OpenAI’s latest progress in mathematical reasoning has triggered fresh debate over whether AI could one day break the cryptographic foundations that modern software and digital systems rely on. In a conversation organized by a16z crypto, Stanford cryptographer Dan Boneh and a16z crypto leaders Eddy Lazzarin, Justin Thaler, Liz Harkavy and Sonal Chokshi separated what they see as evidence from speculation.
Boneh is a Stanford University professor who leads the Applied Cryptography Group and co-leads the Computer Security Lab. He also serves as a special research adviser to a16z crypto. Lazzarin is a general partner at a16z crypto. Thaler is a research partner at a16z crypto and an associate professor of computer science at Georgetown University. Harkavy is an investment partner at a16z crypto, and Chokshi is editor in chief at a16z crypto.
Recent AI math results did not address core cryptography questions
The discussion’s first point was direct: the newly released results show notable progress in mathematics and computer science, but not in cryptanalysis itself.
At 03:00, Boneh said, “This is a tremendous advance in mathematics and computer science, but there is nothing here about cryptography. … So you might ask, does this mean these models are actually very bad at cryptography? We don’t know.”
Lazzarin made a similar point at 15:19: “We have not learned that elliptic curves are any weaker than they were before. We have not learned that the security of any specific cryptographic assumption is worse than it was before.”
In other words, the panel said the current wave of concern has run ahead of the evidence. No new result presented in this discussion showed that a widely used cryptographic assumption had already been weakened by AI progress.
Smarter AI still cannot find an efficient algorithm that does not exist
A second core argument focused on the assumptions behind modern cryptography. Many cryptographic systems rest on the belief that some mathematical problems do not have efficient algorithms.
At 16:12, Thaler said, “We broadly believe these problems do not have efficient algorithms. It’s not that we think one might exist and humans just haven’t been smart enough to find it. We think it simply doesn’t exist. If it doesn’t exist, then it doesn’t matter how smart AI gets. It won’t find the algorithm that doesn’t exist.”
Boneh expanded on that point at 06:00. He said cryptography has to assume certain problems are hard, but that hardness cannot be fully proved because the issue is tied to the famous open problem of P versus NP in computer science. In his words: “We have to assume that certain problems are hard. We can’t prove these problems are hard, because this touches a famous unsolved problem in computer science, namely P versus NP. In some sense, we would have to solve that problem before we could really argue that some cryptographic problems are truly, truly hard. … Nothing released this week came anywhere close to solving P versus NP. In cryptography, we still need to keep making assumptions, right?”
The panel’s position was that OpenAI’s latest mathematics progress remains far from overturning those underlying assumptions.
AI could shorten the review cycle for new cryptographic ideas
The conversation did not frame AI only as a threat. Boneh pointed to a more immediate use case: speeding up the review process that new cryptographic assumptions and systems go through before they are trusted.
At 12:10, he said that in the past, when someone proposed an assumption and built a system on top of it, the field often waited around 10 years before deployment to give researchers enough time to analyze it and build confidence. That timeline may change. Boneh said: “In the past, when someone proposed an assumption and built a system based on it, we often had to wait around 10 years before deploying that system, in order to build confidence and give people enough time to analyze the assumption. … And now, all of a sudden, we can use these models to dramatically accelerate that process. … We can now let models run for a month trying to break it, and if the model can’t break it, then our confidence that the assumption is valid goes up significantly.”
That shifts AI into the role of a high-speed testing tool. Instead of treating models only as future attackers, researchers may use them to probe designs much earlier and much more aggressively.
Work already done for quantum migration may help with part of the AI discussion
On mitigation, Lazzarin said some of the concerns now being discussed under AI overlap with work that had already started because of quantum-computing risk. As fears around quantum attacks grew, parts of the industry had begun preparing for the possibility that elliptic-curve cryptography could become vulnerable.
At 20:52, he said: “Because of concerns around quantum threats, people had already started to think about elliptic-curve cryptography as something that might soon become vulnerable. So for these exact same concerns, we have actually already been involved in, prepared, and deployed many of the mitigations you would need, except they were originally aimed at a different threat.”
Boneh added a limit to that comparison. At 22:08, he said: “The AI threat is in some sense broader, because it could actually also examine our post-quantum systems and somehow weaken them, or even break them completely.”
So the overlap is real, but partial. The panel did not suggest that quantum-readiness work settles the AI question.
Cryptographic agility was presented as a practical defense
Another recurring theme was cryptographic agility, meaning a system’s ability to switch cryptographic methods when evidence changes or when a design is shown to be unsafe.
At 22:47, Boneh said: “The systems we deploy can quickly switch from one design to another if the design they use is shown to be insecure. Cryptographic agility is, in some sense, our friend in defending against surprises.”
He also pointed out at 38:40 that internet connections are already using combined approaches: “They are actually already using agile cryptography. They use both elliptic curves and lattices for encryption at the same time. If you break elliptic curves, that’s okay, because it is also encrypted under a lattice-based system.”
Under that view, resilience comes less from assuming one method will hold forever and more from designing systems that can adapt when assumptions change.
The clearest near-term opportunity is finding more bugs before release
For builders, the speakers said the most concrete opportunity is to bring more security testing into development, before deployment rather than after it.
Discussing complex cryptographic systems, Thaler said at 28:56: “The attack surface becomes very large, yes, and I’m very optimistic that these AI tools that make people panic about cryptography will also help us eliminate all the bugs. This is a very difficult problem.”
Boneh said at 35:05: “Once a system is deployed, it will attract a lot of attention from cryptographers, but at that point, attacking the cryptographic system is actually too late. And now, because we control these AI models, any startup deploying new cryptographic capabilities, and really any company deploying any software, can have these models analyze the vulnerabilities in its cryptography and in its overall software.”
Lazzarin added at 37:10: “Bugs can be eliminated. They can be designed around, they can be mitigated, and the main resource we use to mitigate them, AI capability, is dropping sharply in price every few months.”
The discussion’s bottom line was not that AI has already broken the foundations of cryptography. It was that AI may become a cheaper and faster tool for review, testing and adaptation across cryptographic systems and broader software stacks.
The original article noted that quoted remarks were lightly edited for clarity, and ellipses indicate omitted passages.