The seeds were supplied by the NSA without explanation.
According to Anthropic, Claude found in under half an hour that the seeds for NIST P-192, P-224, P-256, P-384 and P-521 were not hash outputs, as a popular theory about a humorous passphrase had held.
Instead, they came from the C library's lrand48 random number generator, started from a Unix timestamp.
Anthropic says a curious employee prompted the model in October 2026 without giving it the passphrase clue.
It argues the finding makes deliberate backdoors much less plausible, because the seeds came from a simple, reproducible process built on a common pseudorandom generator and the clock.
Anthropic says the seeds had long drawn suspicion because the curve parameters reached NIST with no account of how they were chosen.
It also notes that most researchers already trusted the curves.
The company has published code that regenerates the seeds, and says the $36,864 bounty for finding them will go to the Internet Security Research Group.
Anthropic describes the method as a search for the kind of weak 1990s random number generator that might have produced the seeds. Claude noticed a zero-bit pattern consistent with lrand48, then used a lattice reduction technique (the LLL algorithm) to recover the generator's internal state for the prime-curve seeds. Stepping that state backward yielded timestamps between May 1997 and April 1998. For the binary curves, the timestamps appear to have been halved. Claude also traced base points for six curves, including P-192 and several ANSI X9.62 example curves, to a random number generator in the FreeLIP integer arithmetic package. Anthropic says open questions remain: why some viable candidate curves were skipped, how the B-163 seed was made, and how the base points for P-224, P-256, P-384, P-521 and the NIST binary curves were chosen.