Topic
Security
4 stories, newest first.
- 01Security17 Oct 2026
Claude traced NIST's ECDSA curve seeds to a 1990s random generator
Anthropic says Claude found that the NSA-supplied seeds for NIST P-192, P-224, P-256, P-384 and P-521 weren't a hash of a joke passphrase but output of the C library's lrand48, seeded with a Unix timestamp (P-256 = candidate 1842, 1997-08-16 UTC). Found in under half an hour; reproducible. Not a crypto break, and it makes a backdoor much less plausible. Still open: the B-163 seed and most base points. The $36,864 bounty goes to ISRG.
Source: Anthropic (opens in a new tab) - 02Security16 Oct 2026
Websites send prompt injections to AI agents in HTTP headers
A scan of 217 million web responses found 7,959 sites sending headers aimed at AI agents and 30 injection attempts; agents that read the web should treat headers as untrusted input.
Source: Signals Corps (opens in a new tab) - 03Security14 Oct 2026
GitHub swaps an LLM for a small ModernBERT model in secret scanning
Regex candidates + fine-tuned ModernBERT classifier: 11.5% higher owner-weighted acceptance, 86% lower median scan time and 98%+ lower serving cost vs the previous LLM pipeline; offline 13% higher precision, 19% higher recall. Now extends generic detection to push protection.
Source: GitHub Blog (opens in a new tab) - 04Security13 Oct 2026
AI models can provably hide skills from safety tests
Proof-of-concept (NeurIPS 2026): an encrypted network hidden in a model's weights runs only on a secret trigger and stays provably hard to elicit. After fine-tuning it scored 50.9% vs 50.6% for a random control; short 8-bit triggers could still be brute-forced.
Source: arXiv (opens in a new tab)