Public key cryptography faces questions over AI progress
Public key cryptography, the mathematics that helps strangers communicate securely online, faces a potential challenge from artificial intelligence (AI) advances, according to Wordfence. Its warning concerns whether faster mathematical discovery could undermine the assumptions behind secure web transactions. The source does not report a demonstrated break of today's web encryption, identify an affected algorithm or announce an emergency replacement.
The immediate trigger is a mathematical release that Wordfence attributes to OpenAI. According to the article, OpenAI published more than 700 mathematical proofs in a GitHub repository, an online collection of project files, on the day before Wordfence's account. It subsequently withdrew three. An addendum gives the collection's size as 722 mathematical results. The source does not explain the withdrawals or establish what the results mean for breaking encryption.
Wordfence says the collection includes LEAN proofs, mathematical arguments expressed in a form that software can check. Such checking can provide strong confidence that a conclusion follows logically from its stated assumptions. That is different from demonstrating that a result is a novel discovery or that it defeats a cryptographic system. The article describes frustration, anger and sadness among mathematicians, alongside exceptionally enthusiastic reactions, and points to a Hacker News discussion about AI's role in mathematics.
One striking statistic comes from a former OpenAI employee's post on X: the claim that 81% of all mathematical discoveries over the preceding three years appeared in that release. Wordfence repeats that claim but supplies no methodology or supporting accounting. It should therefore be treated as an attributed assertion, not an established measurement of mathematical progress. Similarly, the article cites a Johns Hopkins cryptographer's concern that public key cryptography could be lost, rather than evidence that this has already happened.
Why does this matter to website owners? Public key cryptography uses related public and private keys, mathematical values that help establish trust and protect communications without first sharing a secret. Its security depends on particular problems remaining impractical for an attacker to solve with available computing resources and mathematical methods. Wordfence describes that barrier in terms of several thousand years of work. That is the article's broad illustration, not a measured security lifetime for every website or cryptographic algorithm, meaning a mathematical procedure used to protect information.
The concern is about changes in mathematical knowledge as well as faster computers. A genuinely effective new method could make a previously impractical attack feasible. Secure web connections depend on cryptographic protections, so a serious weakness in widely used public key methods could threaten the confidentiality and authenticity of online transactions. Wordfence uses WooCommerce and Shopify stores to illustrate the stakes: businesses rely on customers being able to send credit card details and other payment tokens, substitutes for sensitive payment information, securely across a network. Its account of businesses stopping overnight is a hypothetical worst case, not a reported outage.
The article contrasts this possibility with preparations for quantum computing, a computing approach that could threaten some current cryptographic methods. It cites ML-KEM, the Module-Lattice-Based Key-Encapsulation Mechanism, a method for establishing shared secrets designed to resist quantum attacks. Wordfence's argument is that the anticipated quantum threat allowed time to develop alternatives, whereas unexpectedly rapid mathematical breakthroughs might leave much less time. It does not establish that ML-KEM has been weakened or that the newly released proofs undermine it.
Wordfence also places the warning in the context of its own security work. It says it is working with Mythos and cybersecurity-capable OpenAI and Anthropic models, comparing their abilities with human capabilities. According to Wordfence, its Argus system continues to find extremely severe vulnerabilities, software weaknesses attackers could exploit, with many undergoing confidential disclosure. That process gives affected developers an opportunity to address problems before details become public. Wordfence also says PRISM provides broad coverage of the WordPress plugin and theme ecosystem, the add-ons and designs used by WordPress sites. No individual flaws, affected versions or fixes are supplied in this account.
The article argues that objections to AI-generated mathematics will not stop competing developers. It names OpenAI, Anthropic, DeepSeek and Z.ai as companies working on mathematics and other difficult problems to demonstrate their models' capabilities. Wordfence proposes that AI might also help create stronger cryptographic algorithms if it can discover attacks against existing ones. This is a proposed response, not a demonstrated guarantee: replacement methods would still need validation before deployment.
Its most practical infrastructure recommendation is the ability to replace cryptographic algorithms quickly. Applications need a workable route for adopting validated alternatives, rather than depending indefinitely on a fixed mathematical method. For website owners who do not build those systems, Wordfence recommends following cybersecurity developments and checking daily for software and system updates. It acknowledges that some changes could arrive through ordinary updates, while a fundamentally different approach could require more work.
The addendum raises a separate, unconfirmed allegation. A bitcoin security researcher posting on X points to what they consider an unusually small share of cryptographic breakthroughs among the 722 results, claims first-hand experience of US government censorship of academic quantum cryptanalysis, meaning research into attacking cryptography using quantum methods, and suggests intervention could explain the absence. The supplied text provides no evidence that current algorithms have secretly been broken or that this release was censored. That speculation must not be mistaken for a security advisory.
Wordfence notes that its own ecommerce operations also depend on public key encryption and argues that a widespread failure would draw substantial resources and coordination toward a solution. It promises to keep its customers informed about necessary changes. For other site owners, the proportionate response is to keep software current, follow concrete notices from hosting and payment providers, and distinguish verified vulnerabilities from predictions. This article supplies a reason to maintain update readiness, not evidence that secure online payments have already failed.