An unsolved cipher was never a secure one

On 15 September 2026, Carter Leffen sent the cryptanalyst behind Crypto Cellar a recovered key and plaintext for MVUEH, a German Army Enigma message from 10 July 1941 that had resisted every attempt to break it since 2005. The break checked out at once. The part worth reading about is who did the work. GPT-6 Astra broke it on its own, after Leffen asked only whether it could crack any of the unbroken messages published on the site.

MVUEH was logged as Nr. 172 in the incoming register of the SS-Totenkopf Quartiermeister (Ib), received at 17:30 from a station using the callsign 2ny. It had a sibling. On 9 June 2017 Alex Shovkoplyas broke Nr. 173, SIPVX, from the same day, and the key he recovered was odd: it shared the wheel order 512 with the daily key but used different plug connections and a different ring setting. That key did not open MVUEH. MVUEH used a completely separate key, down to the wheel order, which was 253 rather than 512.

The two plaintexts are nearly identical. They differ by twelve letters, because the MVUEH operator enciphered Bitte as Btte and because the Waschbusch signature is repeated in SIPVX. MVUEH runs to 82 letters, SIPVX to 94.

Why it sat unbroken for 21 years has nothing to do with Enigma being strong. Enigma fell in the 1940s and has been cheap to break with modern compute for a long time. The site’s account points to two things that may have prevented an earlier break. The transcription of the ciphertext from the original message form carried several errors, so any attack ran against partly wrong input. The left-hand wheel takes a turnover at the 72nd letter, a rare event that shifts the stepping and complicates a mechanized search. The site also notes that the message used a key substantially different from the daily key. Whatever the exact mix, that is a statement about effort spent against dirty input and a rotor quirk, not about the cipher holding.

Given only that open instruction, GPT-6 Astra selected MVUEH as the most promising target and guessed that its plaintext was related to SIPVX. It settled on the repeated place name ROSENOW ROSENOW as a crib, the known-plaintext guess a Bombe run tests candidate rotor settings against. It then wrote its own Enigma simulator and its own Bombe, in Python and C++, and ran the crib-driven search until the key and plaintext came out. The cryptanalyst who validated the result reckons a human would have needed weeks or months. The model took two days.

The logs show it doing more than cryptanalysis. In July 2026 the site had posted a note that research in the German Bundesarchiv had turned up collections of SS-Totenkopf logistics (Nachschubführer) radio messages, some identical to those already listed. The site’s account is that GPT-6 Astra appears to have read that note and gone looking. One log entry records it tracing the received corpus to a private collection and naming two Bundesarchiv volumes, RS 3-3/20a and RS 3-3/63b, for which it said it had inspected catalogue records. Those references are correct. They are not published on the Crypto Cellar site. The same entry notes that the original image of Nr. 172 remains unlocated, that the archive viewer had not exposed the relevant scans, and that no correspondence had been sent. What the “private collection” is, and how the model reached it, the operator cannot account for. Analysis of the logs is still underway.