An overturned hypothesis does not mean the end of privacy

When I read that AI has overturned a major hypothesis, I want to understand what has been demonstrated before sharing the headline. OpenAI’s ETH announcement deserves attention. Assessing its consequences requires separating the mathematical result, its practical usefulness and the interpretations we add afterwards.

What has been presented

On October 26, 2026, OpenAI announced a result concerning the Exponential Time Hypothesis, or ETH. Here the acronym refers to a computational complexity conjecture, not Ethereum.

Put simply, ETH holds that solving 3-SAT in the worst case requires exponential time in the number of variables. In 3-SAT, we seek an assignment of true and false values that satisfies a Boolean formula.

The published manuscript presents a deterministic algorithm that exactly counts solutions to k-CNF formulas for each fixed width, using subexponential time and polynomial space. Counting also determines whether any solution exists. This is the result the authors use to refute ETH.

Subexponential does not mean fast or polynomial. The improvement describes how costs grow with the input size; it does not guarantee useful running times on a real computer. Constants, instance sizes and implementation still matter.

A public Lean formalization accompanies the work. Its scope documentation distinguishes the formalized bound from a sharper bound in the manuscript. We should not attribute more to formal verification than that documentation establishes.

OpenAI also announced an independent group led by Russell Impagliazzo, Ramamohan Paturi and Ryan Williams to verify and explain the work. As of October 27, 2026, we can describe a result presented with a public formalization and an announced independent examination. That does not establish all its possible applications.

What changes for cryptography

Improved satisfiability algorithms can have cryptographic consequences. We should examine which ones, rather than jump straight to “AI can decrypt everything.”

Appendix C.2 does address a specific case: inverting Boolean functions with constant locality, including certain variants of Goldreich’s candidate functions. For those families, it gives subexponential inversion and rules out the exponential resistance under consideration. The text explicitly notes that this does not rule out one-wayness against polynomial-time algorithms.

That consequence deserves investigation. The work does not thereby present a practical attack against AES, every digital signature scheme or everyday encrypted communications. A concrete break requires identifying the scheme, its parameters, the attack model and the actual cost.

Precise terminology helps too:

• Encoding changes how data is represented. Base64 does not provide cryptographic secrecy.
• Encryption protects information using an algorithm and a key, under defined guarantees.
• Decryption with the correct key is normal operation. Breaking encryption means defeating its guarantees without the required secret.

The question that interests me is which assumption has weakened and which system actually relied on it. That is where security analysis begins.

Protection evolves too

Research does not only seek ways to attack systems. It also develops new constructions, examines assumptions and reviews implementations.

NIST’s 2024 post-quantum standards provide an example: ML-KEM for key establishment, and ML-DSA and SLH-DSA for signatures. Those standards address quantum threats; they are not a response to the ETH announcement or a universal guarantee against algorithmic advances.

They illustrate our ability to revisit the foundations of protection and prepare transitions. Cryptographic agility means being able to adapt and replace algorithms while preserving security and ongoing operations.

For service builders, that involves concrete work: knowing where we use cryptography, which data needs long-term confidentiality, which components can be updated and how to rehearse a migration. Obfuscation or homemade encryption does not replace that work.

AI may help explore alternatives and review implementations, as well as accelerate vulnerability discovery. That is a research opportunity, not a promise that defenses will always arrive first. Transitions can be slow, and implementation mistakes still have consequences.

Before sharing further

When analyzing news like this, I want to preserve what matters without turning every possibility into an established fact. Before sharing, I ask four questions:

1. What exactly does the primary source claim?
2. What has been demonstrated or formalized, and what remains under review?
3. Which consequences follow from the result, and which need further research?
4. Is there already a practical effect on a specific system?

We can be excited by an advance while keeping those questions open. I am interested both in what AI helps us understand about difficult problems and in what we can build with that knowledge to protect information better.