it independently by reimplementing the algorithm in Go, then paid out the bounty — Anthropic’s team donated the full $36,864 to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.

Why the 1-in-5,810 Number Mattered

A single coincidence is just a coincidence. Four independent curve seeds all showing the same “suspiciously structured” bit pattern is a signal:

1. The pattern repeats. Four of the five binary-curve seeds showed all-zero top bits across every 32-bit word — not something you’d expect from genuine randomness.
2. The odds rule out chance. That specific arrangement has roughly a 1-in-5,810 probability of happening on its own, which is low enough to treat as a real fingerprint rather than noise.
3. The fingerprint names a suspect. That exact kind of top-bit bias is what you get from a generator like lrand48(), which only ever returns the upper 31 bits of a 48-bit internal state — a known, specific, checkable mechanism, not a guess.

Why This Matters

Anthropic is careful — more careful than most of the coverage that followed — about what this does and doesn’t prove. The company’s own framing: this is “not a cryptographic break, new attack, or weakness in the ECDSA curves.” The curves are exactly as secure today as they were yesterday. What changed is the story behind where they came from, and that story turned out to be mundane in a way that cuts hard against the backdoor theory. A generator with the output structure of lrand48(), fed a timestamp, gives you almost no room to steer toward a specific “weak” curve on purpose — Valsorda’s own read is that the process left something like 30 bits of real freedom, nowhere near enough to shop around for a secretly exploitable curve among the possibilities. Simple, reproducible, boring. Backdoors are supposed to be the opposite of all three.

It’s also genuinely a research result, not just an AI party trick. Cryptographers had this exact question in front of them for 25 years and didn’t solve it — not because nobody tried, but because spotting the statistical anomaly and then connecting it to the specific constraints of LLL lattice reduction is the kind of cross-disciplinary pattern match that’s easy to miss when you’re deep in one subfield. Anthropic has been building a track record of these results — Claude agents formalized Fermat’s Last Theorem in Lean 4 back in September, also faster than domain experts expected. This is a different flavor of the same claim: given the right framing, frontier models can do original work on problems that have sat unsolved for a long time, not just summarize what’s already known about them.

What Is lrand48, and Why Does It Explain the Seeds?

lrand48() is a pseudorandom number generator that’s been bundled with the C standard library since the late 1980s. It’s a linear congruential generator — a simple formula that produces the next “random” number from the previous one — and it deliberately returns only the upper 31 bits of its internal 48-bit state, discarding the rest. That truncation is normally a non-issue for everyday use. But it leaves a detectable statistical fingerprint in the output, which is exactly what let Claude recognize it decades later and, with lattice reduction, reconstruct the hidden state anyway.

The Bigger Picture

Bitcoin shows up in a lot of the coverage of this story, and it’s worth being precise about why, because it’s easy to overstate. Bitcoin’s signature scheme uses a different curve, secp256k1, chosen specifically because its parameters are rigid enough that there’s little room to hide a weakness in them — it was never part of the seed mystery this result resolves. What this finding actually touches is the NIST P-curves, which remain widely used across TLS/HTTPS certificate infrastructure and government systems that standardized on NIST’s recommendations. If you’re running infrastructure on P-256 or its siblings, nothing about your risk posture changed today. What changed is confidence in the history, not the math.

It’s also a useful data point against the backdrop of Anthropic’s last few weeks of safety disclosures — the IoT worm warning, the Yemen weapons case, the cruelty-ban policy. All real, all worth taking seriously, and all stories about managing risk Claude introduces. This one is a story about Claude producing a verified research result that an outside expert independently checked and paid out real money for. Readers who’ve been tracking this site’s recent run of Anthropic incident coverage should treat this as the other half of the picture: the same lab disclosing uncomfortable findings about its own models is also the one producing work cryptographers couldn’t finish in 25 years.

Our Take

We think this is the most interesting Anthropic story of the month, and also the easiest one to overhype in the wrong direction. The breathless version floating around — “AI proves there’s no NSA backdoor” — isn’t what Anthropic claimed and isn’t what the evidence shows. A simple, reproducible seed-generation process makes a deliberate backdoor less plausible. It doesn’t make one impossible, and Anthropic says as much: the team still can’t fully explain every choice made along the way, like why some usable candidate seeds got passed over. “Much less plausible” is doing honest work in that sentence. Don’t round it up to “proven safe.”

What we’d actually flag as the story here is the research methodology, not the verdict. Claude wasn’t handed Valsorda’s write-up or pointed at lrand48 — it inferred the right category of tool from first principles, noticed a statistical anomaly most people would read past, and reached for a 1980s lattice-reduction technique to close the loop. That’s a genuinely different capability than “summarize known cryptographic history,” and it’s the kind of result that should make security researchers think about what other 25-year-old unexplained artifacts are sitting in standards documents, waiting for someone to point a model at them with the right question.

Frequently Asked Questions

Did Claude prove the NSA didn’t backdoor the NIST curves?

No, and Anthropic doesn’t claim that. The finding shows the seeds came from a simple, reproducible process — the C library’s lrand48() generator fed a Unix timestamp — rather than a secret, engineered procedure. That makes a deliberate backdoor much less plausible, since there’s very little room to steer toward a specific weak curve this way, but it doesn’t rule one out with certainty.

What exactly did Claude discover?

Claude traced the origin of the random seeds used to generate NIST’s P-192, P-224, P-256, P-384, and P-521 elliptic curves to the C standard library’s lrand48() pseudorandom generator, seeded with Unix timestamps from between May 1997 and April 1998. It identified the generator from a statistical anomaly in the seed bit patterns, then used LLL lattice basis reduction to reconstruct the generator’s internal state and confirm the match.

How long did it take Claude to solve this?

Anthropic’s Frontier Red Team says an internal Claude research model identified the mechanism in under 30 minutes.

Who is Filippo Valsorda, and what was the bounty?

Filippo Valsorda is a cryptography engineer who in October 2023 offered a bounty — $12,288, rising to $36,864 if donated to charity — for anyone who could explain the origin of the NIST curve seeds. Anthropic’s team claimed it after Claude’s discovery and donated the full amount to the Internet Security Research Group, the nonprofit behind Let’s Encrypt. Valsorda verified the result himself by reimplementing the algorithm in Go.

Does this affect Bitcoin’s security?

No. Bitcoin’s signature scheme uses a different curve, secp256k1, which was never part of this mystery — its parameters are rigid enough to leave little room for a hidden weakness in the first place.

Is ECDSA or TLS/HTTPS less secure now that this is explained?

No. Anthropic is explicit that this is “not a cryptographic break, new attack, or weakness in the ECDSA curves.” The curves function exactly as they did before this research. What changed is historical context about where the seeds came from, not the underlying math.

What is Anthropic’s Frontier Red Team?

It’s the internal Anthropic group that tests what Claude and other frontier systems can do, including both misuse scenarios and open research problems. The same team has published several of Anthropic’s 2026 safety disclosures, including its warning about self-replicating AI models.

---

Last updated: October 17, 2026. Sources: Anthropic — Claude reveals ECDSA curve origins · Filippo Valsorda — The NIST Elliptic Curves Seeds Bounty Has Been Claimed · CoinDesk — Claude cracks a 25-year NSA number mystery · The Guardian — NSA and GCHQ unlock encryption used to protect emails, banking and medical records.

Related reading: Anthropic Warns AI Could Soon Spread Like a Worm · Claude Formalizes Fermat’s Last Theorem in 11 Days · Claude Helped Yemen Build a Missile. It Failed. · Anthropic Bans Cruelty to Claude. Here’s the Catch · Anthropic vs OpenAI in 2026