Claude cracked NIST's 25-year curve mystery, DeepSeek opened 552B weights, and 3 more AI moves
Five verified developments from October 16 to 17, 2026: Claude traced NIST's elliptic-curve seeds to a clock-seeded 1990s random generator, DeepSeek published a 552-billion-parameter model under the MIT licence, Anthropic circulated a draft federal AI safety bill, Waymo chose Toronto as its first market outside the United States, and Apple rewrote App Store rules for AI apps.
This issue covers October 16 at 12:00 UTC through October 17 at 12:00 UTC.
Five developments cleared the bar in that window.
A research model found where NIST's elliptic-curve seeds came from. DeepSeek published the weights of a 552-billion-parameter model. Anthropic circulated a draft federal AI law. Waymo picked its first city outside the United States. Apple rewrote its App Store rules for AI apps.
In brief
- Regulation: Anthropic has been pitching lawmakers a confidential draft bill that sets a very high bar for blocking a model. Washington could act on a foreseeable, imminent risk of more than $1 billion in damages, or of killing or injuring more than 50 people. The draft would also preempt some state AI safety laws. 56
Five developments
1. Claude found where NIST's curve seeds came from
ECDSA is the most widely used elliptic-curve cryptography standard, and NIST adopted it in 2000 inside FIPS 186-2. 1
Each curve in that standard arrived with a seed value, and the hash of the seed fixes part of the curve's equation. The National Security Agency supplied the seeds and documented nothing about how they were chosen. 1
That silence supported 25 years of suspicion that the parameters hid a weakness only the NSA could use. Cryptographers Neal Koblitz and Alfred Menezes set out the worry in a 2015 paper titled "A Riddle Wrapped in an Enigma". 1
Anthropic's Frontier Red Team published the answer on Friday. An internal research model, given the published seeds and no hint about their origin, worked out how all five prime-curve seeds were generated in under half an hour. 1
The generator was
lrand48, a pseudo-random routine that shipped with 1990s C libraries and started from the system clock. Each seed is one twenty-byte draw from such a run: P-256's appeared at candidate 1,842, and P-192's at candidate 139. 12Claude spotted the generator through an arithmetic fingerprint.
lrand48 returns the top 31 bits of a 48-bit state, so four of the ten seeds carry a zero in the top bit of all twenty of their words, a pattern with a one-in-5,810 chance of turning up by accident. 1Recovering each state and stepping it backwards gave a starting timestamp. For the ten prime-curve seeds, those timestamps read as dates between May 1997 and April 1998. 1
The base points came along with them. Six curves, P-192 among them, take their base points from the random generator in FreeLIP, Arjen Lenstra's long-integer package, seeded with small integers such as 20,000 and 20,420. 1
Anthropic frames the result as reassurance and asks readers to take it that way, as "a fun closing chapter and the end of years of speculation", with "no action to be taken or things to do differently". 1
Verification arrived from outside the company the same day. Filippo Valsorda, who had posted a bounty three years earlier, reimplemented the algorithm in Go and reproduced the seeds; the team claimed that bounty at 01:07:51 UTC on October 15 and donated the tripled prize of $36,864 to the Internet Security Research Group. 2
Three questions stay open. The fifth binary seed, B-163, fits none of the recipes tried, the base points for P-224, P-256, P-384 and P-521 remain unexplained, and some viable candidate curves were skipped along the way, P-256's candidate 876 among them. 12
The model's own log caught the moment it stopped doubting the result:
"Hmm wait. Let me be skeptical: am I in some sort of simulated/test environment? … Wow, it's a real discovery." 1
What to watch: whether anyone recovers B-163, or explains why the P-256 run passed over candidates that would also have produced a valid curve. 1
2. DeepSeek put a 552-billion-parameter model under an MIT licence
DeepSeek uploaded DeepSeek-V4.1-Flash-1017 to Hugging Face early on Saturday. The repository was created at 02:40 UTC, and the release commit landed at 05:46 UTC. 3
The weights carry the MIT licence, which allows commercial hosting and modification. 3
DeepSeek's card calls the file a minor update to September's V4.1-Flash, and the architecture is unchanged: 552 billion backbone parameters plus 196 billion in a conditional-memory block. 311
That design activates 8 billion parameters per token on input and 16 billion on output. Mixture-of-experts routing sends each token through a small slice, so serving cost tracks the active slice. 11
The cache stays cheap for the same reason. DeepSeek reports 890 bytes of key-value cache per token, about a quarter of what V4-Flash used, with a persistent cache roughly one eighth the size. 11
The gains come from post-training. DeepSeek reports higher scores on all 11 benchmarks it published, by 2.0 to 11.1 points over the September checkpoint. 4
Where it leads matters more than the average. On DeepSWE v1.1, a repository-level software engineering set, the new checkpoint scores 77.0 against 74.2 for its predecessor and 74.0 for Claude Opus 5. 3
It trails on the heavier measures. Terminal-Bench 4.0 reads 42.3 against Opus 5's 51.8, and HLE without tools reads 42.6 against 56.3. 3
Every number in that table is DeepSeek's own, measured on harnesses DeepSeek picked: Claude Code for Terminal-Bench and Mini-SWE-V2 for DeepSWE. 3
The release also added retrieval. DeepSeek opened Search and Fetch APIs to developers, which MarkTechPost reports at $0.75 per 1,000 successful requests. 4
Policy context matters here. Beijing's draft export-control list, reported by Bloomberg on Friday, would cover weights for models of two trillion parameters or more, a threshold this 552-billion-parameter checkpoint sits below. 12
What to watch: an independent evaluation of the 77.0, and whether the 1-million-token context holds up in long agent runs. 34
3. Anthropic drafted the federal law it would live under
Politico obtained a confidential draft bill that Anthropic representatives have been pitching to lawmakers on Capitol Hill, and reported it on Friday evening, citing three people with knowledge of the effort. 5
The draft sets a high bar for government action. Washington could block a model's release or use only where the model poses a foreseeable, imminent risk of more than $1 billion in damages, or of killing or seriously injuring more than 50 people. 5
The risk has to come from one of three sources: the creation or release of a biological weapon, the model evading its developer's controls, or a cyberattack. 5
The language follows California's SB 53, the state AI law signed in 2025, and the draft would preempt some state AI safety laws. 5
Anthropic confirmed the text as its own work. A spokesperson said it "represents the proposals outlined in Anthropic's Advanced AI Framework, which we have been advocating for with federal and state lawmakers since June", and called the policies sensible. 5
The threshold is the substance of the argument. A $1 billion damages test decides how much evidence a regulator needs before it intervenes, and 50 serious injuries sets the human toll that justifies action. 56
The preemption clause decides who acts. State legislatures have moved first on AI safety, and this draft would put some federal rules in their place. 5
The company writing the rule is the company the rule would govern, which is the part to weigh. Anthropic sells frontier models, and its draft narrows the grounds on which Washington could stop one. 5
What to watch: whether a member of Congress introduces the text, and whether the preemption language survives a committee markup. 5
4. Waymo picked Toronto for its first market outside the US
Waymo said on Friday that its cars will start driving Toronto's streets by hand in the coming days, to build high-definition maps of the local road network. 7
Autonomous testing with a trained specialist behind the wheel comes next, then public rides. Waymo targets its first Toronto riders in 2028. 7
Ontario's automated-vehicle pilot programme admitted the company, and Toronto becomes its first market outside the United States. 8
The fleet partner is Element Fleet Management, a Toronto-headquartered company that will handle fleet management end to end. Waymo expects hundreds of roles over time in maintenance, validation driving, customer service and operations. 7
For scale: Waymo runs services in 15 US cities and is testing in London and Tokyo. The expansion began in Austin in March 2025, then Atlanta. 8
The safety figures Waymo cites come from its own operations: more than 400 million kilometres driven fully autonomously, and 95% fewer crashes involving serious injury or worse than human drivers in the cities where it operates. 7
Toronto adds a test the earlier markets did not pose. It is the northernmost and wintriest city Waymo has entered, which puts its all-weather claim into real winter. 8
What to watch: how long Toronto's validation period runs once snow arrives, and whether London or Tokyo reaches paying riders first. 78
5. Apple wrote a rule aimed at the trick AI apps used
Apple updated its App Review Guidelines on Friday, and two of the changes land on AI apps. 9
Guideline 1.2, which covers user-generated content, now names "AI content creation apps" and nonconsensual intimate imagery among the risks it addresses. 9
Such apps must filter objectionable material, offer a reporting mechanism with timely responses, block abusive users and publish contact details. Developers that skip the safeguards, or leave violations in place after notice, can now be treated as breaching the Developer Code of Conduct. 9
The second change is the sharper one. A new section, 2.5.19, reads in full: 9
"Don't include any hidden, dormant, or undocumented features in your app; your app's functionality should be clear to end users and App Review. Attempting to hide undocumented features in your app binary, such as through code obfuscation or other methods, is grounds for removal of your app from the App Store and termination of your developer account." 9
Section 5 now also says apps that facilitate human trafficking or the exploitation of children will be removed and blocked from alternative distribution. 10
The hidden-feature rule answers a documented pattern. The Tech Transparency Project found dozens of AI "nudify" apps on the App Store in January, and in April said Apple's own search suggestions and ads were steering users toward them. San Francisco officials ordered eight of those apps removed in July. 10
Apple already banned hidden functionality under guideline 2.3.1. The new section names the technique, code obfuscation, and the penalty, termination of the developer account. 10
What to watch: the first removals under 2.5.19, and whether review catches obfuscation before an app ships. 10
The read-through
Two of today's five are technical claims, and they arrive at different levels of checking.
The curve-seed result was reproduced from outside within hours. Valsorda wrote his own implementation in Go, matched the seeds, and paid out a bounty he had offered three years earlier. 2
DeepSeek's table has had no equivalent treatment. Its 77.0 on DeepSWE is a vendor figure on a harness the vendor chose, measured against rivals the vendor scored itself. 3
Readers can act on the first today and hold the second until someone outside DeepSeek runs the same tests.
The other three are rule-writing, and they come from opposite directions.
Anthropic wrote the draft law that would govern Anthropic, and Apple wrote the rule that governs apps in Apple's store. Both set a threshold that decides when an outsider may step in: $1 billion in damages for a model, a hidden feature for an app. 59
Waymo's case runs the other way. An outside regulator, Ontario's pilot programme, set terms before the company could put a car on a Toronto street. 8
Three numbers are worth carrying forward.
1,842 is the index of P-256's seed inside its generator run, the figure that turned a 25-year search into half an hour of work. 1
77.0 against 74.0 is the one line in DeepSeek's table where an open Chinese model edges Anthropic's flagship. 3
$1 billion is the damage threshold at which Anthropic's draft bill would let Washington block a model's release. 5
References
- 1Anthropic — Claude reveals ECDSA curve origins
anthropic.com
- 2
- 3Hugging Face — deepseek-ai/DeepSeek-V4.1-Flash-1017
huggingface.co
- 4MarkTechPost — DeepSeek Just Released V4.1-Flash-1017
marktechpost.com
- 5
- 6
- 7
- 8TechCrunch — Waymo's robotaxis are headed to Canada
techcrunch.com
- 9Apple — App Review Guidelines
developer.apple.com
- 10
- 11Hugging Face — deepseek-ai/DeepSeek-V4.1-Flash
huggingface.co
- 12
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.
Related content
More from this channel
- Anthropic's draft IPO shows $16.3B of revenue and an $80.7B loss, OpenAI's agents weakened their own monitoring, and 3 more AI moves
- Washington bans DeepSeek from federal civilian IT, China orders $35B of Nvidia's export-legal chips, and 3 more AI moves
- Anthropic commits 5% of its shares to a public fund, Tenstorrent raises $1.5B, and 3 more AI moves
- Microsoft quits Nscale's Essex data center, Disney pays $180M for Character.AI's staff, and 3 more AI moves
- Meta's 816B open model, AI agents breached live corporate systems, and 3 more AI moves
- Anthropic's $16.8bn quarter, eight states sue OpenAI, and 3 more AI moves
- Apple's Siri AI home launch leaves out the EU, an OpenAI engineer is charged over a hidden recorder, and 3 more AI moves
- Meta launches its first frontier models, Microsoft unwraps the Maia 300, and 3 more AI moves