The Dual Threat: How AI Is Reshaping the Post-Quantum Cryptography Landscape

The Threat You Are Not Modelling

Most enterprise security teams are building their post-quantum cryptography (PQC) migration plans around a single scenario: the arrival of a cryptographically relevant quantum computer (CRQC). The planning assumption is linear. A large-scale fault-tolerant machine is still years away. There is time to budget, time to test, time to migrate.

That assumption is dangerously incomplete.

Artificial intelligence has introduced a second, concurrent threat vector to cryptographic infrastructure, one that does not require quantum hardware at all. AI systems are already probing the mathematical foundations of both classical and post-quantum algorithms, finding implementation flaws at speeds no human review team can match, and compressing the timeline for quantum computing itself.

The result is a dual threat model that most organisations have not yet internalised. And the window to act on it is narrower than the prevailing roadmaps suggest.

When AI Broke a Post-Quantum Candidate in 60 Hours

In July 2026, Anthropic disclosed that its frontier AI model, Claude Mythos Preview, had independently discovered a previously unknown mathematical weakness in HAWK, a lattice-based digital signature scheme under active evaluation in the third round of NIST's post-quantum cryptography standardisation process.

The AI identified a structural flaw in HAWK's lattice geometry, an unexploited automorphism that enabled a faster enumeration attack. For the smallest parameter set (HAWK-256), the effective cost of key recovery dropped from approximately 2^64 operations to 2^38. The work took roughly 60 hours of autonomous analysis.

To put that in context: HAWK had survived two full years of expert human cryptanalytic review inside the NIST process before this vulnerability was found. The AI did not simply reproduce known attacks. It produced original, research-grade cryptanalysis that human specialists had missed.

The HAWK finding is specific. It does not affect the NIST-finalised standards (ML-KEM, ML-DSA, SLH-DSA), nor does it imply a general weakness in lattice-based cryptography. But it does prove something that the security community needs to internalise: AI is now capable of conducting original cryptographic research at expert level, and it does so at a pace and cost that fundamentally changes the economics of cryptanalysis.

This was not the only result. The same model also developed a novel attack method on a reduced-round version of AES (7 of 10 rounds), achieving a 200x to 800x speedup over the best previously known approach. Again, no production systems were compromised. But the capability trajectory is clear.

If an AI can find a flaw in a post-quantum candidate that the world's best cryptographers missed for two years, the question for every CISO is straightforward: what else has it found that has not been disclosed? And what will the next generation of models find?

The Dual Threat: Two Clocks, One Cryptographic Estate

Enterprise cryptographic infrastructure now faces two distinct but converging threat vectors. Understanding each, and the way they interact, is essential for any credible migration strategy.

Threat 1: Harvest Now, Decrypt Later (HNDL)

Nation-state and sophisticated adversaries are already capturing encrypted traffic in transit, banking on the future availability of a CRQC to decrypt it retrospectively. Any data with a long confidentiality requirement (health records, financial data, government communications, trade secrets, intellectual property) is at risk today, not at some future Q-Day. The data harvested now cannot be un-harvested. This makes HNDL a present-tense vulnerability, not a theoretical one.

Threat 2: AI-Enhanced Cryptanalysis

This is the vector most organisations are underweighting. AI does not need a quantum computer to threaten cryptographic security. Machine learning models are already being deployed to:

• Discover mathematical vulnerabilities in both classical and post-quantum algorithm candidates (as demonstrated by the HAWK result)
• Identify side-channel leakage in PQC implementations
• Find implementation bugs in cryptographic code at scale
• Stress-test foundational ciphers with a level of mathematical scrutiny they have never previously faced
• Probe the resilience of hash-based digital signature schemes using Quantum Generative Adversarial Networks (QGANs)
• Attack lattice-based cryptosystems, including the structured variants underpinning NIST's ML-KEM standard, using language models

Researchers at the Netys 2026 conference presented work on using language models specifically to attack Learning With Errors (LWE) problems and their structured variants, including Module-LWE, which is the mathematical foundation of ML-KEM (formerly CRYSTALS-Kyber), the primary NIST-standardised key encapsulation mechanism.

The Convergence

These two threats are not independent. AI is being used to improve quantum error correction and optimise qubit control systems, directly compressing the timeline for a CRQC. The feedback loop is self-reinforcing: AI accelerates quantum computing progress, which in turn threatens the cryptographic systems that AI applications themselves depend on. Every AI application that uses HTTPS, signs software updates, or authenticates API calls runs on infrastructure that a fault-tolerant quantum computer could compromise.

The Regulatory and Industry Signals Are Converging

The standards bodies, intelligence agencies, and technology leaders are not waiting for a CRQC to arrive. They are acting now, and the timelines they have published are tighter than most enterprise budgets anticipate.

NIST: The Foundation Is Set

On 13 August 2024, NIST published the first three finalised post-quantum cryptography standards, closing an eight-year evaluation process that began in 2016 with 69 global algorithm submissions:

• FIPS 203 (ML-KEM): Module-Lattice Key-Encapsulation Mechanism, derived from CRYSTALS-Kyber. The replacement for ECDHE and RSA key exchange.
• FIPS 204 (ML-DSA): Module-Lattice Digital Signature Algorithm, derived from CRYSTALS-Dilithium. The general-purpose replacement for ECDSA and RSA signatures.
• FIPS 205 (SLH-DSA): Stateless Hash-Based Digital Signature Algorithm, derived from SPHINCS+. A conservative fallback where lattice security assumptions are undesirable.

A fourth standard, FN-DSA (derived from FALCON), is expected to follow. NIST's IR 8547 guidance is explicit: public-key cryptography must move to ML-KEM and ML-DSA, with hybrid deployments (pairing a post-quantum algorithm with a classical one) encouraged as a transitional measure.

NSA CNSA 2.0: Hard Deadlines for National Security Systems

The NSA's Commercial National Security Algorithm Suite 2.0 sets a phased transition timeline for all U.S. National Security Systems (NSS):

• Software and firmware signing: exclusively CNSA 2.0 by 2030
• Traditional networking equipment (VPNs, routers): exclusively CNSA 2.0 by 2030
• Large PKI systems and niche equipment: exclusively CNSA 2.0 by 2033
• All NSS fully quantum-resistant by 2035, aligned with the White House's NSM-10 directive

Countries including India and Australia have also moved their transition timelines into the 2030 to 2033 range, signalling a global regulatory convergence.

Google: Setting the Pace for Industry

In March 2026, Google published an internal deadline to complete its post-quantum cryptography migration across all infrastructure by 2029, years ahead of most government targets. Google Cloud KMS already offers ML-KEM, ML-DSA, and SLH-DSA for encryption and signing keys. Chrome supports PQC key exchange. Android is integrating ML-DSA into its hardware root of trust.

Google framed the 2029 timeline as both an engineering directive and a public signal to the industry. The broader implication: if a company with Google's scale and complexity is treating this as a three-year migration, organisations that have not started are already behind.

The Wiz Report: The Migration Gap Is Structural

In May 2026, Wiz published the first large-scale analysis of PQC deployment across enterprise cloud environments. The findings were sobering: most organisations lack a cryptographic asset inventory, have no PQC migration roadmap, and continue to rely on RSA-2048 and ECDH key exchanges that are actively being harvested. The gap is not a matter of awareness. It is structural.

AI as a Defensive Instrument: Discovery, Remediation, and Agility

The same capabilities that make AI a potent cryptanalytic tool also make it indispensable on the defensive side of the migration. In fact, without AI-assisted tooling, most enterprise PQC migrations will stall before they start.

Here is why.

The first step in any quantum-safe transition is discovery: understanding what cryptographic algorithms and protocols are deployed across your environment, where they are embedded, and which are vulnerable. For organisations with thousands of applications, microservices, APIs, and third-party integrations, this is not a task that can be completed manually. Legacy systems hard-code RSA and ECC primitives in ways that are invisible to standard asset inventories.

AI-driven cryptographic discovery tools can scan codebases, configuration files, certificate chains, network handshakes, and API calls to build a comprehensive cryptographic asset inventory at a speed and granularity that manual audits cannot achieve. This is the starting point for any credible migration plan.

Beyond discovery, AI is accelerating remediation in several critical areas:

• Automated translation of custom cryptographic libraries from classical to post-quantum implementations
• Generative test harnesses for hybrid interoperability, validating that classical and PQC algorithms coexist without breaking authentication or key exchange
• Anomaly detection tuned to post-quantum handshake behaviour, identifying misconfigurations, downgrade attacks, and implementation errors in real time
• Automated code rewriting for legacy systems that hard-code vulnerable primitives, reducing the manual engineering burden of migration

The operational concept underpinning all of this is crypto-agility: the architectural ability to swap cryptographic algorithms without rebuilding infrastructure. Crypto-agility is not a feature. It is a design principle. And it is the single most important capability an organisation can build into its cryptographic estate right now, because the threat landscape will continue to evolve. The algorithms that are considered safe today may not be considered safe in five years. The organisations that can change primitives faster than the threat changes will be the ones that remain secure.

What This Means for Security Leaders

The convergence of AI and quantum threats demands a shift in how CISOs and security teams frame their cryptographic risk posture. Five priorities should be on every security leader's agenda in 2026:

1. Conduct a cryptographic asset discovery now, not later. You cannot migrate what you cannot see. Most organisations have a fragmented understanding of their cryptographic estate. A comprehensive, automated discovery across code, configurations, certificates, and network protocols is the non-negotiable first step. If your asset inventory does not include the specific algorithms, key lengths, and protocol versions deployed across every system, it is not complete.
2. Adopt a dual threat model. Stop planning exclusively around a CRQC timeline. AI-enhanced cryptanalysis is a present-day risk that operates independently of quantum hardware. Your risk assessment must account for both HNDL (data at rest being harvested now for future decryption) and AI-driven discovery of implementation and algorithmic weaknesses.
3. Prioritise crypto-agility over algorithm selection. ML-KEM and ML-DSA are the right standards for today. But the HAWK incident demonstrates that the landscape will continue to shift. The organisations that will navigate this well are the ones that can swap primitives without architectural upheaval. Build for change, not for a single destination.
4. Implement hybrid key exchange as a transitional measure. Pair classical ECDHE with ML-KEM in TLS 1.3 and analogous hybrid modes in SSH, QUIC, and VPN configurations. Hybrid provides defence in depth: if one algorithm is compromised, the other holds. Begin with internal endpoints and expand.
5. Require PQC readiness in vendor and partner contracts. If your supply chain is not migrating, your migration is incomplete. Mandate that new vendor contracts include post-quantum readiness statements, hybrid key exchange support, and a defined migration timeline. Several European financial institutions have already made this a procurement requirement as of Q3 2026.

From Static Encryption to Agile Cryptographic Posture

The post-quantum transition is not a single event. It is not a compliance checkbox. And it is not a problem that resolves itself when NIST publishes a standard or when a vendor adds a toggle to a product dashboard.

It is a fundamental shift from static, perimeter-based encryption to an agile cryptographic framework that can absorb shocks from both AI-driven and quantum-driven threats, continuously and in real time.

The organisations that treat PQC migration as a 2030 budget item are already exposed. The data being harvested today will not wait for a board-approved roadmap. The AI models probing cryptographic implementations today will not pause while procurement cycles complete.

At ExeQuantum, we build the tools and frameworks that enable organisations to discover their cryptographic exposure, remediate to quantum-safe standards, and maintain the agility to stay ahead as both AI and quantum capabilities evolve. Our approach starts with visibility, because you cannot secure what you cannot see, and extends through remediation to continuous monitoring.

The convergence of AI and quantum is not a future scenario. It is the operating environment we are in right now.

The question is not whether your cryptographic posture needs to change. It is whether it can change fast enough.

References

• Anthropic, "Discovering cryptographic weaknesses with Claude" (July 28, 2026)
• NIST, FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA), published August 13, 2024
• Google, "Quantum Frontiers May Be Closer Than They Appear" (March 25, 2026)
• NSA, Commercial National Security Algorithm Suite 2.0 and FAQ
• IEEE, "AI-Accelerated Quantum Cryptography: How Soon Should the Enterprise Be Ready?" (June 2026)
• Wiz, "State of Post-Quantum Cryptography" report (May 2026)
• Palo Alto Networks, "The AI-Quantum Convergence: Securing the Infrastructure of Tomorrow, Today" (July 2026)
• Miszczak J., "Towards Quantum Machine Learning for Assessing the Resilience of Post-quantum Cryptography," ICCS 2026
• Netys 2026, "AI for the Cryptanalysis of Post-Quantum Algorithms"
• Cloud Security Alliance, CISO Daily Briefing (May 31, 2026)