Can AI Break Cryptography? What the Experts Actually Think

1. Key Themes

The Panic Is a Reaction to Silence, Not to New Information

The central point of the episode is that nothing about cryptography changed this week. The reaction was triggered indirectly, by OpenAI's large dump of math results, and not by any specific finding about cryptosystems. Dan Boneh opened with: "everybody calm down, don't panic. Calm down. The world today is the same as it was a year a year ago, 2 years ago." [00:02:21] Eddy Lazzarin made the same point: "the reaction yesterday uh and continuing today is not a reaction to new information... We didn't learn that elliptic curves are vulnerable in a way that they weren't before." [00:15:25] Boneh also argued the "lack of knowledge right now is creating a vacuum, I think, in the, you know, Twittersphere. And uh that vacuum really needs to be filled." [00:10:21]

The Conspicuous Absence of Cryptography in OpenAI's 700 Problems

Boneh went through roughly 700 problems on which OpenAI posted progress and found none in cryptography, not even theoretical cryptography. He read this as a gap that needs explaining: "this is incredible progress in mathematics, in computer science, but there are no questions here on cryptography... not even on theoretical cryptography." [00:02:21] Lazzarin laid out the two possible explanations: "if the reason for the omission is that AI models are notably bad and couldn't find anything... that in itself would be very interesting... If, on the other hand, they did make progress... that would be very interesting to know, as well." [00:04:54] Boneh's direct ask to the labs: "please tell us what have you done with uh trying to use these models to answer basic questions in cryptography?" [00:02:21]

Cryptography Rests on Unproven Assumptions, So Adversarial Testing Is How Confidence Is Built

All of cryptography depends on hardness assumptions that cannot be proven because of the P versus NP problem. Boneh explained: "all of cryptography is based on complexity assumptions... The reason we can't prove that those problems are hard is because that's related to a famous open problem in computer science called the P versus NP problem." [00:06:33] The consequence is that failed attacks are valuable evidence: "The fact that people try to break them and fail gives us more confidence." [00:00:16] Lazzarin's framing was that in the absence of proofs, "we specifically rely in some sense on time... we put these schemes out and we wait." [00:11:24]

AI as the Fastest Cryptanalysis Tool Ever Built, and a Way to Compress Decades of Scrutiny

The same models that worry people can be pointed at cryptosystems to build confidence far faster than the traditional process. Boneh said: "In the past, when one someone would make an assumption and build a system based on it, we'd have to wait like 10 years... And now, all of a sudden, we can accelerate this process tremendously using these models... we can just let a model run for a for a month try to break it." [00:12:52] Lazzarin put it concretely: "We took our tiptop, totally unrestricted, most cyber-capable model, and we told it to go absolutely insane. And we spent $20 million, $50 million trying to break this scheme. And at the other end, we have more conviction about its confidence than you could probably get from the conventional process in a decade." [00:13:24] Justin Thaler added that models could also provide stronger complexity-theoretic evidence of hardness, not just fail to find attacks. [00:09:04]

AI Threat Versus Quantum Threat: Overlapping but Different

Boneh insisted the two stories be disentangled, and then identified where the AI threat is broader. Quantum "is really only about these elliptic-curve type systems and and RSA and such. The AI threat, in some sense, is broader in that it could actually also look at our post-quantum systems and potentially um weaken them in some way, um maybe break them altogether." [00:22:38] That is why he wants to know whether the latest models failed against the post-quantum candidates: "those are the ones we're moving to." [00:22:38] Liz Harkavy summarized the implication: hash functions and lattices are "post-quantum, but they might not be post-AI." [00:25:28]

Backup Plans Already Exist: Crypto Agility and Diverse Assumptions

Boneh listed the fallback families: "isogenies and code-based systems and and uh multivariate polynomial-based systems... and hash-based signatures." [00:16:09] He highlighted the principle of crypto agility ("a term that's over a decade old") as "our friend for defending against the unexpected." [00:22:38] Deployed systems already hedge: "they're encrypted using elliptic curves and lattices at the same time. If you break elliptic curves, it doesn't matter because it's also encrypted under a lattice-based system." [00:39:10] The TLS key exchange he cited is "X25519MLKEM768." [00:39:47] His answer to the worst case, in which both are broken: "Well, fine. Then we should use the third one." [00:39:47]

Hash-Based Versus Lattice-Based Signatures for Blockchains

The panic reopened an existing debate. Boneh explained why blockchain communities favor hashes: "if one hash function turns out to be not as secure as we thought, we simply switch it out for another hash function and everything works as before... If... the core lattice problems are not as hard as we thought, the whole mechanism collapses." [00:25:43] A second argument is minimizing assumptions: "reducing the number of assumptions in the blockchain is also something that uh people are are kind of excited about" [00:27:22], with Bitcoin core developers "quite excited about getting rid of elliptic-curve assumptions in Bitcoin." [00:27:22] Thaler countered that hash-only designs rely on SNARK recursion, creating a large bug surface and "we don't understand the security of SNARK recursion very well." [00:28:32] Boneh noted that cryptographers are "a little sad" because hash-based schemes "really have no algebraic properties for us to leverage," losing things like threshold signatures. [00:30:26]

Software Security Is Trending Toward Improvement, Not Erosion

Several speakers argued that AI is net defensive in the medium to long term. Thaler said: "bugs remain everywhere. The AIs are good at finding the bugs. Uh I actually hope that's good for, you know, uh aids defensive uh practices more uh in the medium to long-term than than offensive ones." [00:16:48] Lazzarin's bull case: "the number of bugs in software is finite, right? Then we're asymptotically approaching zero bugs... vulnerabilities can be removed. They can be designed away." [00:36:28] Boneh predicted: "software quality is going to go up, crypto quality is going to go up because nothing will ship unless the models said that it's it's it's valid." [00:35:23]

Tail-Risk Psychology Crowds Out Real Risks

Thaler highlighted Vitalik Buterin's observation: "he himself has lost more, you know, personal funds in botched migrations than in all hacks." [00:16:48] His conclusion: "we as humans tend to uh, you know, struggle with uh tail risks that are very scary... when there are sort of clear and present risks that are actually uh more dire." [00:16:48] Panicked migrations are themselves a risk, and Lazzarin noted that the specific actions advised "are probably not good and risky for normal people to do." [00:19:17]

2. Contrarian Perspectives

An AI Cannot Break What Doesn't Exist

The common fear assumes a hidden attack is waiting to be discovered. Thaler rejected that framing: "it's not that we think there might be and humans just aren't smart enough to find it, we think there is not one. And so if there is not one, it doesn't matter how smart the AI is, it cannot find a nonexistent algorithm, right?" [00:16:48] The belief that these problems are intractable is a claim about nonexistence, not about human limitation, so AI capability alone does not threaten it unless the underlying belief is wrong.

A Failed AI Attack Would Be the Strongest Security Evidence Ever Produced

Most observers treat frontier AI as pure downside for cryptography. Boneh argued the opposite: "I would say this would be an extremely positive developments if the labs try their best models at some of our basic cryptographic assumptions, the models fail to break them... that will give us tremendous confidence that our assumptions are valid." [00:06:33] Even a partial result is good news: "even if they shave off a little... 10 bits of security... The fact that all they could do is shave off 10 bits of security is actually already very strong evidence that the assumptions are actually worthwhile using." [00:06:33] Lazzarin extended this: knowing "the equivalent of, you know, 100,000 expert uh mathematicians or cryptographers took a look at a scheme... should actually make you more confident than you could have ever been." [00:32:57]

The "Bunker Mode" Advice Was Both Redundant and Dissonant

Thaler argued that if Justin Drake's warning were true, "it's a cataclysmic event for all digital infrastructure security throughout the entire world," so the "focus on blockchain hygiene is just very discordant with this cataclysmic event he was discussing." [00:22:07] Lazzarin added that the recommended practices were already standard: "Coinbase already came out and said they already do this." [00:19:17] Thaler's advice was blunt: "the worst thing you can probably do right now um is something. You should you should do nothing." [00:16:48] The recommendations were "really just good practice, good hygiene that all of these institutions should already be following." [00:16:48]

The Safest-Looking Option May Sacrifice the Most Capability

Blockchain communities treat hash-based signatures as the conservative choice. Boneh pushed back as a cryptographer: lattice systems have "much better properties," including "threshold uh signatures" and "non-hardened key derivation," while hash-based systems are "much larger," "stateful versus stateless." [00:30:26] His warning: "we are removing assumptions from the blockchain space, but we're also removing capability... perhaps that constraint is also where this extra sense of security comes from." [00:30:26] Thaler added that a hash-only world can't do good encryption or key exchange. [00:28:32]

Closed Source Is Effectively Dead

Lazzarin dropped this as a throwaway line while discussing how startups should rethink security: "Didn't closed source basically Everyone recognized closed-source died last week, right? Because of our ability to decompile things." [00:34:14] The implication is that security by obscurity loses its value when AI can decompile and analyze binaries cheaply.

3. Companies Identified

OpenAI

Frontier AI lab. Its release of roughly 700 papers on mathematics and computer science results triggered the debate. Boneh said: "I can't say enough about how impressed I am with the results that have been put on online. It's really quite remarkable uh to see all the progress." [00:02:21] Lazzarin described the drop as covering "hundreds of different topics" with many "adjacent to cryptography." [00:04:54]

Coinbase

Crypto exchange and custodian. Cited as already following the practices recommended in the "bunker mode" tweet. Lazzarin: "Coinbase already came out and said they already do this, right? They already do a lot of the specific measures outlined in bunker mode." [00:19:17]

Ethereum Foundation

Nonprofit stewarding Ethereum. Justin Drake works there, and the foundation community plans a hash-only approach using SNARK recursion. Thaler: "in the Ethereum community, um the way uh they plan to use only hashes... is to uh use what's called SNARK recursion." [00:28:32] Boneh noted "the same thing is also playing out in the uh in the Ethereum Foundation space" regarding removing elliptic-curve assumptions. [00:27:22]

Bitcoin

Cited via its core developers, who are excited about removing elliptic-curve assumptions. Boneh: "in the Bitcoin space, in particularly the the core devs that I talked to, they're actually quite excited about getting rid of elliptic-curve assumptions in Bitcoin and having Bitcoin only depend on the security of a particular hash function." [00:27:22]

NIST

US standards body. It is "already standardizing many other types of public key systems that we can switch to," which Boneh cited as the backup if any current assumption breaks. [00:10:21]

Apple (iMessage) and Signal

Messaging systems that have already migrated to post-quantum cryptography. Lazzarin asked: "Didn't like iMessage make that migration last year and and and and many other such systems have done that?" Boneh answered: "Exactly, Signal and so on." [00:39:40]

Anthropic (Claude Haiku)

Referenced obliquely by Lazzarin as the source of a model-to-model cost comparison: "because of the release of like 5.5 haiku, they were comparing with 4.5... some people were coming up with estimates like it's 90-sum-plus 95% cheaper, right? 99% cheaper for uh, you know, uh intellectual capability per dollar." [00:36:28]

4. People Identified

Dan Boneh

Stanford professor and leading applied cryptographer. He anchored the episode with the case for calm, the disentangling of AI from quantum, and the call for labs to disclose their cryptanalysis results. He also described an emerging research area: "how do we do software scanning at uh more efficiently, yeah? So we don't have to maybe rescan everything every time a new model comes out." [00:38:18]

Justin Thaler

a16z crypto research partner. He provided the cleanest logical argument ("it cannot find a nonexistent algorithm") [00:16:48], the critique of SNARK-recursion-based hash-only designs [00:28:32], and the tail-risk framing. [00:17:17]

Eddy Lazzarin

a16z crypto general partner. He articulated the "absence of time" problem, the idea of buying decade-scale confidence with $20 to $50 million of model compute [00:13:24], and the bull case for asymptotically approaching zero bugs. [00:36:28]

Liz Harkavy

a16z crypto host of the discussion. She framed the clarifying questions, including "post-quantum, but... not post-AI" [00:25:34], and asked the startup-opportunity question. [00:34:14]

Justin Drake

Ethereum Foundation researcher whose tweet sparked the discussion. He warned "of a possible complete break of elliptic-curve cryptography in the coming months" and urged large cold wallets to enter "bunker mode." [00:16:48] He was mentioned as a trigger rather than praised, but his speculation about "structure in lattice cryptography and elliptic-curve cryptography that perhaps makes it more vulnerable" [00:23:57] framed the technical debate. Both a16z speakers treated his specific recommendations as redundant good hygiene.

Vitalik Buterin

Ethereum co-founder. He posted a more toned-down follow-up and, per Thaler, noted "he himself has lost more, you know, personal funds in botched migrations than in all hacks." [00:16:48] Cited as a model of calibrated thinking about migration risk.

5. Operating Insights

Use Frontier Models as a Pre-Ship Security Gate

Boneh described the shift in when attacks happen: "the time when a cryptosystem becomes really interesting to attack is once it's announced that it's about to be deployed or is already deployed... that's kind of the wrong time to attack a cryptosystem. Whereas now... any startup or any software shop that's deploying a a new crypto capability, or actually even deploying any software at all, can now have these models analyze its cryptography and analyze its general software for bugs." [00:35:23] The tactic: move adversarial analysis before launch and make a clean model scan a release requirement.

Rescan on Every Model Release and Every Code Change

Boneh observed that leading companies "scan the model the the software again" with each update and with each new model release. [00:36:28] The operating lesson is to treat security scanning as a recurring job triggered by new model capability, not a one-time audit. Because each model generation finds different bugs, the bug backlog should be re-evaluated whenever the tools improve. Boneh flagged the open problem of making this incremental and cheap.

Design for Crypto Agility From Day One

The practical defense against unknown unknowns is the ability to swap primitives quickly. Boneh: "we deploy systems that can quickly switch from one type of design to another if the... design is being used turns out to be insecure." [00:22:38] Combined deployments such as "X25519MLKEM768" show the pattern of layering two independent assumptions so that either one alone is sufficient. [00:39:47] When choosing architectures, favor designs where the underlying primitive is replaceable, as with hash functions, over designs that depend on one shared hardness assumption.

Reconsider Security Boundaries for Agentic AI

Lazzarin noted that because agents "can go on unbounded side quests... and do all kinds of random things in pursuit of a goal for you," builders need to "think very carefully about the security boundaries and sandboxes and capabilities-based permissioning schemes we put around AI agents." [00:34:14] Permissioning and sandboxing should be a first-class design concern in any product that deploys agents.

6. Overlooked Insights

Cryptographic Confidence May Become a Purchasable Commodity

Lazzarin's offhand remark about spending "$20 million, $50 million trying to break this scheme" [00:13:24] describes something new: security assurance bought with compute on a timeline of weeks, instead of waiting a decade for academic scrutiny. Boneh reinforced this by describing the old norm of waiting "like 10 years" and the new one of letting "a model run for a for a month." [00:13:00] This suggests an emerging market for adversarial AI audits of cryptographic schemes, new protocols reaching deployment years sooner, and labs holding a privileged position as arbiters of cryptographic confidence. It also creates an asymmetry: Boneh noted "the gap... is also the fact that um obviously some of the models uh are accessible to the labs, but not to the rest of the public." [00:14:31] Whoever controls the strongest unrestricted cyber-capable models can issue or withhold the most credible security attestations.

Responsible Disclosure Is the Real Systemic Dependency

Lazzarin closed with a point that is easy to miss: if a lab did find a break, the outcome depends entirely on disclosure discipline: "they should responsibly disclose it to... the government to the industry, develop a plan, and everybody needs to update their software as quickly as possible." [00:40:13] The structural risk is not the math but the governance of who learns about a break first and how fast the ecosystem can migrate. Even Boneh's reassurance that third-option standards exist came with a caveat: "we'd have to standardize, that would be a longer process... it's just going to be more work and um uh perhaps more more of a rush." [00:39:47] That points to a possible opening for coordination, disclosure, and rapid-migration tooling, and it makes the labs' silence on cryptography a governance question as much as a technical one.