In 2026, AI models stopped finding bugs in encryption software and started finding flaws in the mathematics underneath it. A post-quantum candidate that survived two years of expert review fell in about 60 hours. Two RSA factoring records fell sixteen days apart. And on November 6, Google DeepMind said its AI agents found two weaknesses in legacy 1024-bit RSA. Nothing in production has broken, and the strongest keys still hold, but the price of finding a flaw has collapsed, and this ledger adds up every result.
The ledger
Every 2026 result in which an AI model attacked a cryptographic target, in order, with the cost and the status of each one.
| Date | Result | What fell | Cost or time | Status |
|---|---|---|---|---|
| July 20, 2026 | CryptanalysisBench published | Nothing; an independent benchmark for measuring LLM cryptanalysis, from Lukas Fluri and Avital Shafran | Benchmark, not an attack | Live reference |
| July 28, 2026 | Anthropic's Claude Mythos Preview breaks HAWK | HAWK, a NIST post-quantum signature candidate; expected key-recovery cost for HAWK-256 fell from 2 to the power of 64 to 2 to the power of 38 | About 60 hours; about $100,000 in API cost | Withdrawn from the NIST process the next day |
| July 28, 2026 | Mythos improves the attack on seven-round AES | Seven-round AES-128, a reduced version of the cipher; the Mobius Bridge fingerprinting technique made the best-known attack 200 to 800 times faster | Needs 2 to the power of 105 chosen plaintexts, so completely impractical | Full 10-round AES unaffected |
| September 3, 2026 | RSA-260 factored | An 862-bit number from the RSA Factoring Challenge, unbroken since 1991; Cognition's Eric Lu, using Devin | GPU port of CADO-NFS on idle cluster capacity | Benchmark number, not a key in use |
| September 19, 2026 | RSA-896 factored | A 270-digit number, the largest public factored challenge number; Anthropic's Stephen Weis, using Claude | Up to 2,048 GPUs, about 10 days, about 30 GPU-years | Benchmark number, not a key in use |
| October 7, 2026 | Aaronson reports labs test crypto quietly | Nothing public; Scott Aaronson wrote that several AI companies have started pointing their newest internal models at cryptographic primitives, citing sources he trusts | Secondhand claim, no named lab or protocol | Unverified |
| November 6, 2026 | DeepMind finds two RSA-1024 weaknesses | Legacy 1024-bit RSA: signature forgery once an attacker controls about half the signed block, and batch factoring about 30 times cheaper per extra key | 3.5 times less CPU measured on a solved benchmark; 1,600 times theoretical for short fingerprints | Two technical papers published; 2048-bit keys unaffected |
What the numbers mean
The ladder tells it plainly. Finding a flaw in a candidate scheme cost about $100,000 in model time. Breaking one retired 1024-bit key is estimated at about $30 million at market GPU prices, according to Cognition's Eric Lu, who added that further optimization could halve that. Breaking one current 2048-bit key is estimated at about $32 quadrillion at $3.50 per GPU-hour, according to a PostQuantum analysis. ByteHerald's arithmetic, labeled as such: $100,000 to $30 million is 300 times, and $30 million to $32 quadrillion is about 1.07 billion times. RSA-2048 needs about 35 billion times the work of RSA-896 under standard scaling. The price of finding a flaw has collapsed; the price of breaking the current standard has not moved.
That split is why the headlines have been wrong in both directions. The coverage that says "AI broke encryption" is wrong, because no deployed system has fallen. The coverage that says "nothing changed" is also wrong, because a publishable cryptanalytic result now costs about $100,000 and a week of model time, and three independent efforts produced attacks on three cipher families within days of each other in July. What changed is the economics of finding flaws, and economics is what decides how many flaws get found.
How the work was done
The factoring records used no new mathematics. Both teams ported CADO-NFS, the open-source general number field sieve implementation that has been the standard method since the 1990s, from CPUs to GPUs using AI coding agents, then ran it on large fleets. Lu's Devin built and ran the GPU version on idle cluster capacity. Weis's Claude coordinated up to 2,048 GPUs between other jobs for about 10 days. The advance is engineering speed, not a new algorithm, and both researchers said so plainly.
The HAWK and AES results are different: there the model did the mathematics. Mythos worked semi-autonomously in an agentic harness, with occasional human guidance and nontechnical direction, and found a nontrivial automorphism in HAWK's lattice that prior theory said would enable an attack but had not shown was reachable in the lattice HAWK uses. Anthropic's research post gives the full account, including the demonstration code. The key idea came from a pair of worker agents that disagreed: the first rejected the idea as infeasible, the second found a way to exploit it, and the two kept exchanging messages until both agreed they had found an effective attack. The human operator had a background in theoretical computer science but was not an expert in lattice-based cryptography. After the discovery, the vast majority of human researchers' time went to validating the claims. Anthropic disclosed the HAWK attack to the scheme's authors in June and coordinated disclosure through the NIST mailing list. On the same day, an independent attack on HAWK produced with GPT-5.6 was reported by another researcher, Hengyi Luo, through a different geometric route.
DeepMind's November result followed the same pattern with more human direction. The work was led by Dj Dvijotham and Abhradeep Thakurta, with outside cryptographers Nadia Heninger of UC San Diego and Inria and Emmanuel Thome of Inria. The agents worked under human supervision, and the lab published two technical papers so the wider security community can check the work. The measured result is the 3.5-times CPU saving on an already-solved benchmark key. The 1,600-times figure is a theoretical estimate for the case where the attacker controls only a small part of the signed block, and the distinction between measured and theoretical is the difference between a fact and a projection.
What actually broke, and what did not
HAWK was a candidate, not a standard, and it was never deployed. Its withdrawal the day after Anthropic's disclosure is the system working as intended: NIST proposals are shared in public so a broad audience can review them and find flaws before deployment. The seven-round AES result targets seven of ten rounds and needs an impractical quantity of chosen data. Full AES, the cipher that protects most of the world's encrypted traffic, absorbed the finding with room to spare. RSA-896 and RSA-260 are benchmark numbers from a challenge list, not keys protecting anything. RSA-1024 is retired, and DeepMind chose it as a proving ground precisely because it is already obsolete. The open question is how much 1024-bit RSA still lives in email signing, firmware, and appliances, where keys are rarely rotated.
The labs' own frameworks are supposed to catch exactly this capability. The six-lab safety framework comparison we published in October shows each lab promising to test for dangerous capabilities before deployment, and cryptanalysis is the capability to watch: a model that can find flaws in the mathematics of encryption is a model whose testing should be public, dated, and independently reproduced. The same assume-breach posture applies to defenders: the security report card we published in October starts from the premise that every model is compromised, and the right response to a $100,000 flaw-finding machine is to test your own systems before someone else does.
What defenders should do
First, find any legacy 1024-bit keys still in production and retire them; the factoring estimate of about $30 million puts them within reach of any organization with a large GPU fleet, and DeepMind's batch result makes the second key cheaper than the first. Second, treat crypto-agility as the defense, not any single algorithm swap: only about 7 percent of enterprises have deployed quantum-safe protections across most of their certificates, according to a DigiCert survey from July 2026, so the migration has barely started. Third, read the papers, not the headlines: NIST published its first post-quantum standards in 2024, and the schemes that survive review are the ones that were attacked early and in public, as HAWK was. Nothing in this ledger changes what you must do this week, and that is the point: the work is migration and inventory, not panic.
Five questions for any AI crypto claim
Use these five checks the next time a headline says AI broke encryption. We applied the same ledger treatment to OpenAI's claimed science breakthroughs in October, and the method is the same: separate the measured from the theoretical. First, is the target deployed, or a candidate, a benchmark, or a reduced-round research variant? Second, is the headline figure measured or theoretical, and does the article say which? Third, does the result change what anyone must do this week, or is it a research advance with no production impact? Fourth, was it independently reproduced, or is it a single lab's claim? Fifth, what did it cost to produce, and is that cost falling? A claim that passes all five is news. A claim that fails the first is a research paper wearing a headline.
By ByteHerald Staff. Anthropic, July 28, 2026, published "Discovering cryptographic weaknesses with Claude", reporting that Claude Mythos Preview cut HAWK's effective key strength in half in about 60 hours at about $100,000 in API cost, and improved the best attack on seven-round AES by 200 to 800 times. Google DeepMind, November 6, 2026, announced that human-guided AI agents found two weaknesses in legacy 1024-bit RSA, with a 1,600-times theoretical improvement for short-fingerprint forgery and a 30-times cheaper batch factoring method. Stephen Weis of Anthropic published the factorization of RSA-896 on September 19, 2026, sixteen days after Eric Lu of Cognition published the factorization of RSA-260. Scott Aaronson wrote October 7, 2026, that several AI companies have quietly started testing models against cryptographic primitives, citing sources he trusts.
Comments
Post a Comment