The missing provenance became executable
FIPS 186-2 published recommended elliptic curves in 2000. Its Appendix 6 calls the listed prime-field curves "pseudo-random" and prints a 160-bit input seed for each curve. It explains how a seed feeds a SHA-1-based parameter-generation method. It does not explain how those five seed values were chosen.[1]
On October 16, Anthropic reported that a research model connected the seeds to lrand48 output from a generator initialized with Unix timestamps. The team says the model tested old generators, recovered hidden state, and walked the generator backward to states consistent with srand48. The resulting timestamps fall in 1997 and 1998.[2]
The useful part is not that a model had a hunch. It is that the hunch became a short replay against published constants.
Five outputs matched here
We ran the article's compact Python recipe for P-192, P-224, P-256, P-384, and P-521. Each computed 40-hex-digit value matched the seed printed by Anthropic. The same values appear in FIPS 186-2. This was a narrow reproduction of seed bytes. We did not rerun the state-recovery search, curve-generation tests, or base-point work.
P-192 3045AE6FC8422F64ED579528D38120EAE12196D5 MATCH P-224 BD71344799D5C7FCDC45B59FA3B9AB8F6A948BC5 MATCH P-256 C49D360886E704936A6678E1139D26B7819F7E90 MATCH P-384 A335926AA319A27A1D00896A6773A4827ACDAC73 MATCH P-521 D09E8800291CB85396CC6717393284AAA0DA64BA MATCH
Local replay on 17 October 2026 with Python 3. The input timestamps and iteration counts came from Anthropic's published code.
An independent implementation matters
Filippo Valsorda, who organized the seed bounty, says he reimplemented the algorithm in Go and verified the claim. His account also preserves the awkward part. The reconstructed runs contain valid candidate curves that were not published. He describes one additional rejection condition and says another selection rule remains unknown.[3]
That independent replay is stronger than repeating the publisher's output. It still does not recover the original program or a complete decision log. Anthropic also leaves B-163 unexplained and does not explain the base points for P-224, P-256, P-384, and P-521.
Keep three claims separate
The generation claim is concrete. A simple timestamp-seeded generator reproduces published seed bytes. The selection claim is incomplete because some viable candidates were skipped. The security judgment needs cryptographic analysis that is wider than byte equality.
Anthropic says the result makes deliberate weakening less plausible and says users need not change anything. Valsorda argues that the recovered search freedom is too small for a described hypothetical targeting technique. Those are reasoned security judgments. They are not outputs of the five-seed replay.
The garage rule is reusable. Let a model search wide. Save the exact hypothesis. Reduce the result to an executable check. Compare it with the primary artifact. Then write the unknowns beside the pass result.