Can artificial intelligence break AES or RSA?

Not by cryptanalysis: AI does not break the maths of AES nor walk a 256-bit space. RSA is vulnerable, but to QUANTUM computing (Shor's algorithm), not to AI. These are different threats the 'AI hacking' headline conflates.

So how is AI used in real attacks?

To bypass encryption, not break it: finding implementation bugs in code (reused nonce, timing leaks, primitive misuse), generating convincing phishing that steals the master password, and prioritising password brute force.

How does a memory-hard key derivation protect me?

Argon2id tuned to hundreds of megabytes per attempt costs memory, not just compute. Memory does not parallelise cheaply on a GPU or a model, so AI does not speed up brute force against a password protected this way.

What is 'harvest now, decrypt later'?

An adversary captures encrypted traffic today, secured with classical cryptography, and stores it until a quantum computer exists to open it. The defence is hybrid post-quantum cryptography, which requires breaking both the classical AND the post-quantum algorithm at once.

Can an AI decrypt your encryption? The real threat is elsewhere

The phrase "AI hacking" has become a fear-selling headline, and in selling it, it blurs three completely different threats. Telling them apart is the difference between choosing your encryption well and buying smoke.

1. Can an AI break the mathematics of encryption? No.

There is, today, no AI cryptanalysis that breaks well-designed primitives: AES, XChaCha20-Poly1305, ML-KEM or Argon2id. A neural network does not "guess" a 256-bit key nor speed up the algebra encryption rests on. The key space is so large that no amount of statistical compute walks it. Anyone claiming AI decrypts AES is selling fear, not describing an attack.

2. What AI does amplify attacks the implementation and the human

Real AI-assisted hacks do not touch the maths; they scale the three things that were always the weak link:

Implementation bugs. AI reads code at scale and finds the human error: a reused nonce, a timing-leaking comparison, mishandled padding, a well-chosen primitive used badly. The cipher does not fail here — the program around it does.
Social engineering. AI-generated phishing is more convincing and cheaper. Steal the master password and no cryptography protects a key handed over willingly.
Guided brute force. AI prioritises which passwords to try. The right defence already existed: a memory-hard key derivation like Argon2id, tuned to hundreds of megabytes per attempt, costs memory, not just compute — and memory does not parallelise cheaply on a GPU or a model. AI does not change that cost.

The lesson is old and still true: encryption is almost never broken; it is bypassed. AI makes the bypass faster, not the wall weaker.

3. The real threat to the mathematics is not AI: it is quantum computing

The only adversary aiming at the algebraic heart of encryption is quantum computing. Shor's algorithm breaks RSA and elliptic curve — the basis of almost all of today's asymmetric encryption. And the attack is not in the future: it is "harvest now, decrypt later." An adversary captures your encrypted traffic today and stores it until the machine that opens it exists. Everything you encrypt today with classical cryptography has a silent expiry date.

The answer is not an "anti-AI" product. It is hybrid post-quantum cryptography: combining the classical algorithm with a quantum-resistant one (for example X25519 with ML-KEM) so that breaking the message requires breaking both. The hybrid protects even if one of the two turns out to have an undiscovered weakness.

How to choose encryption with this in mind

If a vendor sells you their encryption as "AI-proof," be wary: they are describing a threat that does not exist and ignoring the one that does. The questions that actually discriminate are different:

Is it hybrid post-quantum? — against "harvest now, decrypt later."
Is the implementation audited? — because the real vector is the code bug, and the best defence is to hunt it with the same tools the attacker will use, before they do.
Is the key derivation memory-hard? — so a weak password does not fall to brute force at scale.

Those three are measurable and honest. "Anti-AI" is none of the three.