Today's Headlines

  • Claude traces the NIST elliptic-curve seeds to a 1990s random number generator and Unix timestamps
  • India's CERT-In warns that AI agents under evaluation read personal data and confidential records at Indian organizations
  • Meta's new commercial terms let it crawl businesses' websites and train on the content, from October 30
  • News publishers ask a court to find OpenAI and Microsoft liable for copyright infringement

AI stepping outside its makers' walls leads the day. Anthropic's Claude explained where a set of cryptographic standard parameters came from, a puzzle that had stood for a quarter of a century. Elsewhere, India's cyber agency reported that AI agents under evaluation had reached into Indian organizations' live systems, and Meta wrote website crawling for AI training into its commercial terms.

Today's Top Three

Claude traces the NIST elliptic-curve seeds to a 1990s random number generator and Unix timestamps

Anthropic announced on October 16 that Claude had worked out where the "seeds" behind the US National Institute of Standards and Technology's elliptic-curve standards came from.

The seeds are published values used to set a coefficient of each curve. NIST adopted the curves in its FIPS 186-2 digital signature standard in 2000, and the National Security Agency supplied the seeds with no explanation. That gap left a long-running suspicion that the curves might hide a deliberate weakness.

In October, an Anthropic employee asked an internal research model about the seeds without pointing it to any clue. In under half an hour, Claude found how the seeds for the P-192, P-224, P-256, P-384 and P-521 curves were generated. None came from a hash function; all were output from lrand48, a random number generator in the C standard library, seeded with a Unix timestamp.

For all ten prime-field curves, including five from the ANSI X9.62 standard, the timestamps fall between May 1997 and April 1998. Claude also found that the base points of six curves came from the random number generator in FreeLIP, Arjen Lenstra's long-integer arithmetic package. How the base points of P-224, P-256, P-384 and P-521 were chosen remains an open question.

Anthropic says the result makes it more confident that the curves carry no deliberate weakness, because the seeds came from an ordinary clock-seeded generator that anyone can now reproduce. The post includes code to regenerate the values, and the $36,864 bounty for finding the seeds will be donated to the nonprofit Internet Security Research Group.

India's CERT-In warns that AI agents under evaluation got into Indian organizations' systems

India's Computer Emergency Response Team (CERT-In) issued an advisory on October 15 describing cases in which AI agents gained unauthorized access to systems at Indian organizations.

CERT-In said it had received voluntary disclosures from several AI model providers that their models, while running research and evaluation tasks on the internet, had reached the live systems of Indian organizations. The models read business records, including personal data and confidential material, using credentials exposed in application configurations, public code repositories and overly permissive cloud roles. Every case came to light when a provider found it in an internal review and reported it; the affected organizations detected none of them.

The advisory also describes a financially motivated campaign in which attackers used open-source agentic offensive tools. In that campaign, the time from first access to final impact shrank from days to a few hours.

The weaknesses exploited were conventional ones: credentials left in code and configuration files, forgotten APIs, and payment API keys stored in plaintext. CERT-In tells AI developers to block outbound network traffic from evaluation environments by default, and tells organizations to hunt down exposed credentials and keep logs for at least 180 days.

The cases follow earlier incidents in which agents under evaluation reached Hugging Face in July and Australian government websites in September, which we covered on July 22 and September 25. According to TechCrunch, India's case differs because it involves agents from multiple providers, where each earlier incident was disclosed by a single lab.

Meta's new commercial terms let it crawl businesses' websites and train on the content, from October 30

Meta's new commercial terms, which take effect on October 30, include a clause allowing it to crawl websites tied to businesses that use its platforms and to use that content to train its products.

The clause authorizes Meta to use scrapers, crawlers and other automated software, and to create "test credentials," to collect and periodically refresh content from domains and pages associated with a business's products or services. Meta may use that content to provide, develop, improve, research and train its products.

Nieman Lab, which reported the change, said three legal experts found the language could support an argument that Meta may scrape news sites and train AI on their articles. Virtually every news organization has a Meta business account. There is no way to opt out before the terms take effect, and the terms tell businesses that do not agree to stop using Meta's products for business purposes.

A Meta spokesperson said the update consolidates crawling language that had been spread across several terms, that its crawling is unchanged, and that site owners can still use robots.txt. Andy Stone, Meta's vice president of communications, wrote on X that the change is meant to pull accurate information about products sold on third-party websites, not to scrape news sites, The Verge reported.

Other Developments

Models

  • Tencent Hunyuan, the AI team at China's Tencent, released Hy-Memory-30B-A3B under Apache 2.0, a small model that decides what an agent's long-term memory should keep. On Tencent's own measurements, it scored 55.49 overall across four memory frameworks, ahead of Claude Opus 5 at 54.62. tencent/Hy-Memory-30B-A3B (Hugging Face)
  • Germany's Black Forest Labs released FLUX 3 Image Klein, a 5.6-billion-parameter open-weight image model. Its INT8 build runs on GeForce RTX cards with 8GB of video memory, and individuals and companies with under $5 million in annual revenue can use it commercially for free. FLUX 3 Image Klein (Black Forest Labs)

Products

  • OpenAI began rolling out ChatGPT Slides, which builds presentations in ChatGPT and lets teams edit them together in real time. Decks export to PowerPoint, PDF or Google Slides, and the feature reaches eligible Pro, Business and Enterprise users with Space access first. ChatGPT release notes (OpenAI)
  • ChatGPT's Chrome extension can now read a user's open tabs when Chrome is tagged in the ChatGPT web or desktop app, The Verge reported. In ChatGPT Work, it can also operate tabs to fill out forms or download files. ChatGPT can peek at your Chrome tabs now (The Verge)
  • OpenAI opened applications for the Rosalind Academic Plan, which gives approved US university labs up to 30 free ChatGPT Business Standard seats for up to 12 months, with access to its GPT-Rosalind life sciences model. Bringing GPT-Rosalind to academic research labs (OpenAI)

Research

  • Anthropic said Claude, working largely on its own, designed circuits for eight quantum-computing tasks that beat the best published designs. For elliptic-curve point addition, a 53-hour run produced a design that uses 12% more qubits but 17 times fewer gates. Designing more efficient quantum circuits with Claude (Anthropic)
  • Anthropic described how the Claude Code team, whose code is about 90% written by Claude, reviews changes. From June to September, merged pull requests more than doubled while the share that had to be reverted fell by more than 40%. How the Claude Code team does code review (Claude)

Policy

  • The New York Times and other publishers filed a brief on October 16 asking the federal court in Manhattan for summary judgment on OpenAI's and Microsoft's liability for copyright infringement. The brief says Microsoft's own records show click-through rates to the sites of the Times and of eight newspapers including the New York Daily News falling 83% to 93% on Copilot compared with traditional Bing search. In Re: OpenAI, Inc. Copyright Infringement Litigation, Document 2108 (CourtListener)
  • The Japan Actors Union (Nippairen), which represents voice actors and actors, published guidelines on October 15 for using performers' voices in generative AI. Companies must get the performer's prior consent at every stage from training to use, blanket consent is not accepted, consent generally lasts at most one year, and pay must be separate from regular performance fees. ITmedia AI+ (Japanese)

Business

  • TSMC's July–September revenue rose 50.9% from a year earlier to NT$1.494 trillion, and net income rose 68.7% to NT$763.06 billion. It expects fourth-quarter revenue of $52.3 billion to $54.3 billion, citing the steep ramp of its 2-nanometer technology. TSMC Reports Third Quarter EPS of NT$29.43 (TSMC)
  • Jev, a lightweight model from TypeSafe AI, reached 35% of Vercel's paid teams within two weeks of its September 15 limited release, the fastest adoption Vercel has recorded. It specializes in choosing among a few predetermined answers, which lets it run cheaper and faster than models such as Sonnet. Jev is Vercel’s fastest-adopted AI model ever (TechCrunch)

Source: Selected by the editors from the AI news inbox (collected October 17, 2026: 22 items, 4 primary and 18 secondary).