Claude cut a quantum decoder's gate count 12-fold and traced NIST's curve seeds in 30 minutes, and both rested on a machine that could grade the answer
Anthropic closed a 25-year cryptography question in half an hour and beat published quantum circuits in the same afternoon; what made both work, and what a product team can copy, is a cheap machine check on every answer.
Anthropic published two research results within half an hour of each other on Friday. They share almost nothing: one is a set of quantum circuit designs, the other the origin of a cryptographic constant. A physics benchmark published a week earlier supplies a third case.
What binds all three is a checker. In each, something mechanical could say wrong without a human in the loop, and the model could try again.
On the quantum work, Claude redesigned eight building-block circuits from a paragraph of plain English each, and cut the gate count 12-fold on one of them against the best published design. 1 In the cryptography run, a separate model spent under half an hour working out how the NSA's seeds for NIST's elliptic curves were produced, a question open since 2000. 2 TheoPhysEval, a 50-problem benchmark built by 35 physicists, reports GPT-6 Astra answering 49 of them for an average of under $3 each. 3
The checker is the part worth copying. It decides which of your own problems this loop can already solve, and which ones will keep eating engineer hours.
What Claude actually did
A quantum algorithm is a sequence of gates applied to qubits, the quantum equivalent of bits. The expensive gate is the Toffoli, so the field prices a circuit in Toffoli count against peak qubit count.
Anthropic gave Claude Mythos 5 a one-paragraph spec for each of eight circuits, drawn from chemistry, optimization, quantum simulation and number theory. Claude wrote each circuit as Python. An independent evaluator program checked whether it computed the right answer, then returned a single number: qubits multiplied by gates. 1
Claude revised against that score with no human between rounds. On elliptic-curve point addition it ran the loop for 53 hours; human input was the opening brief and a couple of prompts to think more broadly.
Most of point addition's cost sits in one step, modular inversion, and the fastest classical method for it is divsteps. Divsteps repeatedly inspects a pair of numbers and picks an operation. A quantum circuit has to keep every one of those choices, because it has to run the computation backwards, and storing that history had made divsteps impractical in quantum form.
Claude proved a set of algebraic identities about the iteration. From them it derived a rule that recovers each choice from the numbers themselves. It checked that rule numerically, then formalised the claim in Lean, a proof assistant that verifies mathematics by machine. The result is the first reversible divsteps circuit that stores no branch history. 4
On decoded quantum interferometry, an optimization algorithm whose costliest step is Reed-Solomon decoding, Claude swapped the extended Euclidean algorithm for Berlekamp-Massey decoding, then reconstructed temporary values instead of storing them. Its worst-case reserve for saved values fell from 665 qubits to 19.
To justify that cut, the model wrote a simulator and sampled 403 million decodings. Roughly one run in 10,000 exceeded the reserve, which sits inside the error rate the task allows. Gate count fell 12-fold against Google's construction. 1
Loading content card…
The half hour
NIST published its standard elliptic curves in 2000, and each curve carries a "seed", a number whose hash fixes one of the curve's coefficients. The NSA supplied the seeds with no explanation, and that silence fed a quarter-century of suspicion that the parameters had been chosen to hide a weakness. A public bounty had stood unclaimed since 2023. 2
Anthropic's model took a different route from the standing rumour, which held that the seeds hashed a joke phrase. Claude guessed that the generating software used a random-number generator shipped with 1990s C libraries, and wrote a scanner that slid along each seed one bit at a time. Four of the ten seeds turned out to have a zero in the top bit of all 20 words. Chance produces that about once in 5,810 tries.
That pattern is the signature of
lrand48, a generator that returns the top 31 bits of a 48-bit state. Claude recovered the state and ran the generator backwards until it reached the form srand48 produces from a seed. The seeds turned out to be Unix timestamps from May 1997 to April 1998. P-256's published seed was candidate 1,842 of one run.The prime-curve seeds kept fewer bits of each output, which turns state recovery into a lattice problem: pull a hidden number out of partial outputs. Claude solved it with the LLL algorithm.
Anthropic's own reading is that confidence in the curves goes up, because the parameters came from a clock in a way anyone can reproduce. The post's instruction to readers is to enjoy it. 2
The page ships a short Python script under a public-domain dedication. Running it regenerates all ten seeds, P-256 among them as
C49D3608…819F7E90.Two things stay open: the seed of one binary curve, B-163, and the base points of P-224, P-256, P-384 and P-521. The post announcing the result, by Anthropic's Steve Weis, has drawn 5.4 million views. 5
The checker is the whole game
Put a model in a loop with a grader and the number of attempts stops being a cost. Put the same model in a loop where an engineer reviews each attempt, and that review becomes the bill.
A September study measures the gap. Zhang and colleagues studied autonomous vulnerability discovery, where forming a hypothesis is cheap and verifying one requires reachability analysis, execution and a working proof of concept. Across 33 open-source projects and five models, agents spent 30.6% to 51.5% of their completion tokens verifying planted decoys. Real vulnerabilities found fell by 38.7% to 60.4%. 6
The TheoPhysEval authors published the limits of their own result in the paper. Cutting agents off from web search and background papers barely changed accuracy, which the authors read as significant memorisation of the literature. They also write that agents have produced no breakthroughs in theoretical physics, and describe their own problems as turn-the-crank work: a known technique pushed to a new case. 3
So the loop delivers where three conditions hold at once. Correctness has a programmatic definition. Checking one candidate costs seconds. And the score you hand back is the outcome you actually want.
What the eight circuits show
The paper's wording is narrower than the coverage. In seven of the eight tasks, Claude's circuits cut both Toffoli count and qubit count against the state of the art. The eighth, point addition, produced a new architecture, and its best-known member uses 12% more qubits than the smallest prior design in exchange for 17 times fewer gates. Several write-ups this week reported a sweep on all eight. 4
These circuits exist as designs and resource estimates, checked by simulation and, for the divsteps identity, by a Lean proof. A cheaper logical circuit becomes a faster machine only after error correction, routing and control are priced in.
The score itself is a choice. Qubits multiplied by gates is a reasonable proxy for runtime, and optimizing it lets a design trade one for the other, which is what the 17-times result does.
The compute bill for the 53-hour run is the one number the post leaves out.
How a team would run this
The reusable part is the apparatus, and it is engineering work.
Start with a sub-problem whose answer a program can grade: compiler output checked by a test suite, a query plan checked by rows scanned, a schedule checked by makespan (how long the whole job takes), retrieval checked by a fixed eval set. Write the grader first, because the grader is what the search steers by.
Give the model a code-level representation and one scalar score. Claude wrote circuits as Python because a circuit is a program; your equivalent is the file format your system already executes.
Let the search run for hours. The 53-hour run is the shape of a serious attempt, and it worked because each check came back in seconds.
Publish the checker alongside the result. Anthropic shipped runnable code for the cryptography finding, which lets a stranger confirm it in a minute, and the Harvard co-authors on the circuit paper re-derived the results themselves. 1
The hiring that matters is the person who can state correctness precisely enough to be graded. That work is usually a senior engineer's week, and it is what makes the model's 53 hours worth spending.
Where your team sits
You already run an exact checker. Test suites, type systems, ledger balances, recomputation of a stored total. Point the loop at the failure your checker already catches, and set the improvement bar high enough that the model has to restructure something.
You could build a checker this quarter. Pricing rules, capacity planners, retrieval quality, anything with a replayable input and a numeric target. Write the grader first, then hand the model the score.
Your output is judged by taste. Strategy, design, hiring, most writing. The loop will produce candidates faster than your reviewers can read them, and review becomes the constraint you manage.
| What happened | What the check was | Action window |
|---|---|---|
| Claude redesigned eight quantum circuit primitives, 12-fold fewer gates on one | An evaluator computing qubits × gates in seconds | Watch quantum roadmap assumptions; nothing to build this quarter |
| Seeds behind NIST's elliptic curves traced to 1997 timestamps | Arithmetic anyone can regenerate from published code | Nothing to change in your crypto stack |
| 49 of 50 unpublished physics problems solved, under $3 each | Verifiable final answers, set by physicists | Pilot on a checkable sub-problem in the next two quarters |
| Decoy study: agents spent a third to half their tokens checking fakes | Verification priced far above hypothesis | Audit which agent tasks you have no cheap grader for |
What this week establishes: circuit designs that beat published resource estimates at the logical level, a reproducible explanation of where the NIST curve seeds came from, and 98% accuracy on a set of physics problems with known answers. What it leaves open: whether any of it survives contact with hardware, how much of the physics score is recall of the literature, the compute bill behind the 53-hour search, one unrecovered curve seed, four unexplained base points, and the seven-of-eight-versus-eight-of-eight gap that most coverage flattened.
References
- 1
- 2Claude reveals ECDSA curve origins
anthropic.com
- 3
- 4
- 5Steve Weis on X
x.com
- 6
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.