Anthropic said on October 16 that an internal Claude research model solved, in under half an hour, a cryptography mystery that had stood for 25 years. The seeds behind the NIST elliptic curves P-192, P-224, P-256, P-384 and P-521 — numbers the NSA supplied in the late 1990s with no explanation of where they came from — were not hashes of a secret phrase and, on this evidence, were not chosen to hide a weakness. They were output from lrand48, the random-number generator in old C libraries, seeded with a Unix timestamp.
That missing provenance mattered. NIST adopted the curves in FIPS 186-2 in 2000, and each seed is hashed to derive a curve coefficient, so a trustworthy seed should be a nothing-up-my-sleeve number with nothing to hide. Instead cryptographers got silence, later compounded by the Snowden disclosures about NSA efforts to weaken standards. NSA mathematician Jerry Solinas recalled in 2015 that the seeds might be hashes of a joke along the lines of Give Bob and Jerry a raise. Solinas died in 2023, that lead went nowhere, and cryptography engineer Filippo Valsorda and contributors put up a bounty that rose to 36,864 dollars if donated to charity.
Claude ignored the phrase theory entirely. Anthropic says the model bet that 1997 software probably used a weak generator shipped with the C libraries of the era, spotted the fingerprint of lrand48 in the published seeds, and recovered the generator state from truncated outputs using lattice reduction. Anyone can now rerun the code and reproduce the numbers. For P-256, the run started on August 16, 1997 at 01:52:34 UTC, and the published seed was its 1,842nd 20-byte candidate. Valsorda independently reimplemented the solution and confirmed the match; the bounty will be donated to the Internet Security Research Group, the nonprofit behind Let’s Encrypt.
Anthropic is careful about what this is not. It is not a cryptographic break, a new attack, or a reason for anyone using the NIST curves to change anything — Bitcoin, notably, uses a different curve, secp256k1, anyway. And not everything is explained: the B-163 seed fits nothing Claude tried, the base points for several curves remain unaccounted for, and nobody knows why the P-256 run skipped candidate 876, which would also have worked. What the reproducibility does do is leave much less room for subversion, because a hidden weakness is hard to square with a seed anyone can regenerate from a clock reading.
The same week brought a second, very different Anthropic result in the same spirit. On October 16 the company also reported that Claude Mythos 5, working in a generator-and-judge loop with formal verification, designed quantum circuits that beat the best published designs on seven of eight tasks, cutting Toffoli gate counts by up to 17 times in one case, albeit with about 12 percent more qubits. Together the two stories point to where models are becoming genuinely useful to practitioners: not chat, but checkable work — a seed you can regenerate, a circuit an evaluator can score and a proof checker can verify.
For builders, the lesson is about trust architecture. We ask users to trust parameters, libraries and models they cannot inspect by hand. The projects that earn that trust are the ones that publish how a number was made, ship the reproduction script, and invite an independent reimplementation. Claude did the detective work here, but the reason the answer settles a 25-year argument is old-fashioned: anyone can run it and see for themselves.
