When AI Cracks Encryption in Days, Not Decades

Jan de Vries · 2026-09-30

Let's be honest. For fifty years, cryptography has been the one part of tech you could set and forget. You know, like that old, reliable toaster in the kitchen. RSA—the foundational public-key algorithm—arrived in 1977. It became the backbone of web security by 1994, and it's still chugging along today. Minor attacks have slowly piled up. Parameters got bigger. Real, meaningful advances? Those took decades. We built our entire digital world on that assumption of slowness. ### The Clock Just Broke Standards bodies deliberate for years. Migration programs are planned in five-year blocks. Procurement assumes what you buy today will still work in 2033. Even the US government's recent move to push post-quantum deadlines to 2030 was considered shockingly aggressive. Then came this past July. An AI found a cryptographic flaw in a candidate algorithm called HAWK in about sixty hours. Two years of expert human review had missed it. Within a day, the finding was confirmed, and HAWK—a lattice-based scheme meant to be secure against quantum computers—was pulled. It will never become a standard. Think about that. Sixty hours. The price of discovery just crashed. When finding a weakness collapses from years to days, but fixing it across a big organization still takes years, you're left with a dangerous gap. And bad things thrive in gaps like that. The uncomfortable math is simple now. The half-life of a cryptographic assumption might be shorter than the migration project meant to replace it. If that's even remotely true, then every plan to "arrive at post-quantum by 2030" was designed for a world that doesn't exist anymore. ### The Real Threat Isn't What You Think Here's the thing. The most realistic AI threat to your encryption over the next few years probably won't be breaking a brand-new algorithm. It'll be in the messy implementation. Every large company is carrying cryptographic debt. It's everywhere: - Expired certificates that got renewed with a weak key - A legacy service still using a deprecated cipher suite - A hardcoded credential buried in a repo from an acquisition back in 2019 - A random number generator that, well, maybe isn't so random For a long time, finding these flaws required expensive, highly skilled humans. The obscure corners of your enterprise were safe only because auditing them wasn't worth anyone's time. AI just changed that game completely. Attackers can now scan all code, certificates, and network configurations continuously for next to nothing. The cost to find a flaw is nearly zero. You have to assume every single weakness will be found. And here's the kicker—nothing I'm describing needs a quantum computer to be real. We're not talking about some far-off "Q-Day." This is about what *already happened* in July. Finding flaws got cheap. Fixing them didn't get any faster. ### The Surprisingly Simple Answer Earlier this year, I asked the security lead at a major European bank a question. "If a widely used algorithm broke on a Friday, when would you know where you use it?" His answer stuck with me. "Two weeks," he said. "Maybe four. And frankly, I'm not sure I'd trust the answer." He was dealing with four core banking platforms—two inherited from acquisitions—thousands of certificates across three cloud providers, and payment integrations whose cryptography was a black box. His reality is everyone's reality. The solution isn't a flashy new widget. It's cryptographic agility. It's the boring, humdrum work of knowing what you have, where it is, and being able to change it fast. It's the unusual security investment that pays off no matter what the future holds—whether quantum computing arrives or we're just fighting smarter AI-assisted attackers exploiting classical mistakes. The era of setting and forgetting is over. The slow problem isn't slow anymore. The question is, how quickly can you adapt?