An open letter to Dominic Williams and the Internet Computer community
I want to respectfully challenge the suggestion that growing concerns about AI, mathematical discovery and cryptography are little more than venture-capital narrative-chasing or crypto projects searching for their next marketing opportunity.
There is, of course, no shortage of hype in this industry. Projects exaggerate threats, promote fashionable narratives and attempt to turn uncertainty into commercial advantage. That deserves scrutiny.
But the existence of hype does not invalidate the underlying risk.
The question is not whether AI-related cryptographic fears can be exploited for marketing. It is whether the accelerating capabilities of frontier AI systems could fundamentally change how quickly we discover weaknesses in the mathematical assumptions underpinning modern digital security.
That is a question worthy of serious technical investigation, not dismissal.
The distinction matters particularly for the Internet Computer, whose architecture relies on sophisticated cryptographic mechanisms to support threshold signatures, distributed trust and secure computation.
1. The significance of what frontier AI is beginning to achieve
On October 6, 2026, OpenAI published a collection of 722 mathematical manuscripts covering 372 families of results, generated using an unreleased internal frontier model. The company reported an average of approximately three hours of ChatGPT Pro-equivalent reasoning compute per result. The work represents a significant development in AI-assisted mathematical research, although its full implications remain subject to independent evaluation.
The important question is not simply how many problems were solved. It is what increasingly capable systems might eventually discover, and how rapidly those discoveries could emerge.
In a separate reported demonstration, an engineer used GPT-6 Astra to decipher a military message that had remained unread for approximately 217 years. The exercise combined image interpretation, historical research and cryptanalysis, including the discovery of a previously documented partial code table.
That achievement is impressive, but it must be interpreted accurately: a historical cipher is not equivalent to modern elliptic-curve cryptography, and this demonstration does not establish that contemporary public-key systems can be broken.
Nevertheless, these developments illustrate a broader possibility. AI systems are increasingly capable of combining reasoning, coding, research and experimentation into workflows that previously required substantial human effort.
The cryptographic community should be asking what happens when those capabilities are applied systematically to the mathematical foundations of digital security.
We should not confuse the absence of a demonstrated attack with proof that future attacks are impossible. Nor should we confuse an emerging possibility with an established vulnerability.
Both distinctions are essential.
2. The potential threat is not limited to quantum computing
Much of the public discussion about cryptographic risk has centred on quantum computers.
For elliptic-curve cryptography, including ECDSA, sufficiently powerful fault-tolerant quantum computers running Shor’s algorithm could solve the relevant discrete-logarithm problem and undermine the security of existing keys.
But quantum computing is not the only conceivable source of a cryptographic breakthrough.
Modern public-key cryptography depends on mathematical problems believed to be computationally infeasible to solve at relevant security parameters. The security of elliptic-curve systems, for example, relies on the difficulty of recovering a private scalar from its corresponding public point.
If researchers discovered a previously unknown classical algorithm that solved this problem efficiently, the consequences could be severe. Such an algorithm would not need a quantum computer. It could potentially run on conventional computing hardware.
This remains a hypothetical scenario, not a demonstrated capability of today’s AI systems.
Nevertheless, the possibility has been raised publicly by Ethereum Foundation researcher Justin Drake, who has called for the industry to prepare for a potential AI-driven threat to existing cryptographic assumptions. His warning is a call for contingency planning, not evidence that ECDSA has already been broken.
The central issue is therefore not whether AI can magically bypass mathematics. It is whether AI can accelerate the discovery of mathematical structures, algorithms or implementation weaknesses that humans have not yet identified.
That possibility deserves rigorous examination.
3. The consequences would extend far beyond cryptocurrency
Public-key cryptography is foundational to the security of modern digital infrastructure.
Elliptic-curve systems and RSA are used across digital signatures, secure communications, authentication, financial infrastructure and software distribution. Cryptographic mechanisms also protect the confidentiality and integrity of sensitive information throughout government, healthcare and enterprise systems.
A practical breakthrough against a widely deployed cryptographic primitive could therefore have consequences extending well beyond Bitcoin, Ethereum or the Internet Computer.
The impact would depend on the precise vulnerability discovered. An attack against a signature scheme would not automatically defeat every encryption system, hash function or secure communication protocol. Nor would every system become vulnerable in the same way.
But if a widely deployed mathematical assumption were fundamentally undermined, the resulting challenge could become a global infrastructure problem.
This is why the discussion should not be reduced to token prices, investment narratives or competitive positioning between blockchain ecosystems.
The underlying issue is the resilience of the digital trust infrastructure on which the wider economy depends.
4. Post-quantum cryptography is necessary preparation, not a guarantee against every future threat
There is another important distinction that the industry must confront.
Post-quantum cryptography is designed to withstand attacks from quantum computers of relevant capabilities. It does not automatically guarantee immunity from every future mathematical discovery, AI-assisted attack or implementation vulnerability.
Consider lattice-based cryptography, including the mathematical foundations associated with CRYSTALS-Kyber, now standardised as ML-KEM.
Researchers have demonstrated deep-learning-assisted side-channel attacks against particular Kyber implementations. These attacks exploit information leaked through physical behaviour, such as power consumption, rather than establishing a general mathematical break of the underlying cryptographic scheme.
That distinction is crucial.
It demonstrates why security depends on more than choosing an algorithm with a strong mathematical foundation. Implementation quality, hardware behaviour, key management, operational controls and resistance to side-channel leakage all matter.
The same principle applies to AI.
More capable AI could become a powerful tool for discovering weaknesses in cryptographic implementations, identifying subtle coding errors, testing mathematical assumptions and automating adversarial analysis.
It could also help defenders discover and correct vulnerabilities before attackers exploit them.
The objective should not be to abandon established cryptography in favour of unproven alternatives. Rushed migrations can create their own vulnerabilities, while new cryptographic designs require extensive scrutiny.
The objective should be to accelerate rigorous evaluation, preserve the ability to change cryptographic mechanisms and ensure that security assumptions remain justified by evidence.
5. Why the Internet Computer should take a leading role
The Internet Computer has invested in sophisticated cryptographic infrastructure, including Chain Key cryptography, threshold ECDSA, threshold Schnorr and vetKeys.
These mechanisms serve different purposes, and their individual security properties must be evaluated separately. Threshold cryptography can reduce dependence on a single signing key, but it does not automatically eliminate the underlying mathematical assumptions of the signature scheme being used.
This creates an opportunity for DFINITY and the wider ICP ecosystem to demonstrate leadership.
Rather than treating AI-driven cryptographic risk primarily as a marketing narrative, the ecosystem could establish a structured programme to investigate it.
That programme should include:
- AI-assisted cryptanalysis: Independently test whether frontier models can discover meaningful improvements against the mathematical assumptions used by ICP’s cryptographic primitives.
- Threshold-system security: Examine distributed key generation, signing protocols, implementation details and the consequences of potential primitive-level weaknesses.
- Side-channel resilience: Evaluate whether AI-assisted analysis can extract secrets from practical implementations through timing, power consumption, memory behaviour or other leakage.
- Post-quantum readiness: Assess which components require migration planning, which alternatives are appropriate, and how hybrid approaches could reduce transition risk.
- Cryptographic agility: Design systems that can replace vulnerable primitives without requiring disruptive architectural changes or exposing users to unnecessary migration risks.
- Independent verification: Publish reproducible findings, commission external cryptographic reviews and distinguish demonstrated vulnerabilities from theoretical scenarios.
Such a programme would not require DFINITY to endorse the claim that modern cryptography is about to collapse. It would require the organisation to recognise that rapidly improving AI changes the tools available to both attackers and defenders.
That is a much stronger technical position than either complacency or alarmism.
6. The right response is neither panic nor dismissal
There is no credible basis for telling users that modern elliptic-curve cryptography has already been defeated by AI. There is equally little value in assuming that today’s security assumptions will remain beyond challenge simply because they have survived decades of research.
The responsible position lies between those extremes.
Cryptography is built on mathematical assumptions, rigorous analysis and practical engineering. Confidence in those systems comes from sustained scrutiny, not from declarations that they are invulnerable.
AI may substantially accelerate that scrutiny. It may reveal new weaknesses. It may also help us strengthen the systems on which we depend.
We do not yet know the full extent of either outcome.
What we can do is prepare: test aggressively, publish evidence, improve implementations, develop migration strategies and ensure that critical infrastructure can adapt when the evidence changes.
For an ecosystem that aims to provide secure, sovereign digital infrastructure, this is not a peripheral concern. It is directly relevant to long-term resilience.
Conclusion: Lead the investigation, not the narrative
Dominic, I agree that the crypto industry should be sceptical of opportunistic marketing and exaggerated claims. But scepticism must apply in both directions.
We should challenge unsupported predictions of imminent cryptographic collapse. We should also challenge the assumption that emerging risks can be dismissed simply because they have become fashionable in investment discussions.
The recent advances in AI-assisted mathematics do not prove that elliptic-curve cryptography is broken. They do, however, justify serious questions about the pace at which mathematical assumptions can be tested, challenged and potentially overturned.
The opportunity for DFINITY is to turn that uncertainty into a programme of measurable technical leadership.
The Internet Computer should help establish what AI-assisted cryptanalysis can actually achieve, where current implementations are vulnerable, which mathematical assumptions remain robust, and how cryptographic systems can evolve safely as AI capabilities advance.
Not because a collapse is inevitable.
Not because a new marketing narrative is needed.
But because the security of sovereign digital infrastructure should never depend on assuming that yesterday’s limits on mathematical discovery will remain tomorrow’s limits.
The strongest response to uncertainty is not panic. It is preparation, evidence and engineering.
That is the standard to which the Internet Computer should hold itself up to.
(upload://pvsBrUMiwXulqXm6U6YKIJMBZcK.jpeg)
