The Day AI Shattered Cryptography's Slowest Promise

Jan de Vries · 2026-09-30

Let me tell you something that should keep you up at night. On July 28th of this year, an AI did something extraordinary. It found a cryptographic flaw in about sixty hours. Two years of expert review had missed it completely. Think about that for a second. Within 24 hours, the findings were confirmed. HAWK—that lattice-based post-quantum signature scheme everyone was evaluating—got pulled from consideration. It'll never become a standard. Just like that. ### The Era of Set-and-Forget Security Is Over For fifty years, cryptography has been the one tech you could install and basically forget. RSA arrived back in 1977. It became mainstream for web security by 1994. And it's still hanging around today, believe it or not. We've grown accustomed to this glacial pace. Minor attacks accumulated slowly. Parameters inched upward. Meaningful advances took decades. This slowness got baked into everything. Standards bodies deliberate for years. Migration programs get planned in five-year blocks. Procurement assumes what you buy today will still work in 2033. The U.S. government's Executive Order 14412 moved post-quantum deadlines to 2030 and 2031. The industry called that aggressive—a shock, even. They'd pulled the timeline forward by half a decade. Then came sixty hours. AI changed the price of discovery overnight. When finding a weakness collapses from years to days, but fixing it across a large organization still takes years, you've got a dangerous gap. And bad things thrive in gaps like that. Here's the uncomfortable math. The half-life of a cryptographic assumption might now be shorter than a migration project. If that's even remotely true, every organization planning for "post-quantum by 2030" is playing the wrong game. ### The Real Threat Isn't What You Think The most realistic AI threat to encryption over the next three years? It's not about breaking some shiny new algorithm. It's about implementation flaws—the messy, human stuff. Every large organization is carrying cryptographic baggage everywhere: - Expired certificates renewed with weak keys - Services still using deprecated cipher suites - Hardcoded credentials from an acquisition back in 2019 - Random number generators that aren't very random The economics of finding flaws have completely shifted. Discovering a flaw used to require highly skilled humans actively looking. Obscure corners of an enterprise were safe only because auditing them wasn't worth the time. AI just changed all that. Attackers can now read all code, certificates, and network configurations continuously at near-zero cost. You should assume every weakness will be found. Here's the kicker—none of this needs a quantum computer. We're already living in this new reality since July. Finding weaknesses became dramatically cheaper. Fixing them didn't get any faster. Even if "Q-Day"—that hypothetical quantum breakpoint—never arrives, everything I'm saying still holds. You'll be exposed to AI-assisted attackers exploiting classical flaws. Cryptographic agility isn't just a nice-to-have anymore. It's the unusual security investment that pays off no matter what happens. ### A Surprisingly Simple Solution Earlier this year, I asked the security lead at a major European financial institution a simple question. "If a widely used algorithm broke on a Friday, when would you know where you use it?" His answer? "Two weeks. Maybe four. And frankly, I'm not sure I'd trust the answer." Let that sink in. His organization runs four core banking platforms—two inherited through acquisitions. They manage thousands of certificates across three cloud providers. Their payments integration is a cryptographic patchwork. This isn't a hypothetical problem. It's today's reality for enterprises operating in Europe and serving global markets. The slow, deliberate world of cryptographic security we built our systems around is gone. AI didn't just find a flaw—it rewrote the rules of the game. And the clock is already ticking on how we adapt.