NSA

Headlines · 3

1. 3d
   Anthropic says Claude traced NIST ECDSA curve seeds to lrand48 timestamps

   On October 16 Anthropic said its internal research model Claude took under 30 minutes to trace how the "seeds" behind NIST's P-192, P-224, P-256, P-384 and P-521 elliptic curves were generated. Rather than a hashed passphrase as long suspected, the seeds came from the C library pseudorandom generator lrand48, initialized with Unix timestamps from 1997–1998; P-256 corresponds to the 1,842nd candidate value from a run on August 16, 1997. Anthropic said the work does not break ECDSA or yield a new attack method, but it reduces suspicion that the curves were deliberately backdoored and requires no action from users. The company acknowledged unresolved gaps, including the origin of the B-163 seed, how some curve base points were generated, and why certain qualifying candidates were skipped; a $36,864 bounty for finding the seeds is being donated to the Internet Security Research Group.

   Hacker News · AI（100+ 分） · 🔥 20
2. 4d
   Brain drain, not AI, is the bigger cybersecurity threat, experts say

   A Gizmodo piece argues that while most people now offload some cognitive work to AI, cybersecurity is where over-reliance on automation carries the biggest downstream risk: many systems running critical infrastructure have gone decades without updates, and a GAO report found the Defense Department's in-house IT system predates the first Apollo moon landing, with COBOL still widely used on government IBM mainframes. Meanwhile, an Anthropic study of more than 50 mostly junior software engineers found AI-assisted coding led to a statistically significant decrease in mastery, and in a May survey of over 850 cybersecurity professionals, two-thirds said they now spend more time reviewing AI outputs and deciding whether to trust them. The article says that as headline-grabbing models such as Anthropic's Mythos and OpenAI's Astra dominate attention, CISA has shed seasoned staff amid budget cuts and layoffs, leaving a shrinking pipeline of experienced engineers to maintain opaque, aging systems.

   Gizmodo · 🔥 0
3. 6d
   US backs OpenAI fair use but calls Chinese model distillation a threat

   In September 2026 the US government took two opposing positions on AI data use. On Sept 1 the Department of Justice filed a statement of interest in the Southern District of New York backing OpenAI in copyright suits brought by The New York Times and other publishers, arguing that training models on copyrighted text is highly transformative fair use and that requiring licenses would be unacceptable. On Sept 8, the NSA, CISA and FBI issued a joint cybersecurity advisory saying six Chinese firms used APIs to distill US frontier models such as Claude and GPT, extracting billions of tokens, and labeled it malicious, targeted capability theft. The article argues training and distillation are technically kindred: both use existing corpora without individual authorization, both yield new parameters rather than copies, and both may substitute for the original market — differing mainly in whether the material learned from is human work or machine output.

   虎嗅 AI · 🔥 0

Experience and discussion from the community

Share my NSA experienceAsk about NSA