SafetyRisk, alignment & guardrails
Cryptographer Matthew Green puts 15% odds on the world losing confidence in public-key encryption after OpenAI's AI maths release
Johns Hopkins cryptographer Matthew Green estimates a 15% chance the world functionally loses confidence in public-key encryption, and 1% that it is impossible outright, arguing AI can surface surprises faster than standards bodies can replace algorithms, so preparation must come first.
Reach: not measured yet
AT Pulse research deskPublished · 4 min read · AI-assisted analysisGreen's 1% and 15% figures are his own subjective estimates, not the output of any analysis. His main argument is about timing: AI could produce cryptanalytic surprises faster than standards bodies can swap algorithms. He also said he knows of no imminent break and warned people not to abandon TLS or other encryption over his post. [1] [7] [10]
The trigger was OpenAI posting 722 maths manuscripts on 372 open problems, produced by an unreleased internal model. These are vendor-released results. Only 162 have their main results formalized in Lean, three were withdrawn over a sign error, and none of the remaining abstracts mention cryptography, LWE or discrete logs. [3] [8]
There is already one precedent. An attack reportedly found with Claude lowered HAWK-512's estimated security from 2^150 to 2^108, and NIST withdrew HAWK while saying Falcon and ML-DSA were unaffected. Green's concern centres on standardized public-key encryption, which rests on only a few hardness assumptions. Researchers have called this a monoculture risk for lattice-based schemes. [2] [7] [9]
no verified AI break of RSA, ECC or ML-KEM exists, though one AI-found attack has already eliminated a post-quantum candidate.
Read the full assessment
Implication: organizations that can inventory and swap public-key algorithms quickly will recover faster if a surprise arrives.
Executive brief
Johns Hopkins cryptographer Matthew Green puts a 15% chance on the world "functionally" losing confidence in today's public-key encryption. He gives a 1% chance that we live in "Minicrypt", a world where public-key encryption is impossible. These are his own subjective estimates, not results. He gave them after OpenAI released hundreds of AI-generated maths results on 6 October 2026. His main point is about timing: AI can produce surprises much faster than standards bodies can replace algorithms, so the preparation has to happen before any break. No public AI-driven break of a deployed encryption standard has been reported.
What changed and event timeline
AI-found attack knocks out HAWK
An attack described as "found by Claude" lowered HAWK-512's estimated security from 2^150 to 2^108. NIST withdrew HAWK and said Falcon and ML-DSA were unaffected.
OpenAI posts 722 maths manuscripts
An unreleased internal model produced manuscripts covering 372 open problems, published in the openai/math GitHub repository.
Cryptography absent; alarm rises
Scott Aaronson said his sources tell him AI labs are quietly testing internal models against cryptographic primitives. Justin Drake warned ECDSA could break "in months". OpenAI withdrew three papers over a sign error.
More detail
"We might lose public key cryptography."
Green posted this, then narrowed it to "encryption specifically". He also told people not to abandon TLS or other encryption because of a casual tweet.
More detail
The 1%/15% estimate
Simon Willison quoted Green's probabilities and his argument about AI speed versus the speed of standards work.
Capabilities and access
- Model: an unnamed, unreleased internal OpenAI model. There is no public access, model card or version number (AI Weekly).
- Scale: it was pointed at about 4,000 problems. Zvi Mowshowitz reports about three hours of compute per solution.
- Artifacts: 722 manuscripts released under Apache-2.0. 162 have main results formalized in Lean.
Read the full section
- Model: an unnamed, unreleased internal OpenAI model. There is no public access, model card or version number (AI Weekly).
- Scale: it was pointed at about 4,000 problems. Zvi Mowshowitz reports about three hours of compute per solution.
- Artifacts: 722 manuscripts released under Apache-2.0. 162 have main results formalized in Lean.
- Cryptography: Justin Drake noted that none of the 719 remaining abstracts mention cryptography, LWE (learning with errors) or discrete logs.
Technical analysis for researchers and developers
- Verification is uneven. About 22% of manuscripts carry Lean proofs. The remaining 560 have no independent check (AI Weekly).
- The risk is concentrated. Researchers have described this as a "monoculture" problem for lattice-based post-quantum schemes (ScienceDirect).
- There is a precedent. The HAWK attack reduced key recovery to a shortest-vector problem (SVP) in dimension n/2+1.
Read the full section
- Verification is uneven. About 22% of manuscripts carry Lean proofs. The remaining 560 have no independent check (AI Weekly). Aaronson treats Lean certificates as strong evidence, though kernel bugs remain possible. He reports the human-written exposition is hard to follow (Shtetl-Optimized).
- The risk is concentrated. Green's follow-up worry is about standardized public-key encryption and some signature schemes, which rest on a small number of hardness assumptions (X). Researchers have described this as a "monoculture" problem for lattice-based post-quantum schemes (ScienceDirect).
- There is a precedent. The HAWK attack reduced key recovery to a shortest-vector problem (SVP) in dimension n/2+1. A HAWK-256 key was recovered in hours on a single server (freenode).
Claims and evidence
- Green's 1%/15% figures are personal priors, not analysis (Simon Willison). He separately says he knows of no imminent break (BeInCrypto).
- Labs testing crypto in secret is second-hand sourcing reported by Aaronson. It has not been corroborated (Shtetl-Optimized).
- "ECDSA could break in months" is Drake's worst case.
Read the full section
- Green's 1%/15% figures are personal priors, not analysis (Simon Willison). He separately says he knows of no imminent break (BeInCrypto).
- Labs testing crypto in secret is second-hand sourcing reported by Aaronson. It has not been corroborated (Shtetl-Optimized).
- "ECDSA could break in months" is Drake's worst case. Yehuda Lindell of Coinbase called it "FUD" and said there is no evidence of a break (Gizmodo).
- OpenAI's maths results are vendor-released. They were only partly formalized, and one error has already been corrected (AI Weekly).
Context and prior work
- Impagliazzo's "five worlds" framework defines Minicrypt as a world with one-way functions but no public-key encryption (Quanta).
- A claimed polynomial-time quantum algorithm for the dihedral coset problem, with implications for lattice problems (ePrint 2026/1591, 3 Aug), was refuted on 15 Aug by Gupte, Ragavan and Zhandry (Quentir).
- Hybrid TLS is standardized. RFC 10024 standardized hybrid key exchange such as X25519MLKEM768 in August 2026 (freenode).
Read the full section
- Impagliazzo's "five worlds" framework defines Minicrypt as a world with one-way functions but no public-key encryption (Quanta).
- Recent false alarm. A claimed polynomial-time quantum algorithm for the dihedral coset problem, with implications for lattice problems (ePrint 2026/1591, 3 Aug), was refuted on 15 Aug by Gupte, Ragavan and Zhandry (Quentir).
- Hybrid TLS is standardized. RFC 10024 standardized hybrid key exchange such as X25519MLKEM768 in August 2026 (freenode).
Limitations, safety and contested findings
- No verified AI break of RSA, ECC or ML-KEM has been reported, and as of mid-2026 no standardized lattice scheme was broken at its specified parameters (postquantum.com).
- Some mathematicians criticized the bulk release as "a demonstration of power" rather than scholarship. Others called it historic (AI Weekly).
- Green himself warned against overreacting to his post (X).
Read the full section
- No verified AI break of RSA, ECC or ML-KEM has been reported, and as of mid-2026 no standardized lattice scheme was broken at its specified parameters (postquantum.com).
- Some mathematicians criticized the bulk release as "a demonstration of power" rather than scholarship. Others called it historic (AI Weekly).
- Green himself warned against overreacting to his post (X).
- Drake and Lindell remain directly opposed on how urgent the risk is.
Business and practitioner implications
- Green's argument is that recovery depends on preparation done before any surprise.
- Combining classical and post-quantum algorithms, as RFC 10024 does, avoids depending on a single hardness assumption.
- Crypto projects are already floating "recovery mode" proposals (Haseeb Qureshi).
Read the full section
- Build crypto-agility now. Green's argument is that recovery depends on preparation done before any surprise. That means inventorying where public-key encryption is used and being able to swap algorithms quickly.
- Prefer hybrids. Combining classical and post-quantum algorithms, as RFC 10024 does, avoids depending on a single hardness assumption.
- Plan recovery paths for blockchains. Crypto projects are already floating "recovery mode" proposals (Haseeb Qureshi).
- Don't abandon encryption based on the current evidence.