Is It AI-Day?
In recent weeks AI has demonstrated advances in capabilities related to cryptography (and in mathematics). Q-Day, it turns out, has a sibling: AI-Day. AI-Day has two elements to it. First, AI has clearly demonstrated that it is capable of discovering vulnerabilities in computer systems that are not known to human experts. Second, and relevant to this website, is that AI has demonstrated that it is capable of weakening or breaking cryptographic methods.
Here are some highlights of how AI has advanced:
- Claude Mythos weakened HAWK, a digital signature scheme that was built for the post-quantum world
- Claude Mythos and Sonnet independently found a full 128-bit key-recovery attack on the SpoC cipher
- Claude Mythos recovered a key through a decryption-reaction attack and exposed an error in the scheme’s published security proof
- Claude helped develop a new structural key-recovery attack on McEliece, a long-studied post-quantum scheme, with optimizations expected to significantly lower its estimated cost. A small challenge key was recovered
- Devin and Claude factored two RSA challenge numbers, RSA-260 and RSA-896, culminating in the 896-bit public record
- OpenAI’s GPT-6 Astra decoded an unsolved 1941 Enigma message and an 1809 ciphered letter
Anthropic estimates the HAWK attack, and a separate attack on a reduced-round version of AES (7 of its 10 rounds), cost about $100,000 each. The HAWK attack took about 60 hours. The AES attack took more than a week of model time and several rounds of refinement, plus nearly a month for two researchers to validate it.
Initial responses expressed grave concern, and without judgment I can see how some folks would be alarmed by this progress. Matthew Green opined that “we might lose public key cryptography”:
Matthew Green@matthew_d_greenI think we might lose public key cryptography.
Justin Drake advocated for “bunker mode” and posited that ECDSA might be broken “in months”:
Justin Drake@drakefjustinToday I call upon the blockchain industry to calmly begin planning for "bunker mode". My personal recommendation is to set in motion a controlled mass migration of assets to fresh addresses, i.e. addresses whose pubkeys remain hidden behind a hash.
Holders, starting with large… Show more
Vitalik Buterin was more measured:
vitalik.eth@VitalikButerinI don't recommend anyone scramble to move their funds to new wallets today. But we should take the risks to cryptography from AI-accelerated math seriously, and minimize our exposure to not just quantum-vulnerable cryptography, but also potentially AI-vulnerable cryptography.… Show more
As time has progressed, the picture is becoming clearer: AI is showing us there is progress in capability. The six examples above are a shock to the community, but did not break any cryptography used in cryptocurrency or in state of the art internet systems.
Green followed up on X, advising people to keep using cryptography, but warned that AI is not plateauing in this field:
Matthew Green@matthew_d_greenI’ve had a few people write to ask me to follow up on a (reply!) tweet I wrote that’s gotten a lot of retweets. I considered deleting it just to avoid the headache, but I think that would make people more paranoid. So let me share my thoughts.
Matthew Green@matthew_d_greenThere has been healthy debate in the Ethereum community about how to proceed with the use of lattices or hashes. Eli Ben-Sasson and Vitalik:
Eli Ben-Sasson | Starknet.io@EliBenSassonStrong disagree. Lattices have juicy mathematical structure, ripe for AI to attack. And the succinct versions based on module SIS are too new -- only around since 2012.
I recommend waiting another 3-5 years for AI to kick the tires, before entrusting serious $ with it.
DYOR;
a16z crypto@a16zcryptovitalik.eth@VitalikButerin> we could still ultimately do Lattice stuff for accounts, wallets, etc. through a precompile if it is proved to be AI-secure
The ideal route to support everyone's cryptography is imo through 8288. You make whatever signature you want locally, then STARK it, and then it gets… Show more
The pattern we see here is one we have seen throughout time: A cryptographic method is developed, it weakens and fails. A new one is invented to replace it. It too will weaken and fail, only to be replaced by a new one. The new feature is the periodicity — the time to weaken and break is decreasing as AI capability is increasing.
AI-Day may not have arrived just yet. It seems wise to assume that it will. While I don’t forecast when that will happen, Green posited that there is “a 15% chance we functionally lose confidence in our existing public-key encryption algorithms”:
Matthew Green@matthew_d_greenEveryone is very concerned about being respectable, so I’m going to be the goofball who raises worst-case possibilities. I think there is a 1% chance we live in Minicrypt, and a 15% chance we functionally lose confidence in our existing public-key encryption algorithms.
His estimate is for AI alone; it leaves out Q-Day. Together, AI and quantum are a greater risk than either on its own.
AI + Quantum = Acceleration
As a user of AI for research and coding, I have observed the rapid improvement in its capabilities over the last few years (especially over the last six months). One area that is directly related to Q-Day is how quantum hardware and software developers have been using AI to augment and accelerate their development. Recently, Google published a paper in Science on magic state cultivation, a key step toward fault tolerance. Its arXiv version reports that a reinforcement-learning agent, used to calibrate the processor, improved the logical error rate by about an order of magnitude. Anthropic also published an arXiv paper about how Claude was used to find designs that “improve upon the best published circuits, in some cases by an order of magnitude or more.”
In my discussions with quantum computing skeptics, who range in opinion from “Quantum is a scam” to “Classical methods will continue to improve eating away any advantage” to “Quantum is so far out as to be irrelevant,” I have made the case that while powerful quantum computers that offer advantage over classical computers do not yet exist, there has been nothing but progress towards that milestone: over the last twenty years the industry has gone from researching how to produce qubits, how to create gates, how to build a computer, how to make a computer reliable, and now we are at the stage of how to make a fault-tolerant machine useful. Along the way, the impossible has become possible.
Once the fault-tolerant useful machine has been achieved, which I forecast is 12–18 months away, human use of this new powerful compute architecture will explore how to apply it to problems. This interplay between human and computer will at minimum reveal whether or not quantum is real, so to speak. More likely, human–quantum interplay will generate new understanding of how quantum can be used to solve meaningful problems, and be used in ways that may not have been conceived of before there were powerful quantum machines available.
Factoring AI into the human interplay with quantum computers will change the outcomes. Manufacturers and developers of quantum hardware and software will continue to accelerate the development of quantum computing systems, which reduces timelines meaningfully (as we are seeing today in 2026). What will be new is how customers use AI and quantum computers to solve problems in ways which are novel or beyond what humans may do without AI augmentation. This will result in an expansion of the solution space such that AI will alter our understanding and use of quantum in ways that were not conceivable just one or two years ago.
Of course, you may say, “Show me the proof!” Or, “Great hypothesis but it’s impossible to falsify.” To which I say, “You’re right!” But this is not irrational techno-optimism or quantum hype. AI has consistently proven that it can change our understanding of the limits of our technological world. It is especially adept at blowing through limits in fields which are verifiable (math and computer programming, for instance). Quantum technologies are verifiable (it is math and computer programming, as the Anthropic circuits research shows). I have not arrived at specific scenarios, specific solutions or outcomes for how humans, AI, and quantum interact. It is, however, obvious that timelines are compressing, and capabilities will be broader than what experts forecast or imagined.
As this pertains to cryptography we should anticipate that over the next five years advances in AI and quantum will lead to the speedy arrival of cryptographically relevant systems.
Pay attention and prepare!