Claude traces NIST elliptic curve seeds to a 1990s random number generator and a timestamp

Anthropic's Frontier Red Team says an internal research model worked out where the seeds for the NIST P-192, P-224, P-256, P-384 and P-521 curves came from. They were never hashes of a phrase, as long rumored. They are output from the C library lrand48 generator initialized with a Unix timestamp. P-256 needed 1,842 iterations to reach its standardized seed. Claude scanned the seeds for signatures of 1990s generators, spotted zeroed top bits, then used lattice reduction to recover the generator state for the prime curves. The NSA supplied the seeds in 2000 with no explanation, which fueled backdoor suspicion for decades. Anthropic says this is not a cryptographic break and makes deliberate weakening less plausible. Gaps remain: the B-163 seed is unexplained, as are base points for several curves. The $36,864 bounty goes to the Internet Security Research Group. For builders, this is a concrete case of a model solving an old open problem by writing its own analysis tools and testing hypotheses, not by retrieving a known answer.