The Signal #109 — Dakota’s read on the AI news that actually matters to people running a business.

There is a mystery that sat open in the cryptography community for more than two decades. Last month, it got closed. By an AI model. In under half an hour.

That detail is worth sitting with for a moment before getting into the specifics.

What happened

ECDSA (Elliptic Curve Digital Signature Algorithm, one of the most widely used standards for verifying digital identities and securing data in transit) was adopted by NIST in 2000 as part of the FIPS 186-2 Digital Signature Standard. The standard defined a set of elliptic curves, and each curve came with a published “seed” parameter, a string of numbers used to mathematically define the curve itself.

The problem: those seeds were provided by the NSA with no explanation of where they came from.

For example, the seed for the widely used P-256 curve was listed simply as a hex string, C49D3608 86E70493 6A6678E1 139D26B7 819F7E90, with no documentation attached. Cryptographers Neal Koblitz and Alfred Menezes wrote a paper on the controversy titled “A Riddle Wrapped in an Enigma.” A public bounty was posted for anyone who could trace the origins.

The most plausible rumor, sourced from a longtime NSA employee named Jerry Solinas, was that the seeds came from hashing a humorous internal phrase, something like “Give Bob and Jerry a raise.” Solinas died in 2023. His colleagues did not remember the details. The archives were never found.

In October 2026, an Anthropic employee asked an internal research version of Claude to figure out how the seeds were generated, without pointing it toward the rumored phrase clue. According to Anthropic’s published research post, Claude found the answer in under half an hour.

The seeds were not the output of any hash function at all. They came from a C library pseudorandom number generator (a deterministic algorithm that produces number sequences that look random but are mathematically reproducible) called lrand48, seeded with a Unix timestamp (a simple integer counting seconds elapsed since January 1, 1970). Claude wrote a scanner that moved along each published seed one bit at a time, testing whether adjacent chunks matched the output of 1990s-era random number generators. It noticed that four of the ten seeds had a zero in the top bit for every 20-word segment, a pattern that would occur by chance with a probability of 1 in 5,810. That was a fingerprint of lrand48, which only returns the top 31 bits of a 48-bit internal state. From there, Claude recovered the generator’s internal state using a standard mathematical technique called the Lenstra-Lenstra-Lovász lattice reduction algorithm. The P-256 curve, for instance, required 1,842 iterations of the generator to produce its seed.

All five NIST prime-curve seeds, plus five more from the ANSI X9.62 standard, traced back to the same approach.

Why it matters

First, the security question. Anthropic is clear: this is not a cryptographic break. It does not weaken ECDSA. It does not mean the curves have backdoors. In fact, the finding does the opposite. Because the seeds came from a simple, reproducible process rather than from any deliberate selection, there is much less room to argue that the parameters were chosen to have hidden weaknesses. Researchers who already trusted the curves now have cleaner justification for doing so.

For operators in financial services, healthcare, SaaS, or any sector that moves data under encryption, the practical answer is the same as Anthropic’s stated conclusion: there is no action to take. Your existing encrypted communications and digital signatures are not compromised.

The more interesting operator angle is what this demonstrates about how AI is actually being used for research-grade investigation right now. A question that stumped experienced cryptographers for over twenty years, that had a public bounty attached, and that lost its best human lead when Jerry Solinas died, was traced to its answer in less than thirty minutes by a model running through logical inference and writing its own scanning code.

This is not a lab curiosity. Real estate transaction platforms, e-commerce companies, digital agencies managing client data, anyone operating in a space where trust in underlying security infrastructure matters now has a cleaner answer to a question that had been open since before many of their current employees graduated from school.

What most people get wrong

The instinct when reading something like this is to frame it as “AI found the answer humans couldn’t.” That framing misses something important.

Claude did not have access to information humans lacked. The published seeds have been publicly visible for over two decades. The mathematical tools Claude used, including lattice reduction algorithms, are well-documented in academic literature. The insight about 1990s-era pseudorandom number generators is the kind of thing a knowledgeable researcher could have reached.

What Claude contributed was a systematic, methodical approach to a problem with a very large search space, no leading clue, and no promising shortcut. It did not get discouraged after failed attempts the way humans do on cold-trail investigations. It did not anchor on the most popular rumor about the humorous passphrase. It asked what the generating software probably looked like, and worked backward from the outputs.

That is a repeatable capability. It applies to any domain where the data exists but the pattern connecting it has not been surfaced yet.

The closing lesson

The value in this story is not that AI solved a mystery. It is that the mystery was solvable all along, from publicly available information, using known techniques, and it stayed open for twenty-five years largely because the search space was too tedious for sustained human attention.

Operators running any kind of knowledge-intensive work, from compliance research to competitive analysis to technical documentation audits, should read this as a signal about where patient, methodical AI investigation is genuinely useful today. Not for magic. For the long, boring problems that keep getting deprioritized.

If you want to think through where that applies in your own operation, xovionlabs.com is a good place to start.