I've adapted a crypto-lib for TLS connections and had a mistake during negotation that truncated some algo-selection value, worked up until the other party started trialling post-quantum algorthims that apparently had algo-id's that collided with the truncated values I was using.

Claude figured out that from the code and trialling TLS handshakes.

Besides, since there was a bounty on finding the curve it seems unlikely that someone would've found out and not shared that? (unless working at a security service that figured out that it was possible to attack?)