Beyond Good Intentions: Strong Algorithms, Weak Keys And The Assumptions AI Is Exposing

Denis Mandich is the Cofounder of Qrypt, a quantum cybersecurity firm, and founding member of the Quantum Economic Development Consortium.

​AI is revealing what enterprises never verified about the foundations of digital trust.​

A cybersecurity system should not require a verdict on someone’s intentions before it can protect your business. Yet when researchers uncover unexplained choices or extraordinary mistakes, the debate often turns to motive: Was this negligence, or was it deliberate? For executives, a more urgent question comes first: Why could either explanation leave so much at risk?​

Two October disclosures bring that question into focus. One reconstructs the origins of widely used cryptographic parameters, while the other exposes disastrously weak private keys inside the internet’s trust infrastructure. They are different events, but together they challenge the assumption that familiar standards and trusted institutions provide sufficient assurance. New AI tools enable top security teams to trust but verify almost everything in their cybersecurity stack.​

On October 16, Anthropic reconstructed the origins of several NIST elliptic curves, mathematical structures used in cryptography. Their public parameter seeds came from a common but deprecated software generator, lrand48(), initialized with Unix timestamps. Anthropic’s latest model found the origins in under half an hour. A question that had persisted for decades suddenly had a quickly reproducible answer with no cryptanalysis expertise. Although this was not a cryptographic break, it did reveal an AI accelerated cryptanalytic technique anyone can apply. Public curve parameters are not secret keys, and their reproducibility does not make private keys predictable. The discovery also narrowed the scope for some suspected forms of manipulation, but Anthropic went further. It presented the result as grounds to close years of speculation, with no action necessary.​