When an AI Lab Says It Broke a Cipher, Ask These Six Questions

An AI lab announces its model broke a cipher. The headline travels in hours. Then the cryptographers show up, and the temperature drops fast — Johns Hopkins professor Matthew Green among the most reliably unimpressed. It’s tempting to read that as academic gatekeeping. It isn’t.

One thing up front: this is a pattern piece, not a post-mortem of a specific announcement. There’s been almost no substantive community discussion to draw from in the past month, so rather than pin numbers to any one claim or put words in Green’s mouth, I want to look at why this argument keeps recurring in the exact same shape.

What “Broke” Actually Means

Start with vocabulary, because that’s where the whole thing goes sideways.

In cryptography, break is a much wider word than in English generally. If you can take arbitrary AES-256 ciphertext and produce plaintext, sure, you broke it. But you have also technically broken it if you find an attack that is even marginally faster than brute force. Found a method that needs 2^254 operations instead of 2^256? That’s a break. It also still takes longer than the remaining lifespan of the universe.

Here’s the first gap. The paper says something precise: we found a distinguisher against a reduced-round variant. The press release says: AI cracks encryption. Nobody lied. The precision just doesn’t survive the trip.

The Questions Cryptographers Actually Ask

When Green and colleagues look at an AI cryptanalysis claim, the checklist is fairly consistent.

What exactly did it beat? The full production algorithm, or a round-reduced version? Attacking reduced-round variants is completely normal cryptanalytic work — it’s how the field measures safety margin. It is not the same as breaking a deployed system. AES-256 runs 14 rounds. Break a 6-round version and you have a legitimate research result that has precisely nothing to do with your banking app.

Did it rediscover something humans already published? Classical ciphers and textbook weaknesses are exhaustively documented. The probability that this material sat in the training data is close to one. A model deriving genuine new mathematical insight and a model recalling a known attack well enough to reproduce it are entirely different events — and from the output alone, they can look identical.

Is it reproducible? Cryptography has an unusually hard verification culture, hardened by decades of broken-on-arrival schemes. Code and parameters get published. Other people run it and get the same thing. “Our internal evaluation showed the model solved this” is not evidence in this community. It barely counts as an anecdote.

How many attempts? Running a model a thousand times and succeeding once is not a capability. It’s a lottery ticket. This is the chronic disease of AI benchmarking generally, and cryptographers are less willing than most to be polite about it.

Why Green in Particular Doesn’t Let This Go

Green has spent years pushing back on cryptographic hype, and his track record is specific. Every time someone claims a quantum computer factored RSA, he takes the claim apart in public — the 2023 Chinese quantum factoring paper, the recurring “quantum advantage” announcements from startups looking for a Series B.

The persistence has a reason. Cryptography is infrastructure that runs on trust, and trust responds badly to noise. If “RSA is broken” spreads incorrectly, migration priorities get scrambled, budget flows to the wrong place, and genuinely urgent work slides. Underreacting to a real threat is worse. That combination is why people in this field are obsessive about the precise scope of a claim. It reads as prickliness. It’s closer to professional ethics.

AI lab announcements draw extra scrutiny for a structural reason: the announcer is the interested party. A company whose valuation is a function of model capability is publishing a claim about its own model’s capability. The incentives differ meaningfully from peer-reviewed work. This isn’t an Anthropic problem — it applies identically to OpenAI, Google DeepMind, and everyone else in the race.

None of Which Means AI Is Useless Here

Now the other side, because “cryptographers are skeptical” translates badly into “LLMs contribute nothing to cryptography.” That’s also wrong.

There are areas where language models genuinely deliver. Finding bugs in cryptographic implementations is the clearest one. A mathematically flawless algorithm still falls over if the code skips constant-time comparison, mishandles an RNG seed, or forgets to validate padding. Real-world crypto failures overwhelmingly come from this layer, not from someone breaking the math — Heartbleed, Debian’s OpenSSL entropy disaster, and a long tail of padding oracle bugs were all implementation, not algorithm. Recognizing code patterns at scale is something LLMs are structurally good at.

Same for the support work: writing fuzzing harnesses, flagging ambiguous language in protocol specs, connecting a new finding to similar attacks buried in forty years of literature. Unglamorous, genuinely useful.

The distinction worth holding onto is simple. Discovering a novel mathematical attack and skillfully applying existing knowledge are not the same difficulty class. The first is territory human cryptographers advance by inches over decades. The second is something AI already does well. Sort any announcement into one of those two buckets and most of the confusion evaporates.

A Practical Checklist

Next time this crosses your feed, six questions:

Full rounds or reduced rounds. A deployed standard or a toy cipher. Is the attack complexity stated as an actual number. Are code and data public. Has an outside cryptographer reviewed it. What was the success rate, over how many attempts.

The more of those that come back blank, the wider the gap between the headline and the thing. And if all six are answered and the result still looks impressive — that’s when you should pay attention, because that’s the real one.

Cryptography Just Got There First

This verification problem is going to matter more, not less. As models actually get stronger, distinguishing a genuine breakthrough from a well-packaged reproduction gets harder, not easier. Cryptography has the field’s most rigorous verification norms, which is exactly why the friction showed up here first. Biology, materials science, and drug discovery are next, and their verification cultures are softer.

So: how much do you verify before you believe an AI result? And who are you assuming will do that verification for you? The party making the announcement is not going to do it on your behalf.