Two suspected and one confirmed attempt in linux from a post 6 years ago: https://www.reddit.com/r/linux/comments/54in5s/the_nsa_has_t...
Found this while looking for a more recent one I vaguely remember involving a bad implementation of I think /dev/random