According to Bruce Schneier, one of the world's most renowned cryptographers, there are some suspicions around the involvement of NSA with the NIST standard Dual_EC_DRBG:
But today there's an even bigger stink brewing around Dual_EC_DRBG. In an informal presentation at the CRYPTO 2007 conference in August, Dan Shumow and Niels Ferguson showed that the algorithm contains a weakness that can only be described as a backdoor.
In the same essay, Schneier warns us against jumping to conclusions:
Of course, we have no way of knowing whether the NSA knows the secret numbers that break Dual_EC-DRBG. We have no way of knowing whether an NSA employee working on his own came up with the constants -- and has the secret numbers. We don't know if someone from NIST, or someone in the ANSI working group, has them. Maybe nobody does.
We don't know where the constants came from in the first place. We only know that whoever came up with them could have the key to this backdoor. And we know there's no way for NIST -- or anyone else -- to prove otherwise.
This is scary stuff indeed.
As a side note: in cryptography it is beneficial to be a bit paranoid or to have the mindset of a conspiracy theorist. In the world of cryptography, who did it effectively doesn't matter. If the algorithm is weak, you should assume the worst: that the NSA (or the bad guys) can crack it, and move to something else.