The Post-Quantum Security Model Built for an Age of AI Agents

A Ground-Breaking Framework that Could Permanently Change How We Work with Cryptography in the Quantum Age On 5 September 2026, a proof appeared. It had been ninety years in the making. It answered one of the seven Millennium Prize Problems — the Navier–Stokes existence and smoothness problem, a question about whether the equations governing fluid flow can develop a singularity in finite time. Human mathematicians had not solved it. An AI system did. Not one model working alone. Roughly ten thousand agents running concurrently, exchanging nearly 2.7 million messages, burning through compute at a cost OpenAI’s own Chief Research Officer described as in the millions of dollars. Eighty-eight hours. Then GPT-6 Astra formalised the proof in Lean — a system that automatically verifies mathematical proofs step by step — in seventeen additional hours. OpenAI published the full result on 8 September 2026, framing it carefully as evidence still requiring mathematician review rather than a claim to the prize. Two human researchers, Tristan Buckmaster and Levent Alpöge, had concurrent work on the related forced Euler equations using an internal Anthropic model, and OpenAI recognised their priority. Science reported the full story, including the priority dispute that followed. The headline is not that AI is now smarter than human mathematicians. The headline is something quieter and far more dangerous. When you can define what a correct answer looks like, and you can afford enough parallel search, problems that resisted a century of human attention start to fall. This single statement has the potential to reshape the entire world. In cryptography, you either recover the key or you do not. You either decrypt the message or you do not. The verifier is a single function call, not a seventeen-hour Lean formalisation. And that field — cryptography — has always rested on one assumption about the nature of its attackers. That they are human. Scarce. Slow. Limited by which tools their training happened to give them. That assumption just expired. This article follows the trail from that expiry to its end. We will cover every algorithm you depend on, in plain English. We will cover the quantum machines that threaten them, with real numbers. We will cover what AI agents have already done to cryptanalysis. And then I will put an architecture on the table — my own, untested, offered to be broken. 1. What You Are Actually Trusting AI-generated by ChatGPT Every cryptographic system in use today rests on a bet. The bet is this: solving a specific mathematical problem is cheap if you know the secret, and impossibly expensive if you do not. Not impossible. Impossibly expensive. Human civilisation is built in the gap between those two words. There are two kinds of security, and you need to know both. Computational security means breaking the system costs more than any attacker can afford. RSA has it. AES has it. Every post-quantum standard has it. It is a claim about your attacker’s budget, not about the laws of physics. Information-theoretic security means breaking the system is impossible regardless of computation, because the ciphertext does not carry enough information to determine the message. Shannon proved this class exists in 1949. Almost nothing you use has it! The Algorithms, In Plain English RSA starts by multiplying two enormous primes. Multiplying takes milliseconds. Pulling the primes back apart from the product takes longer than the age of the universe with every classical technique we know. Encryption raises the message to a public exponent; decryption raises the result to a private one; they cancel each other out. The entire building stands on multiplication being a one-way street. Diffie–Hellman lets two strangers agree a shared secret over a wire everyone is listening to. Each raises a public base to a private number, sends the result, then raises the other’s result to their own private number. Both arrive at the same secret without it ever crossing the wire. The attacker must recover the private exponent from the public result — the Discrete Logarithm Problem — and that is the bet. Elliptic curves run the same bet on a better surface. Points on a cubic curve form a group under a geometric addition rule, and scalar multiplication — adding a point to itself many times — is fast. Running that equation backwards to find k from P and Q is the Elliptic Curve Discrete Logarithm Problem, and it is brutally slow classically. A 256-bit elliptic key matches a 3072-bit RSA key in classical security. Here is the trap. Against a quantum attacker, the smaller key is a liability, not an asset — it means fewer qubits required. Migrating from RSA to elliptic curves buys you nothing against quantum. Now, AES has no number-theoretic trapdoor at all. It is a substitution-permutation machine: swap bytes through a non-linear table, slide rows sideways, blend columns with matrix operations, XOR in a round key. Repeat ten to fourteen times. Every output bit has been influenced by every input bit many times over. There is no structure for a quantum algorithm to grab! Hash functions convert any input into a fixed-length fingerprint that cannot be reversed. SHA-2 chains message blocks through a running state; SHA-3 absorbs them into a large internal sponge and squeezes output from one part while keeping another part permanently hidden. Finding two inputs with the same fingerprint costs the square root of the full search space by the birthday paradox — which is why a 256-bit hash gives 128-bit collision resistance, not 256. Lattices Lattices underpin every post-quantum standard. Take a batch of linear equations about a secret, and slightly corrupt each one. Without the noise: schoolroom algebra, solved in seconds. With a small error baked into every equation: exponentially hard, as far as anyone knows. That is Learning With Errors. Oded Regev proved in 2005 that if the hardest lattice problems are hard in the worst case, then random LWE instances are hard on average. Read that guarantee carefully. It says if worst-case lattice problems are hard. It does not say they are. Nobody has proved that. Code-based schemes invert error correction. Given a corrupted codeword from a random-looking code, find the error pattern — syndrome decoding — and that is NP-hard. McEliece hides a secretly structured code inside what looks random and has survived forty-eight years without a structural break. Its flaw was always key size, not security. Hash-based signatures rest on nothing but the hash function. Build a Merkle tree over thousands of one-time signing keys and publish the root. Each signature reveals one key and a path of hashes proving it belongs under that root. SPHINCS+, standardised as SLH-DSA, is this family at production scale. No lattices. No codes. No number theory. If SHA-3 holds, SLH-DSA holds — and that is the most conservative security assumption in modern cryptography. The Clock That Is Already Running An adversary with storage captures traffic today and decrypts it when a capable machine arrives. The traffic does not need to be breakable now. It only needs to be stored now. So the question is not when quantum computers arrive. The question is how long your data must stay secret. Medical records need a lifetime. Diplomatic cables need thirty years. Industrial control systems carry code-signing keys as long as the devices stay deployed, and that can mean decades. NIST IR 8547 proposes deprecating quantum-vulnerable public-key algorithms after 2030 and disallowing them after 2035. If your secrecy lifetime exceeds the distance between today and a capable quantum computer, you are already exposed. Not in the future. Already! 2. The Quantum Arsenal, As It Actually Exists AI-generated by ChatGPT Shor’s algorithm is not really a factoring algorithm. It is a period-finding algorithm, and factoring falls out as a consequence. The key insight: raise a number to successive powers modulo the target, and the sequence eventually repeats. The period of that repetition hands you the factors through elementary number theory. Finding the period classically is as hard as factoring. A quantum computer evaluates the whole sequence simultaneously. Measuring one register collapses the other into a comb of values spaced exactly one period apart. The Quantum Fourier Transform converts that repeating comb into a sharp spike at its frequency — exactly as a Fourier transform converts a musical note into a frequency peak. Read the spike, run a continued-fraction expansion, recover the period, extract the factors. Cost: Roughly Polynomial in quantum gates for a n-bit number. The same algebra kills Diffie–Hellman and every elliptic curve scheme on the planet. On its first operational morning, a cryptographically relevant quantum computer does this. Recovers the private key behind any RSA-2048 certificate on the internet – piece of cake. Forges a signature on any ECDSA-signed firmware update ever shipped – easy. Decrypts the TLS sessions an adversary archived in 2019 – all in a day’s work. Empties every cryptocurrency wallet whose public key has touched a blockchain – done. That is the entire public-key infrastructure of human civilisation. In four lines. Grover’s algorithm is the symmetric-key threat, and it is far smaller. It searches an unstructured space of N items in roughly sqrt{N} steps, by iteratively amplifying the probability of the correct answer. Applied to key search: AES-128 drops to 2^64 effective security, and AES-256 drops to 2^128. Which stays out of reach forever at any realistic scale. Move symmetric keys to 256 bits, move hash outputs to 384 bits. That decision is cheap and it is finished. Regev’s 2023 improvement cut Shor’s gate count using multi-dimensional period finding, as documented in this comparison of quantum attacks on asymmetric cryptography. It arrived with two problems: higher qubit requirements, and an unproven number-theoretic assumption. Both were resolved within two years. Space-efficient quantum factoring brought qubit requirements back down, and unconditional correctness proofs removed the unproven conjecture entirely. Shor’s complexity stood unimproved for twenty-nine years, then moved, then the follow-up fixed both flaws almost immediately. The Resource Question, Honestly In 2019, Gidney and Ekerå put the resource cost of factoring RSA-2048 at twenty million noisy qubits running for eight hours. In May 2025, Craig Gidney revised that to under one million noisy qubits in under a week — a twenty-fold hardware reduction. He is direct about his own limits: no way to cut another order of magnitude under the same assumptions. He then cites the cryptographer’s proverb that attacks always get better, and endorses the NIST timeline. 2026 work on factoring RSA with neutral-atom processors continues pushing the numbers further. The sober reality: public quantum hardware today sits in the hundreds to low thousands of physical qubits, with error rates that demand enormous overhead per reliable logical qubit. The gap to a million clean qubits is years of engineering nobody has demonstrated. Your RSA keys are not being factored this quarter. But your data is being archived this quarter. And the estimate has fallen twenty-fold in six years. 3. The Agent Cryptanalysts AI-generated by ChatGPTNow we follow the trail. Navier–Stokes was not a model being clever in the sense we usually mean. It was ten thousand agents searching a structured space in parallel, with an automated verifier scoring every candidate, running without rest for eighty-eight hours. That architecture is not specific to fluid dynamics. It is specific to any problem where you can generate candidates and check them cheaply. It Has Already Beaten Human Cryptanalysis On A Real Cipher At CRYPTO 2019, Aron Gohr published improved attacks on Speck32/64 using deep learning. He trained neural networks to distinguish ciphertext pairs with a known structural difference from random pairs. The networks cut the effective security of an eleven-round cipher to about thirty-eight bits. Two findings were not incremental. The networks detected features invisible to any purely differential distinguisher, even with unlimited data. The machine was not doing human cryptanalysis faster — it was seeing something human cryptanalysis had never defined. And the networks found useful input differences within minutes, with no prior human analysis to guide them. Enhanced follow-up work pushed to thirteen-round attacks. It Has Already Beaten Human Mathematics On Constructions DeepMind’s AlphaEvolve evolves programs by having language models propose code edits, scored by automated evaluators, refined evolutionarily. It found a way to multiply two four-by-four complex matrices in forty-six scalar multiplications — the first improvement on Strassen’s 1969 algorithm after fifty-six years. Pointed at more than fifty open problems in analysis, geometry, combinatorics and number theory, it beat the best known construction on about twenty percent of them. One in five. Starting from random or trivial constructions. Cryptanalysis is a search for constructions — input differences, linear approximations, lattice reduction strategies, algebraic relations. It is precisely the shape of problem this architecture was built for. It Has Already Broken Implementations At Industrial Scale Most real cryptographic failures are not mathematical breaks. They are timing side channels, padding oracles, reused nonces, weak randomness, and memory corruption in the parsing layer. In April 2026, Anthropic launched Project Glasswing — roughly fifty partner organisations given gated access to Claude Mythos Preview, a model that autonomously finds zero-day vulnerabilities and demonstrates exploitability. Within about a month, the coalition had discovered over ten thousand high-severity or critical vulnerabilities in the world’s most important software. On 3 September 2026, OpenAI released GPT-6 Astra with cybersecurity guardrails mandatory for the consumer version. The company stated that without production safeguards the model could achieve arbitrary code execution in hardened browsers and build privilege-escalation exploits for hardened operating systems. That is a major laboratory confirming publicly that its shipping model carries offensive capability it must deliberately suppress. 4. Following The Trail: Post-Quantum Is On The Same Shelf AI-generated by ChatGPT On 13 August 2024, NIST finalised three post-quantum standards at the end of an eight-year process. ML-KEM for key establishment, ML-DSA for digital signatures — both on Module-LWE. SLH-DSA for signatures, resting on hash properties alone. FALCON followed. In March 2025, NIST added HQC as a code-based backup key encapsulation mechanism — deliberately chosen because it shares no mathematical foundation with ML-KEM. That choice is the smartest thing in the entire standardisation process. But - read on, because necessary and sufficient are different things. SIKE I opened this article with Navier–Stokes. I need to spend time here with SIKE, because it is the more instructive story. Supersingular Isogeny Key Encapsulation was a NIST Round 4 alternate. Elegant mathematics. Tiny keys — under 600 bytes at strong security levels. Five years of scrutiny by hundreds of the best cryptographers alive. On 30 July 2022, Wouter Castryck and Thomas Decru published an efficient key recovery attack on SIDH. Their program recovered a private key in about ten minutes on a single processor core. No quantum computer. A laptop. The SIKE team’s own withdrawal note states simply that the scheme is insecure and should not be used. The attack used Kani’s theorem — a result from 1997, sitting openly in the algebraic geometry literature — which the cryptography community had simply never looked at. Castryck and Decru came from algebraic geometry. They walked in carrying a tool no one in the room was holding. Now ask the real question. What exactly makes you confident that cannot happen to Module-LWE? Not what makes you hope. What makes you confident. The honest answer: we have no proof, only the absence of a discovered attack. That is precisely what SIKE had, right up until the morning it did not. If I had an algorithm to break Lattice-Based Cryptography – I would keep quiet – And keep the decryption algorithm secret for as long as possible. I would even say that that could have happened even now. Which is why all the AI Labs need to throw all their compute at this problem. 100,000 AI Agents spending 100 hours cracking lattice-based cryptography without success would give me more confidence than any amount of human verification. That’s just the honest truth. The Hybrid Quantum Angle In December 2022, Yan and colleagues published a hybrid quantum-classical factoring method, using a quantum optimiser on top of Schnorr’s lattice-based factoring approach. They claimed RSA-2048 might fall to 372 qubits. Note the irony: an attack on RSA built entirely from lattice machinery — the same family we just standardised as RSA’s replacement. The claim did not hold. An independent reimplementation showed the method fails beyond roughly eighty bits even with a perfect optimiser. A separate analysis found the resource estimates unsupported. Schneier’s verdict was brief: if it depends on a Schnorr technique that does not scale, it does not scale. But read the final paragraph of that same critique. The authors allowed that quantum acceleration may yet give rise to genuinely novel cryptanalytic methods, possibly easier to implement than the known ones. Nobody quoted that part. The Conjecture, Stated As A Conjecture Here is where the trail ends, and I want to flag clearly that this is speculation, not fact. No attack on ML-KEM exists today. Not one. But consider what the search has looked like until now. A small number of human researchers, hand-designing a small number of circuit templates, over a handful of years. Now replace that with the Navier–Stokes architecture. Ten thousand agents, generating candidate attacks against lattice instances with known answers, automatically scored, running for eighty-eight hours at a cost of a few million dollars. Against a target where correctness is verified in a single function call, not a seventeen-hour Lean proof. Is there exploitable quantum structure hiding inside Module-LWE, or syndrome decoding, or the isogeny graphs? Nobody knows. And “nobody has found it” and “it is not there” are different statements. SIKE taught us that. My argument is not that lattices are broken. My argument is about exposure. When the cost of systematically searching an attack space collapses, the probability that an undiscovered attack stays undiscovered collapses with it. Exposure, rather than certainty, is what engineering decisions must be made on. 5. PACS — Publicly Adaptable Cryptographic Systems - The Core Framework I have coined a term for what I believe must come next. PACS — Publicly Adaptable Cryptographic Systems. Two warnings, in bold. This is my own proposal, unreviewed, and nothing here should go near production. PACS is not a new hard problem, and that is the whole point. Every generation has responded to a broken assumption by searching for a harder one. Factoring weakens, move to elliptic curves. Elliptic curves are threatened, move to lattices. Lattices look worrying, move to isogenies. Then SIKE died on a laptop in ten minutes. We keep replacing the bet. I am arguing we should stop betting the world on a single table. Four layers. Twelve mechanisms. Every cost named. Layer One — Composition Mechanism 1: The Assumption Independence Graph. Run several mathematically unrelated key exchanges in parallel, blend their outputs through a key derivation function bound to the transcript. An attacker who breaks one learns nothing — the blend still contains randomness she cannot predict. Today’s hybrid deployments are the two-component version. Here is the part that does not yet exist. Choosing components by name is insufficient, because two schemes can look different and share a hidden mathematical ancestor. So build a public graph where every node is a hardness assumption and every edge represents a known reduction, shared structure, or attack technique applicable to both endpoints. Lattice problems and Schnorr-style factoring share an edge — both reduce to finding short vectors. Isogeny problems and dihedral hidden-subgroup problems share an edge — Kuperberg’s algorithm runs on both. Hash-based signatures sit almost isolated, connected to almost nothing. The selection rule becomes formal: a valid component set must be an independent set in that graph. Adding a new edge automatically invalidates every deployed configuration that assumed independence between those nodes, triggering reconfiguration. We currently pick hybrid partners by intuition. Intuition is exactly what failed on SIKE. Cost: the graph has no natural owner, and drawing an edge is a contested judgement call. But it adds complexity – we have multiple gatekeepers, not one. Mechanism 2: One Verified Arithmetic Core. Four components mean four implementations and four times the bugs — a fatal objection unless answered directly. Answer it below the design layer. Every component must be expressed over one shared, formally verified core: modular arithmetic, polynomial operations, constant-time comparison, sampling, memory handling. Components then differ in how they compose those verified primitives, not in maintaining separate copies of everything underneath. Implementation risk scales with distinct compositions, not distinct schemes. That is what makes Mechanism 1 affordable. Cost: formal verification is slow and expensive, and a bug in the shared core is a bug in everything simultaneously. Layer Two — The Unconditional Floor Mechanism 3: Tiering By Secrecy Lifetime. Secrecy lifetime, not sensitivity label, determines which tier a dataset belongs in. Under one year: hybrid computational security is entirely sufficient. One to ten years: add aggressive rotation and short epochs. Beyond ten years: require an unconditional component — pre-distributed one-time key material, QKD where topology permits, or threshold sharing across independent custodians. The discipline is not technical. It is forcing an organisation to state in writing how long each class of data must stay secret. Most have never done that exercise, and it is worth more than the cryptography that follows. Cost: unconditional security consumes key material proportionally to message volume, so this tier stays small. Mechanism 4: Jurisdictional Threshold Custody. Some keys are not broken by mathematics. They are handed over — by subpoena, seizure, or a single insider with sufficient access. Split the trust root across custodians independent in three dimensions simultaneously. Legally independent, under non-cooperating jurisdictions. Organisationally independent: no shared ownership, staff, or auditor. Technically independent: different hardware and software stacks, so one supply-chain compromise cannot reach a quorum. Cost: slow, politically difficult, and makes legitimate emergency access genuinely hard – which makes decryption hard as well! Layer Three — Motion Mechanism 5: Expiry Inside The Algorithm. Every algorithm identifier carries an expiry epoch as part of its specification, not external policy. An endpoint refuses an expired suite automatically — no human decision, no configuration flag to disable it. Obsolete cryptography cannot silently persist in a forgotten device for fifteen years, because the device stops speaking rather than continuing to speak badly. Cost: unglamorous, engineering-heavy, produces no visible feature. Mechanism 6: Epoch Budgeting. Ephemeral keys per session are the floor, not the ceiling. Rekey mid-session on time or data volume, whichever comes first. Long-term keys authenticate and establish — they never encrypt bulk data. An adversary who eventually breaks one epoch key recovers one epoch, not an archive. Cost: modest. Best benefit-to-difficulty ratio in the architecture. Mechanism 7: Adaptive Parameter Inflation. Parameters chosen once decay silently as attacks improve over the deployment’s lifetime. PACS inverts the direction: parameters ratchet upward automatically on a published schedule, one-directionally. A deployment configured in 2027 and never touched should be running stronger parameters in 2032 than on day one. Not weaker. Stronger. Cost: performance degrades gradually by design — capacity planning must account for it from the start. Upgrade encryption automatically as time goes by. This is obvious – so why are we hunting for more algorithms instead of implementing this? Mechanism 8: Continuous Re-Encryption Of Archives. Harvest-now-decrypt-later works because stored ciphertext is frozen at the moment it was written. For data already captured: nothing can be done. For data you still hold: re-encrypt it under current suites on a rolling background schedule. Your archive’s cryptographic age is then bounded by your rotation period, not by the year the data was written. Cost: heavy input-output load and a risk that a pipeline bug damages data that was previously safe. But the cheapest way to defend against HNDL (Harvest Now, Decrypt Later). Mechanism 9: The Break-Glass Degradation Path. When a component is declared broken, what happens next must already be written, tested, and rehearsed. Not planned. Rehearsed. The broken component is excluded from the combiner on a signed revocation, renegotiation cannot reintroduce it, remaining components carry traffic without outage, and the system announces its degraded state loudly. An untested failover is not a failover. It is a hope. Cost: real engineering work that produces no visible feature and is perpetually underfunded. Layer Four — Public Measurement Mechanism 10: Continuous Open Adversarial Evaluation. Kerckhoffs’s principle says the algorithm must be public. I am arguing that the entire lifecycle must be public. A permanent, funded, running evaluation: an agent swarm of the kind that solved Navier–Stokes pointed at live deployed parameter sets, publishing findings on a fixed schedule. Defenders must hold that capability first. Glasswing is the proof-of-concept: ten thousand critical vulnerabilities in a month. Cost: governance, and it is genuinely unsolved — especially when findings outpace patch cycles, which Glasswing has already shown they will. This is difficult and expensive – but the only way forward. Mechanism 11: Erosion Telemetry. Cryptographic strength today is a static number in a table that never changes regardless of what happens in the literature. Measure it live instead. Compute an erosion metric per parameter set: how much automated adversarial search has it survived, how fast is its best-known-attack complexity falling, how many new edges have appeared around it in the assumption graph. Publish it continuously, feed it into protocol negotiation, so endpoints trade on current measured margin rather than a table written years ago. Crossing a threshold automatically schedules the ratchet in Mechanism 7 and eventually the expiry in Mechanism 5. That closes the loop and makes the whole architecture a control system rather than a configuration. Cost: a badly designed metric creates confident wrong decisions at scale — worse than no metric at all. But with suitable metrics – a game-changer. Mechanism 12: Proof-Carrying Negotiation. Endpoints exchange machine-checkable statements about which assumptions and parameters are active, signed into the handshake transcript. Downgrade becomes detectable rather than silent — critical in a system designed for continuous rotation, where more versions are in flight simultaneously. A policy should be expressible as “at least one unconditional component, plus two computational components with no edge between them in the graph,” and verified mechanically. Cost: a policy parser is itself a potential attack surface, and must be verified with the same rigour as the arithmetic core. Again, obvious, expensive, but necessary. The Whole Thing In One Paragraph Run several mathematically unrelated schemes at once, chosen by a public graph rather than intuition, all on one verified arithmetic core. Keep an unconditional layer under data that outlives its algorithms, with the trust root split across custodians no single legal instrument can compel together. Keep everything moving — expiry inside the algorithms, parameters ratcheting upward, archives re-encrypting themselves forward, a rehearsed path for losing any component without outage. Measure the whole system continuously in public with agents, and feed what you learn straight back into the configuration. 6. The Ledger, And The Case For Making This The Default AI-generated by ChatGPT Here are both pros and cons. The Case For A broken component degrades the system rather than ending it — graceful failure rather than catastrophic failure. Routine rotation converts a future break from a crisis into a scheduled operation. Three simultaneous attacks on harvest-now-decrypt-later:short epochs limit what any captured key unlockscontinuous re-encryption stops archives freezing in the year they were writtenthe unconditional floor protects data that cannot afford to depend on a solvable problem. The assumption graph makes hybrid selection formal rather than intuitive, which is the one improvement that directly addresses the SIKE failure mode. Security margin becomes a live measured quantity rather than a claim — a transition every other engineering discipline has already made. Most of Layers One through Three require integration and organisational will, not new invention. Hybrid combiners, verified cores, threshold custody, and transparency logs all exist. The Case Against Performance costs compound: four components mean four key exchanges, and automatic parameter inflation grows that cost every year by design. For latency-critical or power-constrained environments this may be unaffordable, and I will not pretend otherwise. Complexity is itself an attack surface, and some of the worst cryptographic failures in history were composition failures, not primitive failures. No governance model exists for the assumption graph or continuous evaluation, and I cannot design one from an engineering chair. Erosion telemetry done badly produces confident wrong decisions — more dangerous than no telemetry. Continuous re-encryption is a data-integrity risk for any organisation that cannot reliably restore from backup. The unconditional floor is expensive, has hard physical limits, and stays small. And the honest one: PACS has not been peer-reviewed, formally specified, or implemented anywhere. I am a practitioner arguing an architecture, not a cryptographer presenting a proof. Treat every mechanism as a hypothesis awaiting attack — which is exactly what the architecture demands of everything else. Why This Should Be The Future Of Post-Quantum Cryptography The current strategy (SIKE) has already failed, in public, at the most visible possible moment. So ask the question that matters. What makes you confident the same thing cannot happen to Module-LWE? The honest answer every serious cryptographer gives: the absence of a discovered attack. That is precisely what SIKE had. Every confidence interval we have about scheme survival was calibrated on human cryptanalysts. Human cryptanalysts are brilliant, scarce, slow, and limited by which tools their training happened to give them. Castryck and Decru broke SIKE because they came from algebraic geometry carrying a tool nobody in the room had been holding. That is a story about the scarcity of human attention. An agent swarm has no field, no specialisation, and does not get tired. Our calibration was for a world that ended sometime around 8 September 2026. Adding one harder problem does not fix this. Every new assumption starts with the least scrutiny and the highest risk, and that is exactly when we rush it into deployment. PACS stands on several assumptions at once and requires the attacker to break all of them simultaneously. And it is the only approach whose security improves over time. A conventional deployment decays as attacks improve and nothing in the system notices. A PACS deployment ratchets upward, re-encrypts forward, and reconfigures when the graph changes. Conventional cryptography decays by default. PACS strengthens by default. NIST already saw part of this. Choosing HQC specifically because it is code-based is assumption diversity. Supporting hybrid through the transition is composition. Standardising SLH-DSA on the most conservative assumption available is an unconditional-leaning hedge. The instinct is correct. The mistake is calling it transitional — something to retire once post-quantum is trusted. It should be permanent architecture. Hybrid should never end. The transition should never finish, because finishing is what leaves you frozen, waiting for the next SIKE. And finishing was what enabled Harvest Now, Decrypt Later (HNDL) in the first place. 7. Conclusion AI-generated by ChatGPT Ten thousand agents. Eighty-eight hours. Ninety years of mathematics. Carry that number out of this article, because the system that produced it does not care what problem you point it at. And I am not going to leave you in the dark, because that is not where this trail actually ends. The same capability that finds the attack finds the flaw. Nearly every breach in the last decade had nothing to do with breaking AES. It was a buffer overflow, a leaked credential, a misconfigured bucket, an unpatched dependency. The mathematics was almost never the weak point — it was the strongest part of the system by an enormous margin. The agent swarm that found Navier–Stokes is the same architecture that found ten thousand critical vulnerabilities in a month. For the first time in this field’s history, defenders can afford the same exhaustiveness as attackers. Not the same intent. The same exhaustiveness. A defender has never before been able to check every path. Now a defender can. If we build the tooling first – If we hand it to defenders first, as Glasswing did – If we fund the unglamorous rotation work, not just the exciting mathematics – If we keep the adaptation loop open and public rather than classified – Then the agent era becomes the era software finally gets secure, not the era secrecy ends. Those are choices. Every one of them can go the other way. But they are choices, and they are not physics. So stop looking for the next hard problem. Diversify the assumptions, chosen by a public graph rather than intuition. Keep an unconditional floor under what outlives its algorithms. Build expiry into the algorithms themselves. Let the parameters ratchet upward while you sleep. Re-encrypt the archive so nothing freezes in the year it was written. Rehearse losing a component until it is boring. Measure the erosion in public, with machines, forever. And concretely, this week: inventory every place in your estate where a cryptographic algorithm is named, and count how many you could change without a firmware release. That number, not your ML-KEM rollout date, is your real quantum readiness score. The secrets worth keeping have never been kept by mathematics alone. They are kept by people who understood what they were trusting, and why, and for how long. Go and be one of those people. All of the very best to you. Cheers! References OpenAI on the Navier–Stokes Millennium Prize Problem — https://openai.com/index/navier-stokes-solution/ Science on the AI math breakthrough and the priority dispute — https://www.science.org/content/article/how-ai-math-breakthrough-ignited-controversy Axios on the Navier–Stokes claim and credit controversy — https://www.axios.com/2026/09/08/openai-math-solution-navier-stokes-credit NIST approves the first post-quantum FIPS standards — https://csrc.nist.gov/news/2024/postquantum-cryptography-fips-approved NIST releases three finalized post-quantum encryption standards — https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards NIST IR 8547, transition to post-quantum cryptography standards — https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8547.ipd.pdf NIST standardization process and the HQC selection — https://en.wikipedia.org/wiki/NIST_Post-Quantum_Cryptography_Standardization Factoring 2048-bit RSA with under a million noisy qubits — https://arxiv.org/abs/2505.15917 Factoring RSA with a neutral-atom modular processor — https://arxiv.org/pdf/2605.03951 Comparison of state-of-the-art quantum attacks on asymmetric cryptography — https://arxiv.org/pdf/2405.14381 Space-efficient and noise-robust quantum factoring — https://eprint.iacr.org/2023/1501 Unconditional correctness of recent quantum factoring algorithms — https://arxiv.org/html/2404.16450 An efficient key recovery attack on SIDH — https://eprint.iacr.org/2022/975 SIKE team note declaring the scheme insecure — https://csrc.nist.gov/csrc/media/Projects/post-quantum-cryptography/documents/round-4/submissions/sike-team-note-insecure.pdf Improving attacks on round-reduced Speck32/64 using deep learning — https://eprint.iacr.org/2019/037 Enhancing differential-neural cryptanalysis — https://eprint.iacr.org/2021/719 AlphaEvolve, a coding agent for algorithmic discovery — https://arxiv.org/abs/2506.13131 DeepMind’s announcement of AlphaEvolve — https://deepmind.google/blog/alphaevolve-a-gemini-powered-coding-agent-for-designing-advanced-algorithms/ Project Glasswing programme page — https://www.anthropic.com/project/glasswing Anthropic’s initial update on Project Glasswing — https://www.anthropic.com/research/glasswing-initial-update OpenAI rolls out GPT-6 Astra with cybersecurity guardrails — https://news.bgov.com/artificial-intelligence/openai-rolls-out-gpt-6-astra-model-with-cyber-guardrails-1 What OpenAI has and has not confirmed about GPT-7 — https://www.pluralsight.com/resources/blog/ai-and-data/gpt-7 Factoring integers with sublinear resources on a superconducting processor — https://arxiv.org/pdf/2212.12372 Pitfalls of the sublinear QAOA-based factorization algorithm — https://arxiv.org/pdf/2303.04656 Independent reimplementation refuting the sublinear factoring claims — https://arxiv.org/abs/2307.09651 Schneier on breaking RSA with a quantum computer — https://www.schneier.com/blog/archives/2023/01/breaking-rsa-with-a-quantum-computer.html NSA frequently asked questions on quantum computing and QKD — https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Quantum_FAQs_20210804.PDF All Images in this Article were AI-generated by GPT-Images-2.5 The First Draft of this Article was AI-generated by Opus 5 and Sonnet 4.6. Thomas Cherickal is an Emerging Technologies Educator, acting as a Generative AI Consultant and a Quantum Computing Consultant based in Chennai, India, available for work globally, on a remote and asynchronous basis. He has 500+ published articles across 10+ platforms covering AI, agentic systems, quantum computing, LLMs, Local AI, Quantum AI, and other emerging technologies, for which he acts as a consultant. Skilled in Python, Golang, Rust, and Mojo. Find his work at thomascherickal.com and thomascherickal.github.io. Let's Work Together Thomas writes for power users, developers, enterprises, and executive audiences on AI agent orchestration, enterprise AI deployment, local LLM deployment, quantum computing training and content, and emerging technology. Available for technology writing engagements, technology training, and AI/quantum upskilling sessions for individuals, teams, and enterprises. Technical Writing — deep, sourced, developer-grade long-form content AI Consulting for Content Strategy — helping teams communicate complex Generative AI systems clearly Quantum Consulting for Content Strategy — helping teams communicate complex quantum computing systems clearly CXO-Level AI/Quantum Briefings — cutting through the hype for decision-makers and executives Connect on linkedin.com/in/thomascherickal for a free introductory chat. Find Me On 📰 HackerNoon ✍️ Medium 💻 Hashnode 📬 Substack 🐙 GitHub 🏋️ Exercism ⭕ Code 360 🥷 CodeWars 💼 LinkedIn 🌲 Linktree 💡 LeetCode 🏆 HackerRank 📄 HubPages 🧠 Deep-ML 🏅 CodersRank 🌍 HackerEarth ❓ Quora 🤖 Reddit 📬 Newsletter Emerging tech, explained properly — thomascherickal.kit.com Work With Me 🗓️ 1-on-1 Consults 🛒 Digital Products & Playbooks 📚 Exclusive Member Content topmate.io/thomascherickal thomascherickal.gumroad.com patreon.com/thomascherickal © 2026 Thomas Cherickal · The Digital Futurist · thomascherickal.com · Chennai, India 🇮🇳