AI Could End Encryption as We Know It

Over the past few months, AI models have started resolving major mathematical problems, including ones that have withstood decades of human effort. Claude Fable disproved the Jacobian conjecture in three dimensions, and OpenAI announced a list of 10 problems that its Astra model solved or made significant progress on. Even more recently, an unreleased OpenAI model solved the Navier-Stokes Millennium Prize Problem, one of the most famous open problems in mathematics.

These are tremendous accomplishments, but very little about our day-to-day life will actually change as a result. This is because most well-known open mathematical questions are relatively insulated from practical applications. However, there are a few open mathematical problems that do have serious real-world implications. Chief among these is whether public-key encryption is fundamentally secure: that is, whether two strangers can share a secret message over public channels, such as the internet, without eavesdroppers having an efficient way to decipher it.

We rely on public-key encryption every day for end-to-end encrypted messaging apps, virtual private networks (VPNs), and even the HTTPS protocol you’re probably using to read this article. But all of this is based on the unproven assumption that certain mathematical operations are intrinsically easier to do than to undo. In fact, this assumption has already been undermined once: most public-key encryption in use today is vulnerable to an attack that quantum computers could efficiently execute. This has motivated an urgent shift to “post-quantum” cryptography, whose methods may also prove insecure.

As AI models have advanced, they have been making progress in not just pure math, but cryptanalysis as well: Anthropic recently released research showing that Claude Mythos Preview discovered new attacks against two different cryptography algorithms, including a post-quantum technique that was being evaluated by the National Institute of Standards and Technology (NIST).

Breaking a particular algorithm is much easier than proving that every relevant algorithm is breakable. But given the recent impressive progress in both cryptanalysis and mathematics, AI appears to have a real shot at achieving the latter.

The practical implications would be huge, and largely deleterious: it would be the end of end-to-end encryption, and would signal a vast increase in government surveillance powers. Furthermore, results like these are likely to be withheld from the general public, kept as closely guarded secrets by intelligence agencies.

A Brief History of Public-Key Encryption

Public-key (also called asymmetric) cryptography forms the foundation of secure communication on the internet. Whenever you communicate with a website over HTTPS, the website sends you its public key. Using only that public key, you can verify messages signed by the website and establish a shared secret key for encrypting everything else you send, even if the channel is being eavesdropped on. We’ll focus on just the second aspect: how that shared key gets established. We’ll use “public-key encryption” as shorthand for this process.

A major early public-key encryption method relied on the difficulty of prime factorization. Historically, from the ancient Roman Caesar cipher onward, almost all encryption was symmetric: both parties needed to use the same secret key to encrypt and decrypt the message. This changed in 1977, when the computer scientists Ron Rivest, Adi Shamir, and Leonard Adleman introduced the RSA (Rivest-Shamir-Adleman) cryptosystem, the first practical public-key encryption algorithm available to the public. RSA bases its security on the difficulty of prime factorization. It is easy to multiply two prime numbers together but very difficult to find which numbers were multiplied.

‍Quantum computers could efficiently break RSA encryption. The rise of the internet made public-key encryption more useful than ever before. Instead of meeting in private to share a secret, strangers communicating over the internet could use public keys to do so without ever leaving their house. However, in 1994, the computer scientist Peter Shor discovered a method of factoring large numbers on quantum computers efficiently. While a human with standard computers would need trillions of years to crunch through the numbers and break RSA encryption, an attacker with a quantum computer could relatively easily undo the multiplication and discover the secret key.

Researchers are trying to make encryption methods resistant to quantum computers. Even though no viable quantum computer existed in 1994, cryptographers realized that the existence of Shor’s algorithm posed an intolerable threat. The reason is “harvest-now-decrypt-later”: a persistent adversary could collect data encrypted with vulnerable methods today and decrypt it later, once quantum computing technology had advanced. Indeed, intelligence agencies are widely believed to already be collecting encrypted information for this purpose. As a result of this threat, research almost immediately began on “post-quantum cryptography,” cryptographic algorithms based on a challenge that even a powerful quantum computer cannot solve in a practical amount of time.

Developing robust new encryption methods has proven challenging. So far, research into post-quantum public-key encryption algorithms has clustered around a few mathematical constructs that still don’t have efficient quantum solutions. But even within these domains, the field is littered with broken algorithms. For example, significant effort was put into SIKE, a supposedly quantum-resistant technique based on mathematical functions called isogenies. But, in 2022, having initially passed NIST tests, SIKE was shown to be vulnerable to an attack that required only an hour of computation on a standard PC. These issues are not limited to isogeny-based algorithms. The oldest post-quantum encryption scheme, McEliece, is based on mathematical structures called error-correcting codes. It was also moved to the final round of NIST’s evaluation process, due to its long (nearly 50-year) history of surviving cryptanalytic attacks unscathed. But, in August 2026, an attack was published whose preliminary estimates brought the cost of finding the key below the security thresholds NIST set. The authors of the attack acknowledged AI assistance in their proof.

Post-quantum public-key encryption algorithms occupy an uncertain position: the quantum computers they are designed to defend against don’t yet pose a threat, and proposed algorithms often end up being proven insecure.

Cryptomania or Minicrypt?

It may turn out that these seemingly unrelated failures actually reveal a property of our world: that any mathematical structure clean enough to allow strangers to agree on a secret over a public channel is also clean enough for an eavesdropper to decipher.

Strong cryptography needs hard mathematical problems with no efficient algorithms to solve them. The idea that secure mechanisms for establishing keys over a public channel are simply not possible was first raised by complexity theorist Russell Impagliazzo. In his famous 1995 article, “A Personal View of Average-Case Complexity,” he introduces five worlds we might live in, each differentiated by the algorithms it can access: Algorithmica, Heuristica, Pessiland, Minicrypt, and Cryptomania. Which world we live in depends on the resolution to yet-unsolved problems in complexity theory. These worlds represent security gradations: the harder the relevant mathematical problems are to solve, the more room there is for secure cryptography.

In Algorithmica, Heuristica, and Pessiland, encryption is not possible: in general, any kind of mathematical puzzle you can pose as a cryptographic challenge has a corresponding algorithm that allows eavesdroppers to efficiently solve it.

Minicrypt, on the other hand, offers real cryptography. In this world, we gain one-way functions: functions that are easy to compute but, given the output, hard to reverse. This gives us symmetric encryption, cryptographic hashes, and digital signatures. But here, it’s still impossible to establish a secret in public, since the same key used to encrypt the message can also be used to decrypt it.

In the world of Cryptomania, this changes because, unlike in Minicrypt, public-key encryption exists. Cryptomania represents the most secure world of all, where relevant mathematical problems are hard to solve and most forms of cryptography are possible.

There could be as-yet undiscovered algorithms for breaking encryption methods. Right now, our real world appears to resemble Cryptomania, because we have mathematical structures with no known algorithms that can efficiently solve them. This permits public-key encryption. However, the security we think we have could easily be illusory. There is no fundamental reason why we couldn’t discover an algorithm tomorrow that could solve the mathematical problems we use for encryption today, instantly breaking every encryption scheme built on them.

Public-key encryption is more vulnerable to new algorithms than symmetric encryption. There is a broad consensus among cryptographers and complexity theorists that we likely don’t live in the first three worlds, where modern cryptography is impossible. The confidence that we have at least some cryptography (putting us in either Minicrypt or Cryptomania) comes from how easily mathematicians have been able to find functions that appear hard to undo. In general, any function that scrambles its inputs thoroughly—and there are many ways to do so—appears to be much harder to run backward than forward. Since one-way functions are so diverse, it would be very surprising if every single one of them could be undone by some trick. Unfortunately, the same does not apply to public-key encryption, where only a few highly structured computational operations satisfy the properties needed. Some of these operations, as we saw earlier with prime factorization, have already fallen. The cryptographer Bruce Schneier notes this distinction:

Just as it is possible for a smart cryptographer to find a new trick that makes it easier to break a particular algorithm, we might imagine aliens with sufficient mathematical theory to break all encryption algorithms. ... Public-key cryptography is all number theory, and potentially vulnerable to more mathematically inclined aliens. Symmetric cryptography is so much nonlinear muddle, so easy to make more complex, and so easy to increase key length, that this future is unimaginable.

AI and Cryptanalysis

Might these “aliens with sufficient mathematical theory” already be on the way? As AI continues to resolve long-open mathematical conjectures, I believe we shouldn’t discount this possibility.

AI may succeed at cryptanalysis for the same reason it has succeeded at programming and math. Skeptics might say that mathematical problems used for encryption have withstood decades of scrutiny by people who are extremely motivated to find holes, and that AI is therefore likely to find them intractable too. In response, I would first argue that AI might excel in cryptanalysis for the same reason it has excelled in math and coding: solutions are easy to verify. Either the model’s attack successfully recovers the key, or it doesn’t. This means there is a clear signal of success or failure—exactly what is needed for the reinforcement learning (RL) algorithms already deployed by the AI labs to train better AI mathematicians and coders. In other words, the training techniques that have been effective at improving other AI capabilities will extend naturally to cryptanalysis.

AI models’ capabilities can be improved through incrementally harder problems. Additionally, labs can develop “weakened” cryptographic algorithms that are at an appropriate level of difficulty to train the next generation of models against. For example, one of the two encryption methods that Claude Mythos Preview successfully attacked was a simplified version of the ubiquitous Advanced Encryption Standard (AES). Each generation of models can then be given slightly harder problems, to produce even better AI cryptanalysts.

AI models could dramatically expand the effective labor dedicated to cryptanalysis. Also, even though the mathematical structures underlying post-quantum cryptography algorithms have withstood significant scrutiny, AI models may bring a much higher level of scrutiny than ever before. The Cryptology ePrint Archive (the main venue for sharing cryptography and cryptanalysis research) received around 2,300 submissions in 2025, suggesting a community of only a few thousand active researchers. But for any given subfield of post-quantum cryptography, only a fraction of those researchers will be working on it, maybe just a few hundred. While AI tools may not be as smart as the top researchers in the field, AI models are far more willing to do schlep work, grinding their way through every single possible lead. They can bring to bear many more collective person-hours than the research community would spend.

When an encryption method breaks, it takes time to implement a new one. Public-key encryption could become unusable in practice even without proof that it is fundamentally impossible. Most attacks on cryptography algorithms don’t come from fundamental breakthroughs but rather from flaws specific to the algorithm being analyzed. While it might seem easy to swap out a bad algorithm for one that has not yet been broken, it has historically taken a long time (10 to 20 years, according to NIST) for new algorithms to be integrated. Vulnerable algorithms would remain the de facto ones in use during that time. So, if algorithm-specific attacks become frequent enough, we may end up in effectively the same situation as if public-key encryption were altogether impossible.

Living in Minicrypt

Even in Minicrypt, many of our cryptographic tools would survive, including symmetric encryption, cryptographic hashes, and digital signatures. This means we could still sign code, securely update software, and even use cryptocurrencies. Most of our software would work the same way as it does today. However, end-to-end encryption between strangers would be dead.

Secure messaging apps would require correspondents to establish their keys in person. One consequence is that secure messaging apps like Signal and WhatsApp would lose their mathematically founded guarantee of privacy that does not require users to trust the messaging provider itself. Today, secure messaging apps require public-key encryption in order to establish a shared key for the conversation. When you message someone by username on Signal, the first step in that conversation is building a secure shared key from both your and your correspondent’s public keys. This doesn’t require you to trust Signal, the company, at all. But, in Minicrypt, that would become impossible. In order to establish a secure conversation, you would already need to have a secure channel to start with. For messaging, this might require establishing connections only in person (perhaps by one person scanning a QR code on the other’s phone). However, it would be impossible for you to securely message someone else by just a username or a phone number, independent of the app developer’s integrity. Lacking such assurance would greatly reduce the privacy value of these apps.

Online, a trusted intermediary service would be needed for secure information exchange. Messaging apps might be able to survive the requirement to verify initial contact in person, but the open web could not. By using an intermediary, instead of needing to open a trusted channel with every single website, you’d need to open only one: with the intermediary itself. When you wanted to visit a website, the intermediary would send both you and the website a key to encrypt the traffic. Browsers might be able to implement this protocol without it looking too different for users. The lock in the corner of the URL bar would still exist, and the protocol might even still be called “https.”

An intermediary might need to distribute keys in physical form, similar to SIM cards. The most visible consequence of this change would be how you get online. In addition to signing up with your cellular service provider or internet service provider, you’d also need to sign up with the trusted intermediary. Making that first channel secure is still hard, and, in practice, it would likely require physical distribution. SIM cards already essentially work like this. The card exists only to hold a pre-shared secret with a mobile carrier, which allows you to use its network.

The intermediary could decrypt messages, and the government might ask them to. While Minicrypt would require our communications systems to change, the political consequences are more important than the technical ones. First, in this world, all secure communication stems from the account you have with the trusted intermediary, making it a natural chokepoint for know-your-customer systems, deplatforming, and age verification. Second, the trusted intermediary could snoop on all of your encrypted communications, and even spoof encrypted messages from you.

In the 1990s, the US government proposed the Clipper chip, an encryption chip for telephones whose secret key was held by the government. With a court order, law enforcement could decrypt everything the chip had ever encrypted. However, the chip was not widely adopted, and the proliferation of open-source public-key encryption methods meant there were alternative encryption methods that would not allow government surveillance. The collapse of public-key encryption would mean that the intermediary could decrypt messages, and the government could ask them to do so, effectively bringing the Clipper chip back.

If public-key encryption is broken, the government might keep it secret. All of the adaptations described above would only happen if society is informed that public-key encryption has been broken and is able to develop a new architecture. But, historically, when various intelligence agencies have discovered that a particular encryption algorithm is broken, they have tended to keep that information to themselves. Secrets like these are some of the most closely guarded pieces of information the government possesses. If one of the frontier AI labs does end up discovering that public-key encryption is broken, it may be sworn to secrecy, and the public may never know.

Takeaways and Mitigations

It may be worth building alternative systems now. The best mitigation is probably to build Minicrypt-ready infrastructure now, before we need it. This would involve standardizing a protocol for key distribution, building support into browsers and operating systems, and deciding how the trusted intermediaries would be governed. By setting up this infrastructure early, we can incorporate better privacy-preserving protections than those we could expect from a rushed rollout. If all goes well, and we do in fact live in Cryptomania, then we’ll never need to use the infrastructure. However, if we gain information that implies our future is Minicrypt—such as AI models discovering efficient algorithms for problems we previously assumed were hard—then the infrastructure would be ready for us to swap over.

Having multiple intermediaries in different countries mitigates government overreach. Chief among the privacy-preserving protections is designing the system so that the role of trusted intermediary is split among different authorities. Using secret-sharing techniques that don’t rely on public-key encryption, you could design a system that requires, say, three out of five providers to cooperate in order to construct a session key. Then a single corrupt, hacked, or subpoenaed provider would have no way to decrypt your communications alone. This can help to avoid concentration of power in government; if the providers are in different jurisdictions, then no court order from any one government can force all of them to comply with a request to decrypt messages. This is still weaker than today’s end-to-end encryption, where we don’t have to trust any provider. Nonetheless, it’s a meaningful protection against a single government’s overreach.

The situation we’re currently in is somewhat analogous to the one cryptographers faced after the discovery of Shor’s algorithm in 1994. At the time it was invented, quantum computers didn’t exist. Yet researchers recognized that it might only be a matter of time before they did. As AI-assisted mathematics continues to grow stronger, we’re faced with a similar challenge: designing cryptographic protocols that are secure against an adversary potentially far more mathematically capable than ourselves. Just as researchers began to respond to the risks of quantum decryption as soon as they were understood in principle, so too should we start to address the cryptography risks of superhuman AI mathematicians before they emerge.