As of late October 2026, AI has demonstrated potent cryptanalytic capabilities but has not yet broken a deployed standard. Recent breakthroughs include cutting key recovery on the undeployed HAWK-256 from 2^64 to 2^38 and accelerating a 7-round AES attack by up to 800x Discovering cryptographic weaknesses with Claude Discovering cryptographic weaknesses with Claude Discovering cryptographic weaknesses with Claude. High-profile algorithmic milestones, such as the unrefereed AI-generated ETH refutations, highlight the rapid advancement in theoretical computer science, yet these specific results remain practically irrelevant to concrete cryptography Anthropic Says Claude Too Independently Disproved ... Working with academic communities to build scientific ... OpenAI says its AI model has disproved the Exponential .... Nevertheless, the pace of discovery is extreme: computing costs at fixed capabilities are plummeting, and publishable cryptanalysis now requires only roughly a week of model time and $100k AI Broke a NIST Candidate. Not Your Encryption.

The most critical factor driving near-to-medium term probability is that the threshold for a qualifying event explicitly includes completely impractical, theoretical attacks. For full AES-128, the bar is exceptionally low: human researchers already have biclique attacks costing roughly 2^125.64 to 2^126.1 Revisiting the Biclique Attack on the AES Biclique Cryptanalysis of the Full AES Improving the Biclique Cryptanalysis of AES - Springer Nature. Any genuine AI-originated algorithmic improvement that nudges this cost lower would qualify. Similarly, ML-KEM-512 operates on remarkably thin margins; CRYPTREC estimates place it around 146 bits against a Category 1 threshold near 143 bits CRYPTREC: ML-KEM Evaluation Report FAQ on Kyber512. A modest AI-discovered improvement in lattice sieving or a refinement in number-field-sieve cost estimates for RSA-2048 could technically breach this line, supporting expert views that public-key cryptography is highly exposed Some thoughts about Anthropic's new cryptanalysis results.

Despite these vulnerabilities, scaling from reduced-round ciphers to full, hardened standards is notoriously difficult. For instance, SHA-256 collision research currently reaches only 38 of 64 rounds Pushing Collision Attacks on SHA-2 to 39 Steps, and recent dual-attack analyses affirm the security of ML-KEM and ML-DSA Further Elaborations on the Provable Dual Attack Further Elaborations on the Provable Dual Attack. Furthermore, any qualifying attack must be accepted by the cryptographic community as correct. Marginal theoretical gains are highly prone to expert dispute over whether they represent a novel algorithm or merely a faster known attack The “Claude Broke AES” Claim: A Forensic Analysis of AI- .... Additionally, extensive human validation—which recently took hundreds of hours for reduced-round AES—and responsible disclosure protocols will likely delay public release even after an attack is found Discovering cryptographic weaknesses with Claude. Relative to related AI-discovery questions, the robustness of deployed standards and the high bar of cryptographic consensus warrant a somewhat later timeline: finding a promising result is not enough to establish a qualifying attack.

Balancing the accelerating pace of algorithmic discovery against the friction of cryptographic consensus yields a median of October 15, 2028. The 10th percentile of May 15, 2027, and 25th percentile of November 15, 2027, account for the possibility that massive parallel campaigns quickly locate a fractional-bit improvement on AES-128 or ML-KEM-512 that experts swiftly verify. Conversely, the 75th percentile of November 1, 2030, and 90th percentile of January 15, 2034, reflect the risk that our current standards are exceptionally near-optimal, that apparent AI breakthroughs fail rigorous peer scrutiny, or that labs withhold genuine vulnerabilities for extended periods out of security concerns.