How to Build an Autonomous Cryptanalysis Agent: The Enigma Case

Here’s how to build an autonomous cryptanalysis agent, told through the one that actually shipped: pointed at a German Army Enigma message from 10 July 1941 that had resisted every attempt to break it since 2005, OpenAI’s GPT-6 Astra cracked it in two days — by writing its own code-breaking tools instead of using any that existed.

TL;DR

• The task: an 82-letter Enigma message, logged as Nr. 172 by an SS-Totenkopf Division radio station, had been on a public list of unsolved WWII ciphers since 2005.
• The result: GPT-6 Astra, directed only to look at the unbroken-message archive, picked this message, wrote an Enigma simulator and a Bombe-style key-search attack in Python and C++, found its own crib, and recovered the plaintext in two days — work the write-up estimates would take a human specialist weeks to months.
• The reusable part isn’t the history lesson. It’s the pattern: triage a pool of candidates using linked metadata, build the missing tool instead of waiting for one, find a crib to collapse the search space, then verify automatically. That pattern applies to any bounded, cheaply-verifiable search problem your own agents run into.

What Is Agentic Cryptanalysis?

Agentic cryptanalysis is letting an autonomous coding agent run the full code-breaking loop unsupervised — target selection, tool construction, hypothesis formation, key search, and verification — rather than using the agent as an assistant inside a process a human already designed. The distinction matters because most “AI helped break a cipher” stories are really “a human ran a known algorithm and asked a model to write the loop body.” This one wasn’t. Carter Leffer’s instruction to GPT-6 Astra was simply to examine the Crypto Cellar Research site’s list of still-unbroken Enigma messages — everything downstream of that, including which message to attack and what tools to build, was the agent’s decision.

That’s the part worth studying even if you have zero interest in WWII cryptography: it’s a real example of an agent choosing its own sub-goals across a multi-day task with no human checkpoint in between.

Why This Cipher Survived Two Decades of Attempts

The message, code-named MVUEH, wasn’t unsolved because nobody tried. Crypto Cellar Research has hosted the full unbroken-message list publicly since 2005, and it’s exactly the kind of target hobbyist cryptanalysts pick at over the years. Three things made this one specifically hard:

• The ciphertext carried transcription errors. Radio operators in 1941 copied Morse by hand under field conditions; a wrong letter anywhere breaks a naive key search that expects a clean signal.
• The wheel order was the odd one out. Most 10 July 1941 traffic on this network used wheel order 512. MVUEH used 253 — so any search that assumed the day’s common configuration would never even test the right key.
• A rare rotor turnover complicated the middle of the message. Enigma’s left-hand wheel only advances (turns over) at one specific letter position per rotation; this message’s turnover fell at the 72nd letter, which shifts the cipher’s internal state in a way that trips up naive simulators.

Each of those is a small, well-understood wrinkle to a specialist. Stacked together, on an 82-letter message with no obvious crib, they were enough to keep it unsolved for 21 years.

How to Build an Autonomous Cryptanalysis Agent: A 6-Step Procedure

Strip away the WWII specifics and what the agent actually did is a repeatable procedure for any bounded search-and-verify problem you hand an agent without a pre-built solver:

1. Point it at the whole candidate pool, not one target. Give the agent every unsolved item, not the one you’ve decided is interesting. Triage is part of the task.

2. Have it mine linked metadata for a foothold. The agent noticed MVUEH was logged adjacent to Nr. 173, an already-broken message on the same circuit, and used that adjacency to guess at MVUEH’s likely subject matter before touching the ciphertext itself.

3. Make it write its own tools. Rather than searching for an existing Enigma simulator, the agent implemented one — plus a Bombe-style attack — in Python and C++. Owning the tool meant it could inspect and fix its own failures.

4. Have it find its own crib. Based on its subject-matter guess, it hypothesized the plaintext referenced a place called Rosenow, spotted the doubled bigram ROSENOW ROSENOW in a decrypt candidate, and used that repetition as the crib that collapses the key search.

5. Bound the key space with everything it can verify externally. Wheel order, ring-setting ranges, and the network’s typical configuration for that day are all constraints an agent can pull from the surrounding archive rather than guessing blind.

6. Verify automatically, and tolerate noise. The final check wasn’t “does this decrypt to readable German” on a clean signal — it had to accept a ciphertext with real transcription errors and still confirm plaintext coherence.

None of these six steps require a WWII-specific model. They require an agent that can write code, form a hypothesis, and check its own work — which is the actual claim here, not “AI breaks encryption.”

Autonomous Agent vs. Human Cryptanalyst: What Two Days Bought

Dimension	Human specialist (the norm before this)	Autonomous agent (this break)
Elapsed time	Weeks to months, per the write-up’s own estimate	2 days
Tooling	Reuses an existing Enigma/Bombe simulator	Wrote its own simulator and Bombe-style attack from scratch
Target selection	Manual triage across the unsolved list	Read radio-log metadata and picked MVUEH via its link to Nr. 173
Crib discovery	Requires a researcher already fluent in the traffic’s likely subject matter	Formed and tested its own subject-matter hypothesis, then found ROSENOW ROSENOW
Verification	Manual key check against known constraints	Automated check that tolerated ciphertext transcription errors

The time gap is the headline, but the tooling and target-selection rows are the more interesting ones — they’re the parts a human specialist’s expertise usually is, and here they were sub-tasks the agent handled on its own.

When Does This Approach Actually Work?

Not on every hard problem — the conditions that made this tractable are specific and worth naming before you try the pattern on your own backlog:

• The search space is bounded once a crib lands. Enigma’s keyspace is enormous on its own, but a correct crib cuts it down to something a modern machine can brute-force in minutes. If your problem has no equivalent of a crib — no way to turn a guess into a massive space reduction — an agent will grind without converging.
• A candidate answer is cheap to verify. Decrypted German prose is trivially checkable by a human or a language model. If verifying a candidate is as expensive as generating one, the loop doesn’t pay for itself.
• The domain has enough public structure to mine. Radio logs, adjacent messages, and known network conventions gave the agent footholds a colder start wouldn’t have.

What Breaks If You Skip the Crib?

Everything downstream, because the crib is the step that turns an intractable search into a tractable one. Without a crib, an agent facing Enigma’s full key space — on the order of 10^23 possible settings for a three-rotor machine — has no way to prioritize which keys to test first, and even a fast simulator can’t brute-force its way through a space that size before the sun burns out. The crib doesn’t make the problem easier by a little; it changes its computational class from “impossible” to “a coffee break.” That’s why step 4 in the procedure above isn’t optional polish — for this class of problem, it’s the whole game, and an agent that skips straight to key-search without one will simply time out.

Applying This Pattern to Your Own Agent Tasks

If you run agents against research-shaped problems — log triage, fuzzing targets, reverse-engineering an undocumented format, mining an incident for root cause — the transferable lesson isn’t “use a bigger model.” It’s structure the task so the agent owns tool-building, not just tool-use. A pre-built solver caps an agent at the quality of the solver; an agent that has to write its own simulator has to actually understand the state it’s manipulating, which is exactly the property that let this one debug a rare rotor turnover instead of silently producing garbage. Read agent harness design for the harness-level version of the same idea, and designing a long-horizon research spike as running code for how to scope a multi-day agent task so it doesn’t wander.

FAQ

What is agentic cryptanalysis? Agentic cryptanalysis is pointing an autonomous coding agent at a code-breaking problem and letting it run the entire loop itself: picking a target, forming a hypothesis, writing the tools it needs, searching the key space, and verifying the answer. Nobody hands it a crib or a simulator. It builds both, because the task requires them and no human is in the loop to supply them.

How did the agent know where to look? It was pointed at a public archive of unbroken Enigma messages, not at one specific target. It read the surrounding radio-log metadata — sender, time, and which other messages on the same circuit were already solved — and noticed message MVUEH was logged right next to an already-broken message, Nr. 173. That link, not brute force, is what made MVUEH the best candidate in the pile.

What is a crib, and why did the repeated place name matter? A crib is a guessed fragment of plaintext you expect to appear in the message, which you use to reverse-engineer part of the key before searching the rest. Enigma operators routinely repeated place names for emphasis, so when the agent’s hypothesis pointed at a report near Rosenow, it treated the repeated bigram ROSENOW ROSENOW as the crib. A correct crib collapses a search space too large to brute-force into one small enough to test directly — that’s the whole trick, and it’s an 80-year-old technique, not a new one.

Does this mean AI can now break modern encryption? No, and conflating the two is the most common misreading of this story. Enigma’s keyspace is small enough for a 2026 laptop to search once a crib narrows it, and the break relied on human operator sloppiness — a repeated place name, a reused wheel order — that AES-256 or a modern TLS handshake simply doesn’t have. What transfers is the agentic pattern, not the cryptographic weakness.

What’s the smallest version of this I can try myself? Pick a search problem with three properties: a large-but-bounded space, a way to verify a candidate answer cheaply, and no existing tool that does the search for you. Point an agent at the raw problem instead of a pre-built solver, and let it write the solver. You’ll learn more about where it gets stuck than you will from a task where the tool already exists.

Is this independently verified, or one account? It’s currently one write-up, published by the Crypto Cellar Research site that hosts the original unbroken-message archive, with the specific wheel order, turnover position, and crib named precisely enough to be checked against that archive. It has not been independently replicated by a second party. Treat the agentic pattern as the reusable part and the exact 2-day figure as one data point, not a benchmark.

A related question worth asking about any agent that builds its own tools before trusting its output: how do you verify an AI agent’s benchmark claims instead of taking a self-reported result at face value? And if the interesting part of this story is the multi-day, no-checkpoint execution, parallel tool calls in a DAG-shaped harness is the mechanical piece that makes long unsupervised runs like this one possible without the agent losing track of its own state.

For agents that are given room to build entire simulators before they can even start searching, the pattern shows up again in how some teams teach agents genuinely novel material: running simulations to learn complex topics is the closest analogue on this site. For the more general category this all sits in, see the AI coding agents topic hub.

Sources

• Crypto Cellar Research, “The MVUEH Break” — the primary write-up: message metadata, wheel order, turnover position, crib, and timeline.
• Cryptomuseum, Enigma — background on Enigma’s rotor mechanism, wheel orders, and the Bombe attack this write-up references.
• Sebastian Raschka, “GPT-6 Astra, looped transformers, and hidden reasoning” — background on the model used for the break.