Anthropic's research page now reads as a ledger of things Claude found. Between April 7 and Oct. 16 the company posted six discoveries367891. Each came with a date, a method and a result someone else could check. Its newest entry is the one cryptographers had chased since 1997: where the seeds behind the NIST curves came from.
AI Lately reported that find on Oct. 18. This piece reads the six together.
What makes a find count here? Each one has an outside check. A bounty was paid2.
One preprint drew a CRISPR pioneer's comment, and one map went public with its predicted pixels labeled67. Maintainers of PostgreSQL and OpenSSL described the bug reports they received8.
Anthropic posted six Claude discoveries between April 7 and Oct. 16, 2026
The day each finding was published on Anthropic's research or news pages
Each point is one discovery post, spaced by real time; the magenta point is the NIST curve seeds, the newest.
Sources: Anthropic [1]; Anthropic [3]; Anthropic [6]; Anthropic [7]; Anthropic [8]; Anthropic [9]. Chart by Kelly Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| April 7, 2026 | Glasswing finds bugs. Claude Mythos Preview, flaws in every major OS and browser |
| Sept. 23, 2026 | Enzyme system found. CRISPR-like repeats |
| Oct. 8, 2026 | UV sky map. Claude Science with Brice Ménard |
| Oct. 8, 2026 | OSS Scanner opens. 29,000 candidate vulnerabilities |
| Oct. 16, 2026 | Quantum circuits. Eight circuits improved |
| Oct. 16, 2026 | NIST curve seeds. A 1997 timestamp |
The Bugs Came First
Project Glasswing opened the run on April 7. Anthropic gave eleven partners, Amazon Web Services and Apple among them, a model called Claude Mythos Preview3. The model "has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser," Anthropic wrote.
Two examples carry the age of the code. One was a 27-year-old flaw in OpenBSD that let an attacker crash any machine running the system over the network3. Another sat in a line of FFmpeg that automated testing tools had hit five million times. The tools had missed it every time.
By late May the count had a number. Anthropic's first progress report put the partners' total past 10,000 high- or critical-severity vulnerabilities, Engadget and Help Net Security reported54. Anthropic had also scanned more than 1,000 open-source projects. That scan listed 23,019 issues, of which 6,202 were high or critical.
Six outside security firms and Anthropic assessed 1,752 of those, and more than 90 percent held up4.
The bottleneck moved from finding to fixing. On Oct. 8 Anthropic opened OSS Scanner, a free scan for open-source projects that opt in8. Over six months its models had turned up more than 29,000 candidate vulnerabilities. People had reviewed about 6,000 of them, and maintainers had asked for and received nearly 5,000 raw reports.
Claude found 29,000 candidate vulnerabilities, and people reviewed about 6,000
Anthropic's six-month count behind OSS Scanner, Oct. 8, 2026: candidates found, reviewed by people, and raw reports sent on request
Each bar is one stage of Anthropic's count; the magenta bar is the candidates its models found, and the blue bars are the share people had reviewed and the raw reports maintainers asked for.
Source: Anthropic [8]. Chart by Kelly Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Candidates found | 29,000 |
| Reviewed by people | 6,000 |
| Raw reports sent | 5,000 |
Noah Misch, who works on PostgreSQL, put the quality in his own words. "An unusually high fraction of OSS Scanner's findings uncovered PostgreSQL defects. Several reports came with fixes we can use nearly as-is, and fast-track access let us address the newest issues before they reached a GA release," Misch said8.
Anton Arapov of OpenSSL Corporation went further back. "Early AI reports about 18 months ago, before Project Glasswing, were appalling. The reports we received from Anthropic, raw model output included, were as good and sometimes better than what we get from people," Arapov said8.
Language models went from under 20 percent to over 85 percent of CyberGym flaws found
Share of vulnerabilities found on CyberGym, an academic benchmark, at the start of 2025 and in 2026, per Anthropic; higher is better
Each column is one point in time; the magenta column is this year's share.
Source: Anthropic [8]. Chart by Kelly Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Start of 2025 | 20% |
| 2026 | 85% |
One benchmark line sums up the change. CyberGym is an academic test of vulnerability finding. At the start of 2025, language models found under 20 percent of its flaws8. This year they find over 85 percent, Anthropic wrote.
Then the Sciences
The second find came from a lab Anthropic built for the purpose. On Sept. 23 the company said Claude had found a novel enzyme system in a jumbo phage, "with only high-level direction from our scientists"6. Beside it sits an array of DNA repeats that reads the way CRISPR once did.
Scientists already knew the underlying enzyme. The repeat array and an accessory protein were the new part, and their function stays unknown6.
Next came a map. Brice Ménard is an astrophysicist at Johns Hopkins University and a researcher at Anthropic7. He used Claude Science to fill the holes in the ultraviolet picture of the sky.
NASA's GALEX mission had imaged about two-thirds of the sky between 2003 and 20137. It skipped the bright plane of the Milky Way to protect its detectors.
About a third of the finished map is predicted. Each pixel carries a label saying whether it was measured or guessed7.
Number four landed on Oct. 16, the same day as the seeds. Andi Gu's team gave Claude Mythos 5 plain-language specifications for eight quantum circuits, plus an evaluator that scored each design9. Claude improved on the best published circuit in every case, by an order of magnitude or more in some. Its decoder for one Google algorithm uses twelve times fewer gates than Google's construction, and it came out of a single 53-hour run.
Why does that number matter? Anthropic's post uses a molecule called FeMoco as its textbook example. In 2017 researchers put its simulation at about 50 trillion of the costliest quantum gates9.
Eight years of work by many groups brought that to about 340 million9. Claude's run compressed a step of that kind into two days.
The Seeds, and the Celebration
Sixth and oldest is the seed riddle. Every NIST curve was built from a seed the NSA supplied and left unexplained1. For years the best story was that Jerry Solinas had hashed a joke.
In October an Anthropic employee asked an internal research model how the seeds were made1. Under half an hour later it answered: the output of lrand48, a 1990s C library generator, seeded with a Unix timestamp.
P-256's seed was candidate 1,842 of a run started on Aug. 16, 19971.
Filippo Valsorda had posted a bounty for exactly this in October 202311. He set it at $12,288, tripled to $36,864 for a winner who gave it to charity. Anthropic's team claimed it on Oct. 15 and sent the full $36,864 to the Internet Security Research Group, the nonprofit behind Let's Encrypt21. Valsorda rebuilt the algorithm in Go and matched the seeds himself.
Read that as the celebration it is. A model guessed the generator, recognized its signature in the published bytes, and recovered its state with a standard lattice technique1. Then it wound the clock back to a date in 1997. Anthropic printed the model's own reasoning at that moment: "Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment?".
Anthropic kept the open items in the post. One binary seed, B-163, defeated every generator Claude tried1. Four base points stay unexplained, and a handful of valid candidates were skipped for reasons the record omits.
The Case For and the Case Against
Feng Zhang is a pioneer of CRISPR genome editing at MIT and the Broad Institute. He read the enzyme preprint and made the case for taking these finds seriously. "This is an exciting example of how AI agents can contribute to biological discovery. The identification of RNA-repeat arrays associated with reverse transcriptases is genuinely intriguing and merits further investigation," Zhang said6.
Gabriel Anhaia, a software engineer who writes about AI tools, read the seeds post the day after it ran. He made the case against inflating it. "Before you go looking for something to patch: Anthropic's own post says 'There is no action to be taken or things to do differently.' What the story does give you is a settled argument from the late 1990s, and a good reason to check what mints your session tokens," Anhaia wrote10.
His reading of the half-hour claim rests on one word, confirmed. The public evidence is Anthropic's account of an internal run, checked by a human expert in code the next day102.
Both readings fit the record. Each find on Anthropic's list came with an outside check. Every one also came from Anthropic's own pages, on Anthropic's own models, with the model's name withheld in the seeds case1.
What to do
Judge each find by its outside check, the way the bounty, the preprint comment and the maintainers' quotes work here. A result with a reproducible script, a labeled map or a patched bug is one you can cite.
Treat the vulnerability numbers as a queue. Anthropic itself says its people reviewed about 6,000 of 29,000 candidates8. A project you depend on can opt into OSS Scanner and receive the raw reports, so ask its maintainers whether they have.
By the numbers
- 6 discovery posts on Anthropic's research pages between April 7 and Oct. 16, 2026367891.
- $36,864: the bounty Anthropic's team claimed on Oct. 15 and gave to the Internet Security Research Group21.
- 29,000 candidate vulnerabilities found over six months, about 6,000 of them reviewed by people8.
- 10,000 high- or critical-severity flaws found by Glasswing partners by late May, per Anthropic's first progress report54.
- 90 percent of 1,752 assessed findings held up as true positives4.
- 12 times fewer gates in Claude's decoder than in Google's construction, from one 53-hour run9.
- 85 percent of CyberGym flaws found by language models this year, up from under 20 percent at the start of 20258.
- 1,842: the candidate number of the P-256 seed in a run begun Aug. 16, 19971.
What to watch
Anthropic says it has yet to learn the enzyme system's function6. Learning it would turn the second find from a pattern into a tool.
Whether a hardware group runs one of Claude's eight circuits, and how the quantum paper fares on arXiv, would settle the fourth9. For the seeds, B-163 and the four unexplained base points are the open questions1. Anyone with the published scripts can take them up. The CryptoLately.com Desk reads the same find for Bitcoin's own curve at cryptolately.com.
Sources
- Anthropic Frontier Red Team, "Claude reveals ECDSA curve origins," Anthropic, Oct. 16, 2026, https://www.anthropic.com/research/ecdsa-curve-origins
- Filippo Valsorda, "The NIST Elliptic Curves Seeds Bounty Has Been Claimed," Oct. 16, 2026, https://words.filippo.io/seeds-solved/
- Anthropic, "Project Glasswing: Securing critical software for the AI era," April 7, 2026, https://www.anthropic.com/glasswing
- Help Net Security, "Anthropic: Claude Mythos identified 10,000+ software flaws," May 26, 2026, https://www.helpnetsecurity.com/2026/05/26/anthropic-project-glasswing-update/
- Engadget, "Anthropic says Mythos has already found more than 10,000 vulnerabilities," May 23, 2026, https://www.engadget.com/2180028/anthropic-claude-mythos-preview-project-glasswing-update/
- Anthropic, "Claude discovers a novel enzyme system with CRISPR-like repeats," Sept. 23, 2026, https://www.anthropic.com/news/claude-discovers-novel-enzyme-system
- Brice Ménard, "The missing map of the sky," Anthropic, Oct. 8, 2026, https://www.anthropic.com/research/the-missing-map-of-the-sky
- Anthropic Frontier Red Team, "Launching an opt-in vulnerability-finding service for open-source software," Anthropic, Oct. 8, 2026, https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source
- Anthropic, "Designing more efficient quantum circuits with Claude," Oct. 16, 2026, https://www.anthropic.com/research/designing-efficient-quantum-circuits
- Gabriel Anhaia, "Claude Traced the NIST Curve Seeds to a 1997 Clock and lrand48. Nothing to Rotate on P-256," DEV Community, Oct. 17, 2026, https://dev.to/gabrielanhaia/claude-traced-the-nist-curve-seeds-to-a-1997-clock-and-lrand48-nothing-to-rotate-on-p-256-50d3
- Filippo Valsorda, "Announcing the $12k NIST Elliptic Curves Seeds Bounty," Oct. 5, 2023, https://words.filippo.io/dispatches/seeds-bounty/
- The Hacker News, "Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems," April 7, 2026, https://thehackernews.com/2026/04/anthropics-claude-mythos-finds.html