On October 16, 2026, Anthropic posted two research write-ups that, by coincidence of subject, bracket elliptic-curve cryptography from opposite directions: one explains where the standard curves came from, the other redesigns the quantum arithmetic that would one day attack them.
Where the NIST seeds came from
The provenance of NIST's P-curve "seeds," supplied by the NSA around 2000 with no explanation, has been a running suspicion for a generation. Anthropic says a "curious Anthropic employee asked an internal research model if it could figure out how those seeds were generated," without feeding it the long-rumoured "humorous passphrase" theory. "In under half an hour," the post says, Claude found the answer: the seeds "were... the output of the C library's lrand48 random-number generator, seeded with a Unix timestamp." Claude noticed a statistical signature (top bits cleared), recognised the generator, and recovered its state; the ten prime-curve seeds traced to Unix timestamps between May 1997 and April 1998. It also explained the base points of six May-1997 curves, tracing them to the FreeLIP library's generator.
Anthropic is explicit that this is reassuring, not alarming: "This is not a cryptographic break, new attack, or weakness in the ECDSA curves. In fact, this makes us more confident the curves were chosen without any backdoors." Two things stay open: the binary-curve seed B-163 "fits nothing Claude has tried and remains unexplained," and the base points of P-224, P-256, P-384 and P-521 are still unexplained. The $36,864 bounty is being donated to the Internet Security Research Group. Not everyone reads it as settling the question: on Hacker News, where the post drew more than 700 points, one commenter argued the timestamp recipe is "EXACTLY what a weak curve would look like" because varying the timestamp gives "plausible deniability," a point the post itself concedes is "conceivable."
Redesigning the quantum circuit
The second post, led by Andi Gu in Anthropic's STEM Fellows Program with Harvard and QuEra collaborators, gave Claude Mythos 5 plain-language specifications for eight quantum circuits plus an automated scorer (qubits times gates), and let it iterate "with no human input between rounds." Across all eight primitives it beat the best published designs. The headline case is point addition, the core step in the quantum algorithm that would break elliptic-curve cryptography: after "working for 53 hours," Claude found a reversible way to do modular inversion without storing the usual history of branch decisions, proving the needed identities and checking them in Lean. One resulting circuit "uses 12% more qubits but 17x fewer gates." A second result cut the gate count of a Reed-Solomon decoder, the costliest step in a leading optimization algorithm, "by a factor of 12 relative to Google's previous construction."
Anthropic reports a limitation worth keeping: Claude "was conservative by nature," repeatedly second-guessing real improvements and preferring known approaches, so the team had to prompt it to propose several different methods in parallel and "broaden its search." The breakthrough came only after those nudges.
What remains uncertain. The quantum gains are circuit designs validated against an evaluator, not demonstrations on hardware that does not yet exist; Anthropic notes circuit design "is only one part of building a useful quantum computer." And the seed result settles how the seeds were produced, not whether the choice among candidate seeds was innocent.
Analysis: Read together, these are two instances of the same claim: a model doing open-ended mathematical search that used to take specialists months. The seed result is a tidy closing chapter, useful mainly because it drains a long-running conspiracy; the quantum result is the consequential one, because faster circuit design is a lever on when fault-tolerant machines become useful -- and, eventually, on when today's cryptography is at risk. The caveat that Claude had to be pushed off well-trodden paths is the honest part. Left alone, it polished known designs; the novel idea arrived only after the humans told it to look wider, which is a limit on claims of autonomous discovery, not a demonstration of it.
Anthropic published two October 16 results on elliptic curves: an internal model recovered that NIST's P-curve seeds came from the lrand48 generator seeded with 1997-98 Unix timestamps (easing backdoor fears, though B-163 and four base points stay unexplained), and Claude Mythos 5, iterating against an evaluator, found a reversible point-addition circuit using 17x fewer gates and cut a Reed-Solomon decoder 12x -- after being prompted to stop preferring known designs.