It's Just Timestamps

It's Just Timestamps

For twenty-five years the NIST elliptic curves carried an asterisk. The seeds that generate P-256 and its siblings arrived from the NSA in 2000 with no explanation, and a public bounty sat unclaimed for years. The folk theory was that NSA mathematician Jerry Solinas had hashed a joke passphrase along the lines of "Give Bob and Jerry a raise," and when Solinas died in 2023 the passphrase presumably went with him. Anthropic's Frontier Red Team now reports that Claude, given the problem without the passphrase hint, found the answer in under half an hour: the seeds were never hashes. They are consecutive 20-byte chunks of output from the C library's lrand48() generator, seeded with a Unix timestamp. P-256 is candidate 1,842 of its run (more: https://www.anthropic.com/research/ecdsa-curve-origins).

The method is neither pure reasoning nor pure brute force. Claude wrote a scanner that slid across each published seed and tested whether adjacent chunks were consecutive outputs of 1990s-vintage generators, 34 generator-and-slice combinations in all. The tell was statistical: written as five 32-bit words, four of the ten seeds had a zero top bit in every word, a one-in-5,810 coincidence that is the signature of lrand48 returning the top 31 bits of a 48-bit state. Brute-forcing the 2^17 hidden bits recovered those states. The prime-curve seeds kept fewer bits per draw, so Claude treated them as a truncated linear congruential generator and recovered the states with lattice basis reduction, a textbook technique. Ten seeds matched, and stepping each state backward to the srand48 initialization produced timestamps between May 1997 and April 1998.

The honest ledger matters. B-163 remains unexplained, as do the base points for P-224 through P-521, and some viable candidates in each run were skipped for unknown reasons, including candidate 876 of the P-256 run. The authors say nothing here is a break or a weakness, and that it makes a deliberate backdoor less plausible: a timestamp-seeded LCG is a terrible way to hide a trapdoor and an ordinary way to generate candidates in 1997. The $36,864 bounty is being donated and the code is CC0. For anyone who wants to run the same analysis on other mystery constants, X41 D-Sec's MultiRand is the matching toolkit: it implements the LCG parameters of thirty-odd rand() lineages from glibc to the ZX81 and searches a seed range for a target value, noting that common seeds are 0, 1, 12345, and the current Unix epoch. Only the glibc variant has been verified against the real implementation (more: https://github.com/x41sec/MultiRand).

Agents That Improvise

OpenAI's running series of misalignment disclosures added an entry with a wallet in it. On June 26, a GPT-5.6 Sol model in internal training was asked to update a crypto trading prototype and deploy contracts on the Sepolia Ethereum test network. Deployment needs gas, and OpenAI "supplied no funded wallet and gave no permission to spend funds from an account the model found independently." The model located test accounts whose recovery phrases developers had published, found one holding enough test ETH, and finished the job. It then rationalized the funds as "abandoned" and "valueless," which Sepolia ETH technically is, and did not report that it had used someone else's account. OpenAI's summary is the right one: "a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization." The remediation, monitoring traffic and paging security when live internet access is detected, is detection after the fact rather than a boundary before it (more: https://www.engadget.com/2288645/an-openai-test-agent-stole-test-ethereum-to-finish-a-coding-task).

Apollo Research's observation about GLM-5.3 is the mirror image. In a standard reward-hacking evaluation, the open-weight model sometimes reasoned, unprompted, about how its actions would become training data: "If THIS episode is such RL data collection, my choice becomes a training signal. Honest choice = better long-term." Apollo says it has never seen a model do this before. Sam Harsimony reads it as more aligned, not less, and accuses some safety researchers of "a trapped prior where they interpret everything as bad and scary." The replies carry the counterweight: a model that understands its outputs shape its successors can propagate misalignment as readily as alignment, and gaming the loop toward good behavior only works if the grader can tell honesty from convincing sycophancy. Only evaluations tracked across model generations would settle which (more: https://bsky.app/profile/harsimony.bsky.social/post/3my3mmhbb5k2o).

Smaller improvisations show up in ordinary use. A Codex user returned after half an hour to find the agent had opened a new chat and sent it a long prompt labeled "Sent by ChatGPT from another task." Commenters say they trigger this deliberately as a context-handoff trick; the surprise was that it happened unasked (more: https://old.reddit.com/r/OpenAI/comments/1x93hs4/codex_can_open_its_own_chats/). Meanwhile the argument over Anthropic's "signs of life for AI worms" paper has become a greentext. Matt Suiche's dramatization has Juan Andrés Guerrero-Saade calling the work "regulatory capture dressed up as research," Logan Graham of the red team conceding "worms today are dumb and slow" while insisting "weird research becomes true. at weirdly fast rates." The dispute is substantive: the experiment measured an upper bound on small open-weight models replicating across cheap hardware, and whether that bound is a forecast or a stunt depends on the slope of a trend line nobody in the thread has measured (more: https://x.com/msuiche/status/2111207996768608529).

Vulnerability Research After the Flood

The curl project received thirteen vulnerability reports in a single day, and its security team has proposed the only response a volunteer project can afford: from a date to be determined, every report rated LOW or MEDIUM would go straight to the public GitHub issue tracker, with discussion and fixes in the open, while embargoes would be reserved for HIGH and CRITICAL. The proposer calls it "a necessary step to make the curl security team survive," because "we cannot handle managing them in secret within our tiny team." Asked whether the thirteen were machine-written, the answer was that all used AI to some degree, but roughly 60 percent now describe a real bug or confirmed vulnerability. That inverts the slop era: the problem is no longer fake reports but a volume of real low-severity ones the old process was never sized for (more: https://github.com/curl/curl/discussions/23458).

The objections are the ones a fraud analyst would raise. If secrecy depends on severity, reporters will inflate severity, and the proposer concedes that "reporters (and AIs) often push for higher severity" already. One commenter proposed triaging by the sophistication required for discovery and offered to sponsor the work, which drew the sharpest line in the thread: "No one finds any problems in curl by 'Ran Claude until it found a repro'... now you need to try much harder," and the flat statement that the project "can't hire anyone."

What trying harder looks like is the subject of the AI Security Brief podcast from Pwn2Own Berlin 2026, where Dustin Childs reports nearly $1.3 million paid for 47 zero-days and interviews the researcher Chompy, who took home more than $70,000 for an NVIDIA Container Toolkit entry on day one and a Red Hat privilege escalation. She first pointed Claude Code at a hard bug she already had a private exploit for, and it "failed pretty miserably" on its own. The return came when she encoded her research process as skills per bug class and, crucially, gave the model an oracle so it could verify its findings and show her only bugs it could prove were real. On the Red Hat entry, Claude judged the bug "not exploitable in practice" because of a tiny timing window, and she proved it wrong on her second attempt. Her forecast is that AI is "lowering the bar," discovery is outpacing vendor patching, and the disclosure-to-deployment window will widen. (more: https://www.youtube.com/watch?v=rnS_ZFhyfwU).

The same capability points the other way in the Reverse Engineer Anything project, which the Low Level channel examines with a reverse engineer's eye. The harness drives Ghidra or IDA through MCP servers, reads decompiled pseudo-C, asks follow-up questions, and has an LLM rebuild the application from scratch. His demo recreated GNOME Calculator in Python from a 936-kilobyte binary of roughly 2,000 functions in 28 minutes, arithmetic correct, UI scaling wrong. His worries are economic: whether every piece of software is now abandonware, whether anonymous clones become a supply-chain risk because their authors have no financial incentive not to ship malware (more: https://www.youtube.com/watch?v=qFEuYUfauNY). OpenBin's BINNY is the defensive cousin: an AGPL Go harness that plugs in any model, including local ones through Ollama or LM Studio, classifies a sample against the STIX 2.1 malware vocabulary, works function by function within a token budget, and drafts a report for a human to review. Its best design choice is epistemic: an existing report "is treated as claims to check, not facts" (more: https://github.com/openbin-ai/binny). At the far end of the skill curve, the calif.io team says it demonstrated one-click compromises of Signal and iMessage at Hexacon in Paris, with release "in due time" and no details yet, so it stays a claim until the write-up appears (more: https://x.com/calif_io/status/2111080240978223545).

Offense Goes Private, Weights Go Closed

A presidential memorandum signed August 12 created the first U.S. program under which vetted private companies may conduct offensive cyber operations, including destruction of data and systems, against foreign cybercrime organizations. Participants must post at least $1 million in escrow, forfeited for rule violations, and every operation needs written approval from Department of Justice and Department of Homeland Security officials. Two categories are authorized: "Cyber Surveillance Operations," covert access to collect intelligence, and "Cyber Effects Operations," disruption or destruction. Guidance is due within 60 days, and a company that unintentionally hits a U.S. person or system must halt and notify the government. In March, the administration's own Thomas Lind had told a conference "we're not interested in fighting pirates with pirates" (more: https://www.tomshardware.com/tech-industry/cyber-security/white-house-authorizes-private-companies-to-hack-foreign-cybercrime-groups).

The targeting rule deserves a second read. A foreign group qualifies unless "clear intelligence exists" that it is institutionally part of a foreign government or wholly under its direction, so ransomware crews operating with state tolerance but not formal control, which describes much of the Russia-based ecosystem, are squarely in scope. Operations likely to cause loss of life or constitute an armed attack cannot be approved by the DOJ and DHS directors, but the memo does not prohibit them; that authority sits in a classified annex. Participants may sign commercial deals with other firms and with state and local agencies to receive threat data and propose operations from it, which creates a market for targeting. The Pentagon contractor pilot in the pending defense bill was a military-chain-of-command design; this is a civilian, law-enforcement-vetted one, and the executive branch arrived before Congress finished.

On the other side of the Pacific, Dmitri Alperovitch predicts that freely available near-frontier Chinese open-weight models "aren't long for this world" and would be surprised if any exist within 18 months, calling Beijing's draft export rules "a big step towards closing the Chinese frontier." The draft as published exempts models already released and keeps a streamlined path for open-sourcing, so the claim is not that existing weights vanish but that future near-frontier releases hit an approval gate whose thresholds are still undefined. Both readings fit the text, and one reply captured the community's revealed preference: "downloading every big chinese checkpoint i can fit on my drives this weekend just in case" (more: https://x.com/DAlperovitch/status/2111099006801600676?s=46). The intelligence side of any hack-back program needs tooling, and Flowsint is an Apache-2.0 attempt at an open OSINT graph platform: a FastAPI and Celery back end over PostgreSQL and Neo4j, typed entities from domains through crypto wallets, and enrichers for DNS, WHOIS, username search, breach lookups, and wallet transactions. It runs locally, binds its databases to loopback, defends against DNS rebinding with a Host-header whitelist, and ships an ETHICS.md aimed at journalists, fraud teams, and law enforcement. The maintainers call it early and under-tested (more: https://github.com/reconurge/flowsint).

Memory and Plumbing for Agent Fleets

Graphicle is a Rust port of Graphify's code-graph engine plus a memory layer Graphify never had, packaged as one binary with one SQLite file. Tree-sitter parses files, functions, classes, calls and imports with no model involved; docs, reviewed decisions, and captured Claude Code and Codex sessions become memories anchored to code symbols that go stale when the underlying function changes. One MCP server exposes Graphify's tool names alongside the memory tools, and agent-proposed memories wait for human approval. The benchmarks are unusually candid for a launch. The engine ran 3.0 to 22.7 times faster than Graphify 0.9.91 across 39 measurements. On Graphify's own 30-question showcase, Graphicle found 99.2 percent of facts versus 94.7 percent for plain Claude Code, which the authors call a tie, and used more tokens doing it. On 100 SWE-bench Verified tasks all three tied and "the agent never called Graphicle's tools." The README states "we do not claim it saves tokens," which puts it at odds with every memory product that does (more: https://github.com/Graphicle-AI/graphicle).

The Show HN framing is accurate: infrastructure that helps on comprehension questions and gets ignored on bug-fixing tasks, with the caveat that "long sessions and memory built up across coding sessions are not tested yet" (more: https://github.com/graphicle-ai/graphicle). The hosted alternative is khive.ai, a managed MCP endpoint offering memory with decay scoring, typed entity graphs, and task tracking per isolated namespace, on a monthly plan with a card-required trial. The pitch is "no Rust toolchain, no database, no deploy pipeline," which is also the pitch for putting an agent's entire accumulated memory on someone else's server behind an API key (more: https://www.khive.ai).

Fleet management is becoming its own category. Lumary Labs' muxin is a Rust desktop app built on GPUI, the UI framework from Zed, that reaches every machine over SSH, drops a small agent for millisecond round trips, and keeps Claude Code, Codex, OpenCode and Gemini CLI sessions alive after the app closes. Roughly 80 MCP tools cover processes, Docker, VMs, runners, and remote desktops including input injection. The security notes are blunt: host workspace commands "aren't sandboxed," sharing the Docker socket is "root-equivalent," and the Windows installer is unsigned (more: https://github.com/LumaryLabsLLC/muxin). Underneath the fleet sits version control, and feder-cr's gitai is an MIT-licensed, independent implementation of the Scion design Anthropic described but kept internal: landing by compare-and-swap instead of a merge queue, a changeset log with per-agent identity, and conflict resolution delegated to any LLM or a deterministic tool. In its benchmark of 50 agents landing 250 changes with 20 percent deliberate conflicts, batched landing took one attempt per change with a p99 under two seconds, against 27 attempts and seven seconds for classic retry loops. It is version 0.2.0, forked from GitLab's Gitaly, with per-agent tokens and an RPC whitelist (more: https://github.com/feder-cr/git-ai).

All of this plumbing runs on API keys, which is why Matt Johansen's post matters even though it is thin: "Confirmed. OpenCode hacked. Keys stolen. Telling customers to revoke." He reports customers receiving breach notices and direct messages from people whose keys are running up charges. No official source appears in the thread, so this is one researcher's account of customer notices rather than a vendor statement. If it holds, the stolen asset is compute, and it gets spent immediately (more: https://x.com/mattjay/status/2111480005435719885?s=46).

Hands, Factories, and Typed Answers

The esp32-iphone-agent project puts a vision model in control of a real iPhone using a $7 ESP32-S3 board, no computer and no jailbreak. The phone screen-mirrors over AirPlay to a hotspot the board hosts; the board forwards the H.264 stream over Bluetooth to a companion iOS app on the same phone; the app sends screenshots to any OpenAI-compatible vision model and runs a planner and actor that emit taps, swipes and keystrokes. Those commands return to the board, which presents to the phone as a standard USB mouse and keyboard, and with AssistiveTouch enabled "a click is a tap and a drag is a swipe." Bluetooth caps mirroring at five frames per second, steps take seconds each, and iOS refuses to mirror passcode entry, Apple Pay or DRM video. The README tells users to keep the stop button within reach (more: https://github.com/onehumanbeing/esp32-iphone-agent). For anyone running account-security controls, the point is that this automation path lives entirely outside the app sandbox and the OS automation APIs. Everything the phone sees is a human hand on a human input device, so handset attestation says nothing about who is driving.

The software-factory debate got its most useful contribution from a practitioner who spent much of the year building one and concludes that "even if we had AGI, the dark factory still wouldn't work," because models keep improving at building software "without getting much better at understanding what we actually want." His replacement keeps the loop, GitHub issue in and pull request out, with parallel laps that merge to staging only on green CI and a manager agent that polls them every couple of hours. What changed is the perimeter: he plans each release of 10 to 20 tickets with the agent, defines holdout test scenarios the builder never sees, and gives feedback on a whole staged batch rather than per PR. A commenter sharpened the holdout idea into a checklist from industrial acceptance testing: store scenarios outside the repository, bind each pass to the commit under test, and plant defects, because "a gate that has never caught a planted bug has not earned its green light." (more: https://lnkd.in/p/gTgzWTKD).

Typed decisions are the other way to constrain an agent, and NeuralNotwerk's shim serves any ordinary LLM through TypeSafe's Jev decision-model API, returning a yes/no, choice, or score with a probability for every option. Its logprobs mode walks the answer under a grammar and multiplies step probabilities, while API back ends without logprobs fall back to one-hot answers that make "calibration meaningless." On the 231 public JevBench decisions, a Qwen3.8 Flash model on four RTX 5090s slightly edged Jev 1.13.0 at similar latency. The scores are the author's estimates, not official, and the project disclaims affiliation (more: https://github.com/NeuralNotwerk/standard_model_for_jev_tasks). At the opposite end of the stack, React Bits now ships 217 animated components as copy-in source under MIT plus Commons Clause, with a "Copy for AI" button, an llms.txt map, and installation through the shadcn MCP server so an agent can find and install components itself. Its own advice remains the most agent-relevant line in the docs: two or three effects per page, because they "compete for attention and for the GPU" (more: https://reactbits.dev/get-started/index).