AI advances in mathematics and raises alarm over the foundation of current cryptography

UK regulators are already testing banks for a scenario in which AI models and quantum computers threaten RSA. In Brazil, banks like Inter and companies like Grupo FS are starting to take notice.

The Financial Conduct Authority (FCA), the UK's financial markets regulator, has started testing a tool with 50 large institutions to assess whether they're prepared for a scenario in which artificial intelligence and quantum computing compromise the encryption systems in use today. The information was published by Financial Times and republished by NeoFeed, a Brazilian business news outlet, in late October.

For anyone building authentication systems, digital signatures, or anything that relies on HTTPS, this isn't regulatory futurology. It's the mathematical foundation underpinning TLS, certificates, API keys, and much of what protects data in transit on the internet.

What OpenAI published, and why it became a security concern

In early October 2026, OpenAI released hundreds of mathematical papers, including solutions to problems considered old and difficult, obtained with the help of its own models. The initiative drew an immediate reaction from the Association for Human Mathematics, an organization that asked researchers to stop collaborating with the company.

The debate over AI's role in pure mathematical research is one thing. But it opened a more uncomfortable question for people working in security: if a model can solve mathematical problems that academia took decades to crack, how far does it get on the problems that underpin modern cryptography?

RSA relies on a calculation that's hard to undo

Much of the asymmetric cryptography used today, RSA foremost among it, isn't secure because it's mathematically impossible to break. It's secure because factoring a giant number into the product of two primes is a task that, for conventional computers, takes an impractical amount of time.

Multiplying two large primes is trivial. Figuring out which primes generated a specific product, with numbers hundreds of digits long, is not. All the trust placed in HTTPS, digital certificates, and much of web authentication rests on that asymmetry of computational effort.

If a tool, whether an AI model or a quantum computer, finds an efficient shortcut for this kind of factoring, the problem stops being theoretical. According to the report, there's no evidence so far that this has happened with the main algorithms in use. But the technology has already left a practical mark.

PHP: the first concrete case on the table

In the week before the story was published, companies around the world had to scramble to fix vulnerabilities in PHP, a language widely used in websites and web applications. Some of these flaws were identified by AI models developed by OpenAI and Google.

That doesn't mean AI broke any encryption: it means it was efficient at finding security bugs in a mature, widely audited codebase, which on its own is already a meaningful signal. If AI models can sweep through legacy code looking for flaws at this speed, application security teams in production, many running PHP stacks, including in Brazil, gain both a new tool and a race against whoever uses that same tool to attack.

The quantum computing factor hasn't left the radar

Alongside AI's progress, quantum computing remains the longer-term, but potentially more disruptive, threat to current cryptography. Unlike conventional computers, quantum machines exploit properties of quantum physics to perform certain types of calculations at much higher speed.

A sufficiently advanced quantum computer could, in theory, solve the factoring problem that underpins RSA in practical time. For now, these machines remain at an experimental stage, without the capacity to break the algorithms used today. But the combination of two simultaneous risk vectors, AI and quantum computing, is exactly what led the FCA to act before the problem materializes.

What the Brazilian market is already doing

The concern has also started showing up among companies in Brazil. In an interview with NeoFeed during the NeoSummit "IA na Real" event in September 2026, Alberto Leite, founder of Grupo FS, warned about the impact of more accessible quantum computing.

When this technology becomes able to operate in a more widely accessible environment, it will cause a crash in the cryptography model we have today.

Alberto Leite, founder of Grupo FS

According to Leite, the practical obstacle today is testing defenses against a threat that doesn't yet exist at scale: the quantum computers available are experimental and lack the power to break the main cryptographic systems. Banco Inter also signaled movement in this direction: at the launch of Inter Science, the bank's research hub focused on AI, blockchain, and quantum computing, Bruno Grossi, the institution's head of digital assets, said that one of the research fronts is precisely the development of more advanced cryptographic mechanisms.

What changes for developers now

None of this means swapping RSA for something else overnight. But there's concrete movement worth tracking:

• Post-quantum cryptography is already an active research front. There are algorithms in development designed to resist quantum attacks, and it's reasonable to expect widely used cryptographic libraries to start incorporating support for them in the coming years. It's worth checking the official documentation of each stack before migrating anything in production.
• Crypto-agility has become an architectural requirement. Systems that hardcode a single signature or key-exchange algorithm will struggle more to migrate when (and if) the moment comes. Abstracting the cryptographic layer, instead of coupling it directly to business logic code, is the kind of decision that pays off in this scenario.
• AI as an auditing tool is also AI on the attacker's side. The PHP case shows that the same models used to find flaws in legacy code can be used by attackers. Automated security review has stopped being a differentiator and become a basic expectation for CI/CD pipelines.
• Brazilian regulators tend to follow the UK's lead. The FCA is testing its oversight tool with 50 large institutions, but it has already signaled plans to issue guidance on the topic for the more than 35,000 financial services firms under its supervision. It's reasonable to expect Banco Central (Brazil's central bank) and CVM (Brazil's securities regulator) to follow this debate in upcoming regulatory cycles, especially for institutions that already report compliance with international standards.

What remains unclear is the timeline. Neither AI nor quantum computing has broken RSA so far, and the NeoFeed report points to no evidence of that. What exists is a group of regulators and companies treating the risk as manageable today and urgent to map, not to solve tomorrow. For those architecting systems that will run over the next five to ten years, this is the right window to already design with crypto-agility in mind.