Public key cryptography: Wordfence warns of AI math risks

Public key cryptography could face new pressure from advances in artificial intelligence (AI), Wordfence argues, warning that website operators may eventually need to replace security algorithms faster. Its commentary links a reported release of mathematical proofs by OpenAI to concerns about the foundations of secure online transactions. However, the supplied account does not demonstrate that an algorithm protecting websites has been broken or identify an emergency replacement that operators should deploy.

Wordfence cites Matthew Green, a cryptographer at Johns Hopkins, expressing concern about the future of public key cryptography. This is the mathematics-based system that uses a public key and a corresponding private key to help strangers communicate securely. Its protection depends on certain mathematical problems remaining impractical for an attacker to solve with available computing resources and known mathematical methods. Better methods, not just faster computers, can therefore change the security assumptions.

According to Wordfence, OpenAI released more than 700 mathematical proofs in a GitHub repository, an online collection of project files, and subsequently withdrew three. The source describes the release as occurring the previous day, without providing a calendar date in the supplied text. It says the collection includes LEAN proofs, mathematical arguments expressed for checking by software, and presents this as strong evidence of their logical validity. That is distinct from evidence that those results defeat a particular encryption system.

Wordfence describes reactions among mathematicians ranging from frustration and sadness to claims of extraordinary historical significance, and points readers to a Hacker News discussion. It also repeats an unnamed former OpenAI employee's assertion on X that the release accounted for 81% of mathematical discoveries over the preceding three years. The supplied account provides no measurement method or supporting dataset for that percentage. It should not be treated as an established measure of mathematical progress or cryptographic risk.

The commentary contrasts the possibility of rapid mathematical advances with the longer preparation for quantum computing, a type of computing that could undermine some existing cryptographic methods. It names ML-KEM, the Module-Lattice-Based Key-Encapsulation Mechanism, as an example of a post-quantum approach. In plain terms, it helps systems establish a shared secret and is designed to resist attacks involving quantum computers. Wordfence's concern is that an unexpectedly fast mathematical breakthrough could leave less time to prepare alternatives. It does not report such a breakthrough against ML-KEM.

For businesses, the relevant dependency is the protection of information moving between customers and websites. Wordfence uses WooCommerce and Shopify stores as examples of operations that rely on secure transactions, including the transfer of card details and payment tokens, substitutes used for sensitive payment information. Its warning about commerce stopping is a hypothetical consequence of losing essential cryptographic protection without a replacement, not a report of an outage or exposed payments at either platform.

Wordfence also describes its own work with Mythos and security-capable OpenAI and Anthropic models. It says Wordfence Argus continues to discover vulnerabilities it considers extremely severe, with many undergoing confidential disclosure, the process of privately notifying affected developers before publication. It separately says Wordfence PRISM provides broad coverage across the plugin and theme ecosystem, the add-ons and design packages used by websites. The supplied account gives no affected versions, vulnerability identifiers, technical details or patches for those discoveries, so it offers no specific flaw that a site owner can check or remediate from this information alone.

The company's wider argument is that mathematical research will continue across competing AI providers, naming Anthropic, DeepSeek and Z.ai alongside OpenAI. It proposes that AI could also help develop replacement cryptographic algorithms and that applications may need faster ways to adopt validated alternatives. Both are proposed responses to a possible future problem, rather than demonstrated solutions in the supplied account. Faster deployment would not remove the need to establish that a replacement is suitable and secure.

For website owners, Wordfence recommends keeping track of cybersecurity developments and making a daily habit of checking for necessary software and system updates. It acknowledges that some changes could arrive through ordinary updates while others might require more work. AEU-I's security-first IT, infrastructure and consulting services are relevant to businesses planning how to maintain their systems, but that is not evidence of protection against an unproven cryptographic breakthrough.

Wordfence notes that its own ecommerce operations depend on public key encryption and says it will keep customers informed about developments requiring action. The practical distinction for readers is between preparing to respond and responding to a confirmed incident: this account supports attention to maintenance and vendor guidance, not a conclusion that today's website encryption has failed.