AI · cryptanalysis
A-Day
Q-Day is the day a quantum computer breaks the public-key cryptography in use. A-Day is the day an AI system does it first, by finding the mathematics that people have not. This page records who has predicted it, and what AI systems have actually produced against the problems that deployed cryptography rests on. Each row carries the document it comes from. Last verified 28 Oct 2026.
The prediction
Who has said that AI will, or will not, break the cryptography in use, in their own words. Each row links the document the words come from.
| Date | Who | Position | Statement | Source |
|---|---|---|---|---|
| 28 Jul 2026 | Anthropic Frontier Red Team, on its HAWK and AES results | Expects it | Dormant weaknesses in deployed ciphers will soon be within reach of language models | Discovering cryptographic weaknesses with Claude Mythos Preview Many ciphers protecting modern systems have received less scrutiny than they deserve—they might still have important weaknesses lying dormant that LLMs will soon be able to discover. |
| 28 Jul 2026 | Bruce Schneier Harvard Kennedy School | Open question | Early results, something to watch | Measuring LLMs' ability to perform cryptanalysis Still early results, but this is definitely something to watch. |
| 23 Sep 2026 | Jacob Alperin-Sheriff on the SNOVA attack, pqc-forum | Doubts it | The SNOVA flaw would have been found without AI | Round 3 OFFICIAL COMMENT: SNOVA, pqc-forum I am certain you'd have found it in a few weeks even in the dinosaur pre-AI age |
| 7 Oct 2026 | Justin Drake Ethereum Foundation | Expects it | ECDSA may break before Q-Day, in months rather than years Proposes hash-based cryptography and no structured assumptions, from curves, lattices or isogenies. | Post on X IMO it is now reasonable to brace for the possibility that ECDSA breaks before qday, in the worst case in months not years. |
| 7 Oct 2026 | Haseeb Qureshi Dragonfly | Expects it | The risk is conventional mathematics overturning hardness assumptions, not quantum | Post on X The risk is not quantum, but just conventional mathematics overturning unproven cryptographic hardness assumptions. |
| 7 Oct 2026 | Vitalik Buterin Ethereum | Open question | Lattices are the core new area of risk; no need to move funds today Suggests multiplying key sizes by ten for anything meant to stay secure long term. | Post on X The core new area of risk from this viewpoint is, unfortunately, ML-DSA / FHE / lattices. |
| 9 Oct 2026 | Matthew Green Johns Hopkins University | Open question | A 15% chance of losing confidence in public-key encryption The next post in the thread: the numbers are based on vibes, but nobody has better ones. | Post on Bluesky I think there is a 1% chance we live in Minicrypt, and a 15% chance we functionally lose confidence in our existing public-key encryption algorithms. |
Where it stands
The problems deployed cryptography rests on, with how many watched results touch each and the strongest effect any of them has had on a deployed scheme. A result that proves a theorem in the surrounding mathematics counts as a result; it does not count as an effect.
| Problem | Results | Latest | Effect on deployed cryptography |
|---|---|---|---|
| Lattice problems (ML-KEM, ML-DSA) | 6 | 29 Sep 2026 | None |
| Decoding problems (HQC, McEliece) | 2 | 29 Sep 2026 | None |
| Multivariate systems (UOV, SNOVA) | 3 | 29 Sep 2026 | None |
| Hash functions (SHA-2, SHA-3, SLH-DSA) | 3 | 29 Sep 2026 | None |
| Block ciphers (AES) | 3 | 28 Jul 2026 | None |
| Implementations and side channels | 2 | 7 Apr 2026 | None |
| No cryptographic problem | 6 | 25 Oct 2026 | None |
Results watched
AI-produced or AI-assisted results that touch a cryptanalytic problem or the mathematics under a cryptosystem, newest first. Status is the result's standing with its field. Effect is what it changes for a scheme in use today.
| Date | Lab | System | Result | Touches | Status | Effect | Source |
|---|---|---|---|---|---|---|---|
| 25 Oct 2026 | OpenAI United States | Unnamed internal model | Subexponential algorithm for counting 3-SAT solutions, refuting the Exponential Time Hypothesis Lean proves a slightly weaker bound. A working group led by Impagliazzo, Paturi and Williams is examining the proof. Subexponential is not polynomial, and no scheme rests on 3-SAT. | No cryptographic problem | Claimed | None | openai/math history The case of 3-SAT refutes the Exponential Time Hypothesis. An independent working group of computer scientists led by Russell Impagliazzo, Ramamohan Paturi, and Ryan Williams will examine and explain the proof. |
| 6 Oct 2026 | OpenAI United States | Unnamed internal model | Catalogue of manuscripts answering stated open problems, 721 in 373 families by 26 October No family attacks a deployed scheme. Three manuscripts were withdrawn over a sign error on 7 October. Mathematicians dispute several results. | No cryptographic problem | Disputed | None | openai/math README best understood as a form of raw research data, rather than polished academic papers |
| 29 Sep 2026 | Markku-Juhani Saarinen | Agent workflow, model not named | 110 of the 191 findings against China's NGCC first-round candidates in the competition's first week The candidates are fresh submissions, many with implementation faults. The paper calls the HAWK result the field's Lee Sedol moment. | Lattice problems Decoding problems Multivariate systems Hash functions | Claimed | None | Chinese NGCC Algorithms: The First Week of AI Cryptanalysis, IACR ePrint 2026/2266 Our independent evaluation effort discovered, verified, and disclosed 110 of those issues (47 Critical) using the agentic workflow described in this work; outside researchers, some AI-assisted, found the rest. |
| 22 Sep 2026 | IBM Research Zurich Switzerland | gpt-5.6-sol (OpenAI), then Beullens and Hess | Key recovery for six alternative SNOVA parameter sets from biased vinegar sampling The SNOVA team says no recommended Round 3 set is affected and corrected the sampling in version 3.1. | Multivariate systems | Confirmed | None | Round 3 OFFICIAL COMMENT: SNOVA, pqc-forum The first version of this attack was found independently by an AI system (gpt-5.6-sol). |
| 22 Aug 2026 | Markku-Juhani Saarinen | A large language model, not named | HOVER key recovery solves five TII McEliece challenges, including TII-252 BSI's note of 29 September 2026 advising against new Classic McEliece deployments cites HOVER among ten works and does not mention AI. | Decoding problems | Peer reviewed | None | HOVER: Higher-Order Vanishing Endomorphism Recovery, IACR ePrint 2026/1778 our analysis does not indicate that HOVER would threaten Classic McEliece parameters in its present form. Lastly, we note that HOVER's main cryptanalytic shortcut was discovered with a large language model |
| 22 Aug 2026 | Olejnik and Naskręcki | Agent workflow, model not named | Eight published academic constructions fail at their stated parameters A Ring-LWR commitment, a lattice e-voting protocol and a signature hash among them. None is a standard. | Lattice problems Multivariate systems Hash functions | Claimed | None | AI Grinding for Fun and Cryptanalysis, arXiv 2608.21986 Eight published constructions fail at stated parameters or claims. A Ring-LWR commitment opens to every message with probability one. |
| 29 Jul 2026 | Hengyi Luo | GPT-5.6 (OpenAI) with Codex | A second, weaker HAWK attack through SVP in dimension 3n/4 | Lattice problems | Claimed | None | HAWK-n key recovery thread, pqc-forum a related piece of work produced by GPT-5.6 with only minimal technical guidance from human researchers, which attacks HAWK by solving SVP with dimension (3n/4) |
| 28 Jul 2026 | Anthropic United States | Claude Mythos Preview | HAWK key recovery with half the effective key size; HAWK withdrawn from NIST's process The HAWK team confirmed the attack and withdrew the scheme on 29 July 2026. The post says the attack is specific to HAWK and no production software has to change. | Lattice problems | Confirmed | None | Discovering cryptographic weaknesses with Claude Mythos Preview Despite HAWK having survived two rounds of expert human review over a period of two years, Mythos was able to improve the best-known attack on it in just 60 hours of work—effectively cutting its key strength in half. |
| 28 Jul 2026 | Anthropic United States | Claude Mythos Preview | Meet-in-the-middle attack on 7-round AES-128 sped up 200 to 800 times AES-128 has ten rounds. Matthew Green: a small increment in our knowledge, not a practical new attack. | Block ciphers | Claimed | None | Discovering cryptographic weaknesses with Claude Mythos Preview To be clear, neither of these results has a practical impact on today's computer systems; no production software will have to change as a result. |
| 20 Jul 2026 | ETH Zurich, Tel Aviv University, TU Berlin, Anthropic | Claude Opus 4.8, Sonnet 5 and Mythos 5, GPT 5.5, GLM 5.2 | CryptanalysisBench: models break 65 to 86% of known-broken schemes across 191 tasks New findings include a key recovery on the SpoC AEAD and an error in KINDI's CCA proof. GLM 5.2 from Zhipu is the one Chinese model tested. | Block ciphers Hash functions Lattice problems | Claimed | None | CryptanalysisBench: Can LLMs do Cryptanalysis?, arXiv 2607.18538 In this paper we ask whether LLMs can do cryptanalysis, and find that the answer is increasingly yes. |
| Jul 2026 | Anthropic United States | Claude Fable 5 | Counterexample to the Jacobian conjecture Mathematics with no cryptographic bearing, listed as a capability marker. | No cryptographic problem | Claimed | None | Discovering cryptographic weaknesses with Claude Mythos Preview earlier this month we announced that Claude Fable 5 resolved the Jacobian Conjecture |
| 20 May 2026 | OpenAI United States | Unnamed internal model | Erdős unit distance conjecture disproved Mathematics with no cryptographic bearing, listed as a capability marker. The page returns 403 to automated clients and was read in a browser. | No cryptographic problem | Confirmed | None | Model disproves discrete geometry conjecture An internal OpenAI model has disproved this longstanding conjecture, providing an infinite family of examples that yield a polynomial improvement. The proof has been checked by a group of external mathematicians. |
| 7 Apr 2026 | Anthropic United States | Claude Mythos Preview | Thousands of high-severity software vulnerabilities, including a 27-year-old OpenBSD bug Vulnerability finding in code, not cryptanalysis. Two library bugs are credited to Claude, CVE-2026-5194 in wolfSSL ECDSA verification and CVE-2026-45445 in OpenSSL AES-OCB. | Implementations and side channels | Claimed | None | Project Glasswing Mythos Preview found a 27-year-old vulnerability in OpenBSD |
| 27 Nov 2025 | DeepSeek China | DeepSeekMath-V2 | Gold-level scores on IMO 2025 and CMO 2024, 118 of 120 on Putnam 2024 Mathematics with no cryptographic bearing, listed as a capability marker. No Chinese lab or university has claimed an AI cryptanalysis result. | No cryptographic problem | Claimed | None | DeepSeekMath-V2: Towards Self-Verifiable Mathematical Reasoning, arXiv 2511.22570 achieving gold-level scores on IMO 2025 and CMO 2024 and a near-perfect 118/120 on Putnam 2024 with scaled test-time compute |
| 14 May 2025 | Google DeepMind United Kingdom | AlphaEvolve, on Gemini | 4x4 complex matrix multiplication in 48 scalar multiplications; better solutions to a fifth of 50 open problems Mathematics with no cryptographic bearing, listed as a capability marker. | No cryptographic problem | Claimed | None | AlphaEvolve: A Gemini-powered coding agent for designing advanced algorithms AlphaEvolve's procedure found an algorithm to multiply 4x4 complex-valued matrices using 48 scalar multiplications |
| 1 Aug 2024 | Meta AI United States | SALSA transformers with lattice reduction | Sparse secrets recovered at Kyber-like parameters Secrets of Hamming weight 9 to 11 only. ML-KEM's secrets are dense, so the standard is not affected. | Lattice problems | Peer reviewed | None | Benchmarking Attacks on Learning with Errors, arXiv 2408.00882, IEEE S&P 2025 we recover hamming weight 9-11 binomial secrets for KYBER (κ=2) parameters in 28-36 hours with SALSA and Cool&Cruel |
| Dec 2022 | KTH Royal Institute of Technology Sweden | Deep learning on power traces | Message recovery from fifth-order masked Kyber on a Cortex-M4 An attack on one implementation's power leakage, not on the algorithm. Press reports at the time said AI had cracked Kyber. | Implementations and side channels | Claimed | None | Breaking a Fifth-Order Masked Implementation of CRYSTALS-Kyber by Copy-Paste, IACR ePrint 2022/1713 recover a message bit with the probability above 99% |
| Jan 2019 | Aron Gohr | Deep residual networks | Neural distinguishers cut 11-round Speck32/64 to about 38 bits of security Benamira, Gerault, Peyrin and Tan matched the distinguisher without a neural network at EUROCRYPT 2021. | Block ciphers | Peer reviewed | None | Improving Attacks on Round-Reduced Speck32/64 using Deep Learning, IACR ePrint 2019/037, CRYPTO 2019 we show that contrary to conventional wisdom, machine learning can produce very powerful cryptographic distinguishers |
Method and limits
- Statements
- Quoted from the document named in the row, at the length needed to carry the claim. A position is this site's reading of the quote.
- Results
- A result is listed when a lab, a paper or a repository claims that an AI system produced or materially assisted it, and the result concerns a cryptanalytic problem, the mathematics under a cryptosystem, or an attack on an implementation. Results produced by quantum hardware without an AI component are not listed. The OpenAI math catalogue has its own page with every family classified.
- Status
- Claimed: published by the lab or as a preprint. Confirmed: reproduced by the scheme's designers or by an independent party. Peer reviewed: accepted by a journal or conference. Disputed: a named party has published a challenge. Withdrawn: retracted by its authors.
- Effect
- What the result changes for a scheme in use today, at the parameters standards name. None is the usual answer and is recorded as such.