TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
OpenAI reported on Oct. 26 that an AI-assisted method refuted the Exponential Time Hypothesis, a longstanding unproved conjecture about computational difficulty. The result has not broken an encryption system, but it renews questions about whether AI could help find mathematical shortcuts relevant to cryptography. Independent researchers are reviewing the work.
OpenAI reported Oct. 26 that an AI-assisted method refuted the Exponential Time Hypothesis, a longstanding unproved conjecture about how computational work grows for difficult problems. The result is theoretical, not a demonstrated attack on encryption, but it has sharpened debate over whether advances in mathematical methods could threaten cryptographic systems without a quantum computer.
The OpenAI work describes a method for solving a class of yes-or-no decision problems in a way that escapes the exponential growth barrier expected under the hypothesis. It also counts the number of valid combinations. In the source account, each added decision can double the possible combinations; the conjecture holds that no general method can avoid exponential growth on the hardest cases.
OpenAI says the proof was checked using Lean, software that verifies proofs written in a precise, computer-readable form. The work is now being examined by independent researchers. A verified theoretical result does not, on its own, show that real-world cryptographic systems can be broken efficiently: a method may still take impractically long when applied to larger instances.
The report was published as a guest post by researchers including Ofir Joseph of the University of Haifa and the Academic College of Tel Aviv–Yaffo, Prof. Irit Hadar of the University of Haifa, and researchers affiliated with Tel Aviv University and Tal Ventures. Their argument is that mathematical advances could alter assumptions about security, while stressing that the OpenAI result is not itself a practical encryption break.
Why Mathematical Shortcuts Matter
Public-key cryptography underpins secure online connections and helps systems verify who sent information. Its security depends in part on certain calculations being too difficult for attackers. If researchers discover more efficient methods for solving relevant mathematical problems, security assumptions may need reassessment even if no quantum computer is involved.
That possibility matters for the development and review of post-quantum cryptography (PQC), which is designed to withstand attacks by both conventional and quantum computers and runs on ordinary hardware. The OpenAI result does not show that a standardized PQC system is vulnerable. It does, however, reinforce the need to distinguish a theoretical improvement from an attack that works at the sizes and costs used in practice.
AI could assist both sides of that work: helping researchers search for weaknesses in proposed cryptographic designs, and helping developers test and strengthen systems before adoption. The guest authors frame the concern as a changing research process, not proof that current encryption has failed.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Bose S1 Pro+ Portable PA Speaker
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Recent Tests of Post-Quantum Designs
A separate example came in research published by Anthropic in July 2026. With AI assistance, researchers improved an attack on HAWK, a proposed post-quantum digital-signature scheme. They recovered a secret signing key in a small experimental version, while attacks on larger versions remained impractical. Anthropic estimated the research effort at roughly 60 hours and $100,000 in model usage; that figure was not a cost estimate for breaking an arbitrary key. HAWK’s developers withdrew the scheme on July 29. NIST said the finding did not affect its finalized post-quantum standards.
Another development was distinct from that AI-assisted research. On Oct. 1, Germany’s cybersecurity authority, BSI, advised against selecting Classic McEliece for new developments, while reporting no practical attack against its recommended configurations. Cryptographic proposals have been overturned by mathematical analysis before AI became a prominent research tool, so AI’s contribution is a question of speed and capability rather than the arrival of mathematical cryptanalysis itself.
The guest post also discusses quantum key distribution (QKD), which uses specially prepared light signals to help two sites establish a shared secret. QKD has different security assumptions from public-key methods, but requires dedicated equipment and suitable connections. It does not replace digital signatures or protect compromised computers. The US National Security Agency does not currently recommend it for national security systems unless technical limitations are overcome; the UK’s national cybersecurity authority also rejects it for government and military use. ETSI describes it as complementary to PQC.
“A theoretical improvement can remain impractically slow.”
— The guest-post authors
From Proof to Practical Attack
Independent review is ongoing, and the source does not provide details about the method’s practical performance on cryptographic systems or whether it applies to the mathematical problems used by particular standards. It is not yet clear whether the result will lead to algorithms that run efficiently at real-world scales.
The reported finding does not demonstrate that an attacker can recover keys, read encrypted messages, or defeat a standardized post-quantum method. The source also does not establish how much AI contributed compared with conventional mathematical research. Those points would be needed to assess the result’s direct security implications.
More broadly, the guest authors argue that AI may speed up cryptographic analysis, but the degree of that acceleration remains uncertain. QKD is not a direct fix for the reported result: it brings its own equipment, authentication and operational requirements, and any combined system would need evidence showing what remains secure if one component fails.
Review and Cryptographic Testing
The immediate next step is independent examination of the OpenAI proof, including scrutiny of its assumptions and the limits of the method. Further work would be needed to determine whether the approach has implications for specific cryptographic problems and whether any improvement can be made practical at relevant scales.
Security agencies and standards bodies will continue to assess proposed and finalized methods as new mathematical results emerge. For now, the source offers no indication that users need to change encryption settings in response to OpenAI’s announcement. The practical question is whether follow-up research can connect the theoretical result to an efficient attack—or show that it does not apply to deployed cryptography.
Key Questions
Did OpenAI show that current encryption can be broken?
No. The reported result challenges a theoretical computation conjecture; it does not demonstrate an attack on an encryption system or the recovery of a deployed key.
What is the Exponential Time Hypothesis?
It is a longstanding, unproved conjecture that certain hard problems require work that grows exponentially in the hardest cases, rather than being solvable by a general method with much slower growth.
Does this mean post-quantum cryptography is unsafe?
The source does not establish that. It says the OpenAI result is not a practical attack on a standardized PQC method. NIST also said the separate HAWK research did not affect its finalized standards.
Could AI help find weaknesses in cryptography?
Researchers have used AI assistance in cryptographic analysis, including the reported work on a small experimental version of HAWK. Whether AI makes attacks practical against deployed systems remains uncertain.
Would quantum key distribution solve this risk?
Not by itself. QKD has different security assumptions, but requires specialized equipment and does not replace digital signatures or protect compromised computers. The guest authors describe it as a possible complement to PQC in selected settings, not a universal remedy.
Source: rss
