When AI does the discovering, verification is the bottleneck

A post-quantum encryption scheme called HAWK spent two years under expert review. Two full rounds of professional cryptanalysts, the people whose entire job is breaking codes, went looking for weaknesses and cleared it. Last week an AI found one in about sixty hours.

That’s the short version of research Anthropic, the company behind the Claude models, published on July 28. An experimental model, Claude Mythos Preview, found a genuine flaw in HAWK’s math that cut the cost of recovering a secret key from roughly two-to-the-64th operations down to two-to-the-38th. In plain terms, from “no computer will ever do this” to “a determined attacker might.” Separately, the same model invented a new attack technique on a reduced version of AES, the encryption standard that protects most of the traffic on the internet, running 200 to 800 times faster than the best method anyone had published before. Both findings are verified. Neither breaks anything you use today. Both target theoretical designs still under review, which is exactly where you want weaknesses found.

Now, why should a product person care about lattice math?

Because there’s a comfortable story going around about where humans stay safe as AI gets good, and this cracks it. The story goes like this. AI is driving the cost of building things toward zero. So “can you build it?” stops being the hard part. The hard part, the durably human part, becomes “do you know what to build?” Discovery. Customer research, problem validation, sensing which opportunity is worth the money. The advice that falls out of it is everywhere right now: stop competing on execution and go deep on discovery, because that’s the ground the machines can’t take.

The advice has real data behind it. Atlassian’s State of AI 2026 survey found 89% of executives say AI made their teams faster, while only 6% could point to company-wide returns. Speed was never the constraint. Knowing what to do with it was. So the case for betting on discovery is honest, and I don’t want to strawman it.

The cryptography result is that case’s falsifier, arriving early. Because finding a weakness no specialist saw in two years is not execution. It’s discovery in its purest form: finding what nobody knew to look for. On the very week the field is planting its flag on “discovery is the safe human ground,” an AI is operating at the frontier of discovery itself.

So the safe ground isn’t discovery. But watch where it went, because that’s the part worth your attention.

The scarce human capability is sliding from finding the answer to confirming the answer is real. And product’s real protection may be that it lives in a domain where confirming an answer is expensive and slow.

Look at what the cryptography research actually cost. Each discovery ran around one hundred thousand dollars in computing, and generated roughly a billion words of reasoning along the way. Then Anthropic’s own researchers spent several hundred expert hours checking whether the findings were true. The AI produced candidate discoveries faster than trained humans could verify them. Read that again, because it’s the whole point. The bottleneck moved one step downstream, from generating the insight to confirming it.

Here’s the part that should matter most to you. Cryptography is the friendliest possible place for a machine to discover things, because it has ground truth. A weakness in a lattice either exists or it doesn’t. You can check. It’s math. AI cracked discovery first in the one domain where the answer is checkable, and even there, checking is what jammed.

Product discovery has no ground truth. “The right thing to build” has no proof. There’s no calculation that tells you the feature is correct. You ship it, you wait months, and the market eventually mumbles something back that you still have to interpret. Verifying a product bet isn’t costly because it takes a few hundred expert hours. It’s costly because it may not be possible at all until the bet has already played out.

That flips the usual worry on its head. We tend to treat the fuzzy, unmeasurable nature of product work as its weakness, the reason it never feels rigorous. It might be the source of its protection. An AI can generate a hundred plausible product bets an hour. So can a room of smart people. Neither can tell you which one is right, and no amount of compute changes that, because the information doesn’t exist yet. The scarce skill is deciding which bet to trust when nothing can confirm it in advance.

I want to be honest about the size of that leap. The cryptography result is verified. The reframe I’m hanging on it, that verification difficulty is the real moat and product is shielded by its own fuzziness, is my inference. Nobody has measured it. Hold it as a prediction, not a finding.

The steelman for the old story is fair too. Maybe cryptography is a special case: a narrow, formal domain with a clean target, and product discovery stays out of reach for reasons that have nothing to do with verification. That’s possible. But notice it lands in the same place. Whether product is safe because AI can’t discover there, or safe because nobody can verify there, the skill you’d invest in is the same one.

So if you run a product org, the question this hands you is sharp. If the durable job is confirming which AI-surfaced opportunity is real, rather than surfacing more of them, are you building any muscle for that? Most teams have a discovery process. Almost none have a verification process: a repeatable, honest way to decide a bet is worth trusting before the outcome arrives.

And there’s a darker read you have to hold at the same time. In a domain with no ground truth, “the bottleneck is verification” might not be a moat. It might be a trap. A place where neither the human nor the machine can tell value from waste, where everyone ships confidently into the fog and calls the survivors strategy. That risk was always sitting under product work. What AI did this week was make it impossible to keep ignoring.

The teams that come out ahead won’t be the ones generating the most opportunities, or even the best ones. They’ll be the ones who build an honest way to tell, before the market does, which of their bets is real. That’s a discipline almost nobody has yet. It just became the one worth having.