For twenty five years, an unexplained string of numbers sat inside some of the most widely used cryptography on the internet, and nobody could prove whether it was innocent. NIST's standard elliptic curves, the ones underneath TLS, SSH and most of what signs software today, were generated in the late 1990s from seed values the NSA handed over with no explanation of where they came from. Bruce Schneier and cryptographer Filippo Valsorda put up a bounty in 2023 just to recover the inputs, because the question of how those numbers were actually produced had sat open since the people who picked them stopped being reachable. On October 16, Anthropic says an internal Claude research model answered it. The seeds trace back to lrand48, a deterministic random number generator from the C standard library, seeded with Unix timestamps from a window in 1997 and 1998. The seed behind curve P-256, for instance, lines up with a timestamp from the early morning of August 16, 1997. The model guessed the weak generator, ran a scan across dozens of candidate generator and output combinations, noticed a bit pattern that only made sense for lrand48's narrow output, then brute forced the missing bits for the binary curves and used lattice reduction to rebuild the rest for the prime curves.
Anthropic is careful to say this isn't a break of ECDSA, and it isn't. What it actually closes off is twenty five years of a much worse possibility: that the seeds were secretly crafted to be weak. They weren't crafted at all. Somebody in 1998 reached for whatever RNG was sitting in their standard library and used it the way everyone used it back then, and nobody wrote down which one. That's a far less interesting story than a backdoor, and that's exactly why it's worth believing. It's also the kind of problem language models are actually good at right now: a bounded search over a known structure with a way to check the answer, not an open-ended request to be clever.
Three days earlier, on October 13, Microsoft shipped its biggest Patch Tuesday yet, more than 1,400 fixes in one release. Buried in that pile was CVE-2026-96951, a Windows Shell flaw that lets an attacker bypass Mark of the Web, the warning Windows attaches to files downloaded from the internet so they don't just run on open. Microsoft confirmed it was already being exploited before the patch shipped, and CISA added it to its Known Exploited Vulnerabilities catalog the same day, with a fix-it-by date of October 16. Microsoft credited two Fujitsu researchers, Riku Bamba and Yuya Chudo, along with a third researcher, Benoit Sevens, who used Claude as part of finding it.
That last detail got reported in some places as "Claude found a Windows zero-day," which overstates things in a way worth pushing back on. A person used an AI assistant as one tool among several while doing security research, the same way the rest of us reach for a linter or a debugger, and three human researchers get the byline for the work. The useful fact here isn't that a model gets partial credit. It's that a Mark of the Web bypass, sitting in a pile of well over a thousand other bugs, most of which carry scarier severity labels on paper, is the one to patch first, because "already being exploited" beats "critical" every time you're triaging a list that long.
Meanwhile OpenAI spent the week dealing with a much messier trust problem of its own making. The company has been publishing large batches of math results from an internal model for months, and mathematicians have been pushing back hard. Scientific American reported that one of them called the pattern "research misconduct" after finding that an AI-generated proof leaned on an argument that had already appeared in someone else's 2016 paper. On October 15, OpenAI updated its research page to say it's putting $5 million into a new Simons Foundation initiative, with Anthropic chipping in too for a combined $15 million, aimed at paying mathematicians to actually check AI-generated results instead of taking the lab's word for them.
Paying people to verify your claims is a reasonable response to getting caught overstating them, and a mathematician who spends weeks checking a ninety-page machine-generated proof for lines that already exist in somebody else's paper deserves to be paid for that labor rather than donate it. But set it next to the curve seed story above and the contrast is hard to miss. One lab published a result built entirely out of a derivation anyone can rerun and check for themselves. The other published faster than anyone could check, and only afterward funded the infrastructure to find out whether any of it holds up. Work that verifies itself is worth more than money spent convincing people to trust it.