GPT-6 Astra Autonomously Cracked an Unbroken 1941 Enigma Message
Given only a loose goal, OpenAI's GPT-6 Astra picked its own target from an archive of unsolved WWII Enigma traffic, wrote its own cryptanalysis tooling, and broke it — a capability signal AI security teams should take seriously, even though the cipher itself was never the hard part.
Key Takeaways
- Researcher Carter Leffer asked OpenAI's GPT-6 Astra to try breaking any unsolved WWII Enigma message on the Crypto Cellar Research archive — the model picked its own target, wrote its own cryptanalysis code, and solved it without further direction.
- GPT-6 Astra broke message Nr. 172 ("MVUEH"), unresolved since 2005, by spotting a link to a related decrypted message and independently building an Enigma simulator plus a Bombe-style search in Python and C++.
- Days later, Anthropic's Claude Opus 5 independently broke a separate unsolved 1941 message from the same archive, suggesting autonomous scoping-and-tool-building is a shared frontier-model capability, not a one-off.
- The underlying cryptanalysis is classic known-plaintext attack against a weak, tiny-keyspace cipher — genuinely notable for the autonomy involved, not evidence that modern encryption is at risk.
An 85-year-old cipher, cracked without a script
Security researcher Bruce Schneier wrote about an unusual milestone this month: researcher Carter Leffer pointed OpenAI's GPT-6 Astra at Crypto Cellar Research, a long-running archive of German Army Enigma traffic that has resisted decryption for decades, and simply asked it to see what it could do. Leffer didn't pick a target message or specify a method. The model did both on its own.
What the model actually did
According to Crypto Cellar Research's own account of the break, GPT-6 Astra surveyed the site's unbroken messages and settled on Nr. 172 — ciphertext "MVUEH," transmitted on 10 July 1941 and logged by the SS-Totenkopf Quartiermeister's radio station, unsolved since 2005. It noticed the message's structure resembled an already-solved neighboring message, SIPVX (Nr. 173), and used the repeated geographic term "ROSENOW" as a known-plaintext crib — the same technique human cryptanalysts at Bletchley Park relied on against Enigma in the 1940s.
What's new is that the model then authored its own Python and C++ tooling — an Enigma simulator and a Bombe-style key search — to turn that crib into a full break, without being told to build software at all. It scoped the problem, chose an attack, and built the instrument for it.
A second data point, days later
This wasn't isolated to one model. Per Schneier's post, Anthropic's Claude Opus 5 independently broke a different unsolved message from the same archive — Nr. 205/285, ciphertext "FMNGI," 63 letters, dated 31 July 1941 — on 20 September 2026, using the crib "XHARTJENSTEINX." Two frontier models from different labs, working the same public archive within days of each other, both moved from an open-ended prompt to working custom cryptanalysis code.
Why this matters more for AI governance than for cryptography
Enigma's effective keyspace is minuscule next to AES or RSA, and known-plaintext attacks against it are a solved problem in the academic sense — nothing here threatens modern encryption. The signal worth tracking is upstream of the cipher: given a loosely scoped goal and a pile of public data, these models chose a target, selected an attack technique, and wrote and iterated on offensive tooling entirely on their own initiative. That's exactly the kind of unsupervised capability elicitation that AI red-teaming and evaluation programs — and frameworks like ISO 42001 — exist to surface before an agent is given a consequential goal rather than a historical puzzle. Organizations deploying agentic AI with any access to code execution and real-world targets should be asking what else a model will autonomously decide to try, not just what it was asked to do.
The caveats
It's worth being precise about what didn't happen: no new cryptographic technique was discovered, and the crib-based approach mirrors WWII-era cryptanalysis rather than surpassing it. The genuinely new part is process autonomy — self-directed target selection and tool authoring — not cryptographic breakthrough. Coverage that frames this as AI "breaking encryption" overstates it.
Frequently Asked Questions
Does this mean AI can now break modern encryption like AES or RSA?
No. Enigma has a comparatively tiny keyspace and was broken here using a known-plaintext crib, a decades-old technique. Nothing in this result applies to modern, well-implemented encryption.
What's actually new if humans already knew how to break Enigma this way?
The autonomy. GPT-6 Astra wasn't told which message to attack or how — it selected the target, chose the crib-based method, and wrote its own simulator and Bombe-style search without step-by-step direction.
What should security teams take from this?
It's a data point for evaluating agentic AI before deployment: models can autonomously scope a problem and build offensive tooling toward it, which is precisely what structured AI red-teaming and capability evaluations are designed to test for ahead of time.
Sources
- 1GPT-6 Astra Breaks an Old Enigma Message — Schneier on Security
- 2The MVUEH Break — Crypto Cellar Research
- 3Crypto Cellar Research — Crypto Cellar Research