GPT-6 Astra broke a 1941 Enigma message. Here is what makes it checkable
A user pointed Astra at Crypto Cellar's unsolved messages. It wrote its own Enigma simulator and Bombe software, and a named expert confirmed the key. An independent review of the logs is still pending.
A known crib, a key anyone can re-run, and a named validator. That is more than the last AI cipher claim had.
A German Army Enigma message from 10 July 1941, filed as MVUEH, sat unsolved on Frode Weierud's Crypto Cellar site from 2005 until this month. It is 82 letters long. On September 15, 2026, Carter Leffer (spelled Leffen in some coverage), who does not work for OpenAI, sent Weierud a solution produced with GPT-6 Astra. Weierud checked it and published the break on September 17.
The history fits in two sentences. The message went to the supply officer of an SS division and asks for a route of march and an immediate radio reply. It is almost identical to a neighboring message, SIPVX, which was already solved.
What the model did
Leffer asked Astra to try the unbroken messages on the site. Astra picked MVUEH, spotted its link to SIPVX, and wrote its own Enigma simulator and Bombe search software in Python and C++. It used the sender's location, repeated as ROSENOW ROSENOW, as a crib: a guessed stretch of plaintext that narrows the search. The run took about 10 hours at OpenAI's highest reasoning setting, The Decoder reported. The key uses wheel order 253, which differs from the other keys recorded for that day.
Why this claim is easier to check
At the end of August, a claim that Claude Fable 5.1 had solved a 370-year-old cipher fell apart within a day, because the claimed method could not produce the claimed message. An Enigma key is a small, exact object. Set a simulator to the wheel order, ring settings and plugboard, type the 82 letters, and readable German comes out or it does not. Weierud says he saw at once that the key and plaintext were correct.
What is still missing: Weierud wrote on Bruce Schneier's blog that he does not have all the logs, and that he is unsure how Astra found the Bundesarchiv file references it cited. The Decoder notes the materials do not show the solution is unique, and no independent review has been published. On Hacker News, commenters disputed calling the run unaided, pointing to open-source Enigma tools and to what the model may have seen in training. OpenAI has not commented.
Why a build studio cares
Model capability claims reach clients as screenshots, and most of them are the Fable kind: impressive, and impossible to re-run. MVUEH shows what a claim worth taking seriously looks like. The output can be checked mechanically, a named expert checked it, and the gaps are on the public record. When a vendor says its agent solved something, ask for the same three things: the artifact, the check, and the logs. The logs are usually the missing part, as they partly are here.
Next step: read Weierud's write-up. It lists the key, so you can put it into any Enigma simulator and check the result yourself. If AI output is going into your product with no mechanical check behind it, write to us at hello@gattyworks.com.