For years the plan was simple: migrate off RSA and elliptic curves before a quantum computer arrives, and onto the post-quantum standards that will survive it. That plan now has a problem at both ends. AI is finding weaknesses in cryptography faster than people can, and the schemes you are migrating to are not exempt.
In July, a post-quantum signature candidate that had passed two years of expert review was broken by an AI model in sixty hours and withdrawn the next day. Nothing deployed has fallen yet. But the question for a security leader is no longer which algorithm to move to. It is how fast you can move again when the next result lands.
What cryptography actually rests on
Almost everything you trust online depends on cryptography: the padlock in the browser, the signature on a software update, the authentication behind a payment. And cryptography depends on a handful of math problems that are easy in one direction and believed to be practically impossible in the other. Multiplying two large primes is trivial. Recovering them from the product is not.
Nobody has ever proved these problems are hard. What we have is history: for decades, the best mathematicians in the world have tried and failed. That is a strong argument. It is also the only one.
The quantum threat
Since 1994 we have known exactly how a quantum computer would break these problems. Shor's algorithm makes factoring and the elliptic-curve problem tractable, while leaving symmetric encryption and hash functions largely intact. We know roughly how large such a machine needs to be, the estimates keep shrinking, and hardware progress is visible in public. The National Institute of Standards and Technology (NIST) published the first post-quantum standards in 2024, and governments have set migration deadlines between 2030 and 2035.
Yet many security leaders have not started, and the reason is respectable: skepticism. Serious people argue that such a machine is a decade or more away, and some say it may never arrive. Because the threat has a known shape, waiting feels rational. You can watch the qubit counts and move when the signal is clear.
That logic carries a hidden assumption: that the only thing coming for the hard problems is a machine that does not exist yet.
AI did not wait
This summer that assumption broke.
HAWK was a third-round candidate in NIST's competition for additional post-quantum signature schemes, a few steps from becoming a standard you might have deployed. A researcher at Anthropic set the company's frontier model on it. In about 60 hours it found a hidden symmetry in HAWK's lattice and turned it into an attack that halves the scheme's effective security. The authors confirmed the result and withdrew the scheme within a day. The cost was roughly 100,000 dollars of model time, and that price falls every quarter. A second lab's model found an independent attack on HAWK the same week.
One result from September concerns keys you run today. AI coding agents ported the classical factoring algorithm to GPUs and set two RSA (Rivest-Shamir-Adleman) factoring records sixteen days apart, RSA-260 and then RSA-896. No new mathematics, only speed. But that speed puts 1024-bit RSA within reach of any organization with a large GPU fleet, and 1024-bit keys still live in email signing, firmware and appliances.
What is happening out of sight
To be clear: no deployed standard has been broken by AI. HAWK was a candidate, and the factoring records used an algorithm from the 1990s.
The real signal is elsewhere. Scott Aaronson, a theoretical computer scientist not given to hype, wrote in October that according to sources he trusts, several AI companies have quietly started pointing their newest internal models at cryptographic primitives and are keeping the results to themselves. That is second-hand, and I treat it as such. But consider what prompted it: OpenAI had just published roughly 720 AI-generated math manuscripts, which Aaronson called one of the biggest days in the history of mathematics, and cryptography was conspicuously absent from the list. Nobody was making this claim a year ago. Now it is the obvious question.
Both ends of the migration
The post-quantum migration rests on a ranking: move off RSA and elliptic curves, and onto lattices and hashes. In October, two of the most prominent figures in Ethereum questioned both ends of that ranking, hours apart.
Justin Drake, a researcher at the Ethereum Foundation, called on the industry to prepare for "bunker mode" and move funds out of reach, because AI-driven mathematics could break elliptic-curve signatures before a quantum computer does, in the worst case within months. Coinbase's head of cryptography called that unfounded, since there is no evidence that decades-old hardness assumptions have weakened. True, but the absence of evidence is all we ever had.
Vitalik Buterin took the other end. Everyone assumed curves were the problem and lattices were safe, he wrote, but there is a good chance lattice-based schemes, the heart of the new standards, take serious hits from the next two years of AI mathematics.
The experts disagree on the odds. They agree that the comfortable picture, in which you know what to leave and what to move to, no longer holds.
From migration to agility
The skeptic's case against quantum was that the machine may never come. That case does not apply to AI: the models exist, their results survive expert review, and each one gets cheaper.
For years the target was a migration: a project with a destination called post-quantum cryptography. If the destination is uncertain, the target becomes the ability to move again. NIST calls this crypto agility and published its guidance this year. For a security leader it comes down to two things. Know what you have, down to which hard problem each algorithm rests on, so you can answer "what depends on this?" in hours rather than months. And be able to change it, including where cryptography is hard-coded, embedded in a device or buried in a vendor product, which is where most organizations are blind.
The question is no longer whether machines can do cryptanalysis. They can. The question is who finds the next weakness first, and how fast you can respond when it is announced on a Tuesday morning.
The QIZ Cryptography Posture Management Platform
QIZ Security gives security teams a continuous, current picture of the cryptography their estate depends on: which algorithms and keys are in use, where they live, which hard problem each one rests on, and where they cannot be changed. That picture is what turns crypto agility from a policy into something you can act on the day a result lands.
We built it because, after years of advising organizations on this migration, I watched most of them stall at the first step: not choosing new algorithms, but finding out what cryptography they actually run. The inventory was always a spreadsheet, always out of date, and always missing the systems that mattered most.
About the Author: Itan Barmes is the Co-Founder and Chief Strategy Officer of QIZ Security. Before QIZ he led Deloitte's global quantum cyber readiness team for six years, advising banks, telecom operators and healthcare organizations on post-quantum migration, and served as a Quantum Security project fellow at the World Economic Forum. He holds a PhD in experimental physics from Vrije Universiteit Amsterdam.
Sources
- NIST, "NIST Releases First 3 Finalized Post-Quantum Encryption Standards", August 2024: https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
- NIST IR 8547, "Transition to Post-Quantum Cryptography Standards" (deprecation timeline): https://csrc.nist.gov/pubs/ir/8547/ipd
- Anthropic, "Discovering cryptographic weaknesses with Claude", July 2026: https://www.anthropic.com/research/discovering-cryptographic-weaknesses
- NIST, Round 3 Additional Digital Signature candidates (HAWK listed as withdrawn): https://csrc.nist.gov/Projects/pqc-dig-sig/round-3-additional-signatures
- NIST pqc-forum thread, "HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1", July 2026: https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/2r2u6SbHun4
- Cognition, "Factoring RSA-260", September 2026: https://cognition.com/blog/factoring-rsa-260
- Steve Weis, "RSA-896", September 2026: https://saweis.net/posts/rsa-896.html
- Scott Aaronson, "The Mathocalypse", Shtetl-Optimized, October 2026: https://scottaaronson.blog/?p=10169
- OpenAI, "Sharing AI progress in mathematics", October 2026: https://openai.com/index/sharing-ai-progress-in-mathematics/
- Justin Drake on X, 7 October 2026: https://x.com/drakefjustin/status/2107837081313505768
- Yehuda Lindell on X, 8 October 2026: https://x.com/LindellYehuda/status/2107999859219587309
- Vitalik Buterin on X, 8 October 2026: https://x.com/VitalikButerin/status/2107976296320106851
- NIST CSWP 39, "Considerations for Achieving Crypto Agility", 2026: https://csrc.nist.gov/pubs/cswp/39/upd1/considerations-for-achieving-crypto-agility/final
