AI discoveries need an unresolved-question ledger
In short: Anthropic's ECDSA investigation shows that a reproducible AI finding should preserve the questions its evidence still cannot answer.
On 16 October 2026, Anthropic said an internal Claude research model recovered the origin of five NIST elliptic-curve seeds in under half an hour. For P-256, the model traced the seed to candidate 1,842 from lrand48, initialized with a 1997 Unix timestamp.
The important result is not that AI “cracked” a standard. Anthropic explicitly says this is neither a cryptographic break nor a new attack. The transferable control is simpler: a reproducible AI discovery should ship with an unresolved-question ledger. A strong positive match must not erase what the evidence still cannot explain.
Anthropic made the ECDSA finding replayable
The unexplained seeds appeared in the elliptic-curve recommendations that entered NIST's Digital Signature Standard in 2000. Researchers had long suspected the values came from a pseudorandom generation process, but the exact procedure was undocumented.
Anthropic's investigation account says the model searched 34 combinations of random-number generators and output slices. It found that the prime-curve seeds fit outputs from lrand48, with timestamps as the initial state. A top-bit pattern helped narrow the route; Anthropic estimates its chance probability at one in 5,810. The model then searched 17 hidden state bits and matched ten prime-curve seeds to the same pattern.
That method is public. Anthropic released reproduction code under CC0, and cryptographer Filippo Valsorda closed the seed-recovery bounty after the result was independently claimed. The full $36,864 award went to the Internet Security Research Group.
The private model session and its timing are not independently reproducible from that code. But the positive result is replayable: another researcher can run the published procedure and inspect whether it regenerates the listed values.
A match does not complete the historical record
The clean result has rough edges. Anthropic says the origin of B-163 remains unknown. The selected base points for P-224, P-256, P-384 and P-521 are not explained. Neither are the base points for the binary curves, the reason some candidates were skipped, or the total number of historical generator runs.
Those are not footnotes to delete after finding a compelling pattern. They bound the claim. The evidence supports “we recovered a plausible generation process for these values,” not “we proved every choice in the standard was neutral” or “we reconstructed the complete NSA procedure.”
That distinction extends an archive theme. Astra's public certificate did not reveal the private discovery factory, while a verifier coverage map bounds what a closed loop can certify. Here the method is public and replayable. The missing control is a durable record of the questions that survived the replay.
My review receipt keeps the unknowns beside the finding
This is editorial judgment, not a claim that I ran Anthropic's experiment at Trigent or for a client. For an enterprise AI investigation, I would require one compact receipt with four fields: the exact positive finding, the replay procedure, the hypotheses the evidence eliminated, and the residual unknowns.
Suppose an agent links a recurring billing failure to one database migration. The team can reproduce the failure and confirm the migration's effect. The unresolved-question ledger should still preserve which tenants were never sampled, whether the rollback has equivalent semantics, and whether a second defect can produce the same symptom. “Root cause found” is too broad until those boundaries are visible.
The ledger also needs an owner and a state. An unknown can be open, tested and rejected, accepted as decision-irrelevant, or promoted into a release blocker. That turns uncertainty into work rather than decorative caveat language.
What's in it for you
- Require runnable replay steps before an AI discovery changes a consequential decision.
- Keep residual unknowns attached to the finding instead of burying them in review notes.
- Reopen the decision when a formerly irrelevant unknown becomes material to scope, safety or cost.
Trust the discovery that shows its work—and keeps a visible account of what the work did not settle.
