Post-Quantum Saturday — August 22 2026 Weekly Update

TL;DR — This Week

1. Simon's polynomial-time DCP claim has been refuted — formally, and machine-checked. Gupte (MIT), Ragavan (Google Quantum AI / MIT) and Zhandry (Google Quantum AI / Stanford) posted ePrint 2026/1693 (approved August 15): "The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP." Their result is not a critique of Simon's proof — they show the algorithm itself cannot possibly work: after step 3 the algorithm never touches the classical Fourier labels again, and it can be implemented (up to error poly(n)·2^(−n/3)) using only the most-significant third of those labels — which is provably not enough information to extract the DCP secret's least-significant bit. Discarding as few as ω(log n) bits per label hides the answer information-theoretically. They close the obvious escape: either the algorithm is wrong, or its expected runtime is Ω(2^(n/9)) — it cannot be both subexponential and correct. Lean 4 code is released (github.com/sragavan99/lean-ePrint-2026-1591-refutation) so the result can be machine-checked. The kicker: Ragavan is one of the two personal-communication sources Simon's own paper cited for its SVP/LWE corollary — he is now a co-author of the refutation. Nine days from claim to no-go.

2. The verification arc that produced it was open, fast, and AI-assisted. Between Aug 6–15, a qcryptanalysis Discord effort (Bernstein, Kirshanova, Apon, Jaques, with Simon participating) converged on Lemmas 3–4 as the failure sites. Daniel Apon (Anduril, ex-NIST) published "The Search for Simon" (Aug 9) proving the generic proof strategy requires a missing theorem he calls AQSE and has no local repair, then stated Aug 10 he believed Lemma 3 false. Simon posted a revised draft Aug 11 defending Lemma 3; Apon answered the same night with a one-page counterexample (github.com/a-as-plus-e/lemma3-objection) showing the pairwise-independence the lemma needs fails by construction. A separate analysis found Lemma 4's substitution on p.14 replaces a doubly-cancelling signed sum with a non-negative quantity, making the amplitude ratio positive by construction — structurally incapable of detecting the catastrophic ρ ≈ −1 failure mode. Kirshanova's independent AI-assisted check converged on the same Lemma-4 bug. The no-go theorem subsumes all of this for a broad class of Regev-template algorithms.

3. RFC 10024 published (August 2026): hybrid PQ/T key agreement for TLS 1.3 is a Proposed Standard. The hybrid X25519MLKEM768 / ECDHE+ML-KEM constructions — deployed by Chrome, Cloudflare, Google, AWS, Apple — now have their permanent, cited-everywhere RFC (Kwiatkowski, Kampanakis, Westerbaan, Stebila; AD Paul Wouters; was draft-ietf-tls-ecdhe-mlkem). The endorsed default for TLS transport PQ is no longer a draft. Meanwhile pure ML-KEM TLS (draft-ietf-tls-mlkem) remains unpublished — IESG state unchanged after the Last Call closed Aug 13. freenode.net (Aug 16) documented Bernstein's four-part Aug 11 filing: 75 sourced, non-withdrawn objections from the third WGLC, none addressable by document edits; his claim that the last-call moderators blocked the series from last-call@ietf.org (with timestamped archive links), and a demand that the chairs publish the record they filed in secret. An RFC 2026 formal complaint on the consensus call is signalled. If the IESG approves publication, the appeal path is fully prepared.

4. The attack line the refutation does not touch: Wen–Zheng stands. The CRYPTO 2026 Module-LWE ↔ IP-M-EDCP ↔ EDCP bridge (ePrint 2026/155) is peer-reviewed mathematics independent of Simon's algorithm — it now points at a target with no known poly-time solver. The research program is intact; only the claimed solver is dead. Bai et al.'s CRYPTO 2025 quasi-polynomial EDCP algorithm remains the genuine algorithmic advance in this line. Kuperberg 2005 (2^O(√n)) remains the best actual DCP algorithm. Post-refutation, "the exponents of LWE attacks are continuing to drop" (Bernstein, Aug 11 last-call message) — but nothing has changed for deployed parameters.

5. Backfill (missed by prior updates): Anthropic's Claude Mythos Preview recovered HAWK-256 challenge keys (July 28 disclosure). Two HAWK-256 challenge public keys → signing-equivalent keys in hours on one server, via a Galois involution (ζ → −ζ) in HAWK's power-of-two cyclotomic ring that roughly halves the SVP oracle dimension (Straznickas & Weis, anthropic.com/document/hawk_key_recovery.pdf). A separate team independently attacked the same scheme with GPT-5.6. Mythos also improved the best-known attack on 7-round AES-128 (a 13-year-old record). No deployed system affected — HAWK is a NIST Round 3 candidate; the AES result needs 2^105 chosen plaintexts against 7 of 10 rounds. This is a tier-2 (algorithm-design) event, not tier-3: module-LIP in general is intact; HAWK's specific ring choice is the flaw; reparameterization (different ring conductors) is the fix. What changed is economics: a publishable cryptanalytic result now costs ~$100K and a week of model time.

6. Backfill: Classic McEliece quasipolynomial distinguisher (ePrint 2026/1630, Aug 10). Ghoshal, Ishai, Jain, Sun (IIT Madras / Technion+AWS / CMU) gave a classical n^O(log n) distinguisher for binary Goppa codes — the first structural distinguisher cheaper than information-set decoding (2^114–2^124 vs 2^151–2^287 Boolean-circuit cost) on every NIST parameter set, with no heuristic assumptions. Not a break: Classic McEliece never claimed public-key pseudorandomness (OW-CPA + CCA conversion). But the quantitative argument that made structural attacks easy to dismiss is gone — relevant to HQC-diversification planning since code-based confidence now rests on "generic decoding is the floor" for both KEM families' code branch.

7. Google Cloud attached dates to its PQC migration (Aug 11 post; Ivezic analysis Aug 13). Domain 1 (SNDL mitigation): end-2027 — quantum-confidential ALTS done 2025, API endpoints + load balancers done 2026, Cloud VPN / Interconnect / GCE OS Login / SDK / gcloud / GKE mesh 2026–27; hybrid TLS on LBs enabled-by-default after Oct 2026, always-on after Oct 2027. Domain 2 (integrity/non-repudiation): end-2028 — Binary Authorization 2026, Assured OSS 2027, CA Service 2027, Cloud IAM 2028, Google Trust Services MTC support 2028. Domain 3 (foundations/KMS): end-2028 — ML-KEM/ML-DSA/SLH-DSA in Cloud KMS already GA. Signatures trail confidentiality by exactly one year across the board.

8. CRYPTO 2026 concluded Aug 17–20 (Santa Barbara, 189/781 papers). The venue where hallway verdicts on Simon's preprint were expected — but the no-go landed first (Aug 15). From the program: practical lattice proof systems maturing (LaZer/LaBRADOR aggregate-signature comparisons — proof size and prover time favor lattices, verification ~10× slower), Bennett–Lai–Stephens-Davidowitz "advanced cryptography from lattice isomorphism" (new IBE and FHE from LIP — the same problem family HAWK uses, now building on it instead of only breaking it), and the Wen–Zheng equivalence in the proceedings. No post-conference statement from Simon as of Aug 22.

Freedom-tech implication: the scare of Aug 6 is dead; the discipline it demanded survives. Nothing about the deployment posture changes — hybrid X25519MLKEM768 for transport (now RFC 10024, citeable), hybrid Ed25519+ML-DSA for signatures, SLH-DSA as conservative backbone, HQC tracked for 2027, crypto-agility as architecture. The two durable lessons from the nine-day arc: (1) open verification works — Discord + Overleaf + Lean machine-checking compressed a community verdict from months to days, a model for every future claim; (2) the AI-cryptanalysis economics shift ($100K/week per publishable attack) means tier-2 findings will arrive at a cadence standardization processes weren't designed for — the agility argument is now an AI-cadence argument. And the backfilled HAWK story sharpens the Round 3 watch: one of the nine candidates took a ring-specific key-recovery hit in July; its reparameterization response is the thing to watch through the ~2027–28 evaluation window.

The Week in Detail

1. The Refutation — How the Claim Died in Nine Days

Paper: Aparna Gupte (MIT), Seyoon Ragavan (Google, MIT), Mark Zhandry (Google, Stanford), "The ePrint:2026/1591 Quantum Algorithm Does Not Solve DCP," ePrint 2026/1693, received and approved August 15, 2026.

The theorem, plainly

The refutation is stronger than a proof-gap objection. It is an impossibility result about the algorithm, not the analysis:

• What Simon's algorithm throws away. After step 3, the algorithm never touches the classical Fourier labels again — and step 3 uses them only through the top log n bits of each block's inner product. Because the blocks are short, the low bits of those labels almost never change the output, so the entire step-3 state can be reconstructed from roughly the top third of each label.
• Why that is fatal. GRZ prove that any algorithm following Regev's 2004 template and keeping only that much information cannot distinguish the secret's least-significant bit with advantage better than poly(n)·2^(−n/3). Discarding as few as ω(log n) bits per label is enough to hide the answer information-theoretically. No repair to the analysis rescues an algorithm that has already discarded the answer.
• The dichotomy. Either the algorithm is wrong, or its expected runtime is Ω(2^(n/9)). It cannot be both subexponential and correct.
• The scope. The no-go "encompasses a much broader class of algorithms than the specific algorithm by Simon." Main message: DCP algorithms on Regev's template "will probably have to make extensive use of the classical Fourier labels in the uncomputation stage."
• The machine-checking. Lean 4 code released at github.com/sragavan99/lean-ePrint-2026-1591-refutation — the refutation itself can be verified by proof assistant, a level of rigor beyond the claim it kills.

The authors stop short of claiming no repair path exists at all ("not aware of a repair path that meaningfully circumvents our theorem") — but any repair would have to abandon the algorithm, not fix its proof.

The personal-communication irony

Simon's final corollary (the SVP/LWE parameter statement) rested on unpublished personal communications from Seyoon Ragavan and Daniele Micciancio. Ragavan is now a co-author of the refutation. Whatever he communicated privately in early August, his published position by Aug 15 was that the algorithm cannot work. The other corollary source (Micciancio) has not published a statement either way.

Timeline of the nine days

What it means, calibrated

• For deployed crypto: nothing. "On the evidence available today, the lattice assumptions under ML-KEM and ML-DSA sit where they sat on July 30" (Ivezic). Migration guidance "fails to change for a boring reason rather than an uncertain one."
• For the research program: direction intact, solver dead. Wen–Zheng (CRYPTO 2026) still maps Module-LWE into dihedral territory; Bai et al. 2025 still gives the genuine quasi-polynomial EDCP advance; Kuperberg 2005 still bounds what's actually achievable. The invitation to attack IP-M-EDCP stands.
• For epistemics: the base rate held. Chen 2024 → withdrawn in days. Luo 2026 → fatally flawed. Simon 2026 → refuted in nine days. Three loud claims, three deaths, each caught by open expert scrutiny plus, now, machine checking. The system works — and it is getting faster at working.
• For history: a near-symmetry that didn't happen. Had it survived, the researcher whose 1994 algorithm enabled Shor's would have produced the lattice counterpart 30 years later. Instead the episode becomes the textbook case for why preliminary-draft claims get 9-day treatment: the author's stature accelerates verification, it does not lower the standard of proof.

Sources: ePrint 2026/1693 (eprint.iacr.org/2026/1693); ePrint 2026/1591; IACR News entry (Aug 15); PostQuantum.com Simon analysis with Aug 15 update (Ivezic); github.com/sragavan99/lean-ePrint-2026-1591-refutation; github.com/a-as-plus-e/lemma3-objection; Regev, SIAM J. Computing 2004.

2. What Survives the Refutation — Wen–Zheng, Bai et al., and the Real Attack Line

The reduction chain, redrawn post-refutation:

            published, peer-reviewed                  REFUTED (Aug 15, 2026)
  ┌────────────────────────────────────┐    ┌─────────────────────────────┐
  ML-KEM / ML-DSA (Module-LWE)          │    │  Simon's poly-time DCP      │
     ↕ Wen–Zheng (CRYPTO 2026)          │    │  solver — proven NOT to     │
  IP-M-EDCP ──→ EDCP ──→ DCP ───────────┼────┤  work (GRZ no-go, Lean 4)   │
     (BKSW 2018, Regev 2004 lineage)    │    │  Best actual: Kuperberg     │
  └────────────────────────────────────┘    │  2^O(√n), unchanged since '05│
                                            └─────────────────────────────┘

• Wen–Zheng (ePrint 2026/155, CRYPTO 2026) is untouched. The equivalence between search Module-LWE and IP-M-EDCP over power-of-two cyclotomics with constant module rank — exactly ML-KEM's setting — is published mathematics. What it lost is its would-be customer: a claimed poly-time DCP solver. What it keeps is its value as a map: any future DCP/EDCP advance has a signposted route toward ML-KEM's ring family. Their open-problem invitation (attack IP-M-EDCP; is it strictly easier than EDCP?) remains the live question.
• Bai et al. (CRYPTO 2025, ePrint 2025/1046) remains the real algorithmic advance. Quasi-polynomial EDCP over power-of-two moduli, constrained by sample/modulus limits from reaching standard parameters. The un-poly'd frontier.
• Kirshanova's two observations from the verification effort (recorded during the arc, independent of the refutation): if-correct the algorithm solved worst-case unique-SVP (harder than LWE); and the noisy-sample tolerance "is irrelevant, it's never used." Historical footnotes now, but they document how the community read the claim's ceiling.
• The concentration-risk point stands anyway. A vault whose entire PQ estate is Module-LWE family (ML-KEM + ML-DSA + FN-DSA would be two families) has a nameable correlation. HQC (2027) and SLH-DSA (now) remain the diversification levers — unchanged from last week, for reasons that are now boring rather than urgent.

Sources: ePrint 2026/155; ePrint 2025/1046; PostQuantum.com Wen–Zheng analysis (Ivezic, Aug 6).

3. TLS: RFC 10024 Published; Pure ML-KEM Still in IESG Limbo

The hybrid RFC

RFC 10024 — "Post-Quantum Traditional (PQ/T) Hybrid Key Agreement Mechanisms for TLS 1.3" (Kwiatkowski / Kampanakis / Westerbaan / Stebila; responsible AD Paul Wouters; was draft-ietf-tls-ecdhe-mlkem) published August 2026 as Proposed Standard. Datatracker last-updated Aug 10, 2026.

This is the RFC behind X25519MLKEM768 — the hybrid already carrying most PQ-protected web traffic (Cloudflare >65% of human traffic as of April 2026, per the tracker). Practical consequences:

• The endorsed default is now citeable in procurement, compliance, and code documentation as an RFC rather than a draft. Trivial-seeming; matters enormously for enterprise and government migration paperwork (the DigiCert/HKMA execution-gap data from last week showed documentation friction is a real barrier).
• The hybrid/pure asymmetry is now starker: Recommended=Y Standards-Track RFC 10024 vs Recommended=N Informational draft (if it publishes at all). The IANA registry keeps pointing deployments to hybrid.
• For Hybrid KEM Migration: update references from draft-ietf-tls-ecdhe-mlkem → RFC 10024.

The pure draft, after Last Call

As of Aug 22, draft-ietf-tls-mlkem remains unpublished; the datatracker state (In WG Last Call — Revised I-D Needed / I-D Exists; shepherd none) reflects the contested history rather than post-Last-Call progression. The IESG decision promised "in the coming weeks" has not landed.

freenode.net (Aug 16, "Bernstein documents 75 objections the IESG cannot edit away") assembled the record of the final days:

• The 75. From 82 registered "unambiguous, non-withdrawn opposition" messages in the third WGLC, Bernstein narrowed to 75, quoted one line from each, and archived every original — excluding pre-WGLC opposition, other venues, chair-blocked messages, and ambiguous phrasing "in the interests of avoiding any accusations that the quotes overstate the level of opposition." He verified none of the 75 suggested document modifications could remove the objections. As Izzy Grosof put it: "The performance improvements of a non-hybrid approach are trifling; the security risks are immense."
• The denominator. The chairs' "roughly 7/10 WG participants favor advancing" claim came only after restricting the count to "pre-existing WG participants" — a denominator chosen after the objections arrived. Bernstein demands the IESG state, on the record, what weight each of the 75 objectors receives, and answer each substantive objection individually.
• The blocked filing. Bernstein reports his four Aug 11 messages "appeared promptly on tls@ietf.org but not on last-call@ietf.org," with timestamped archive links. If the moderators of the IESG's own comment process blocked the most thorough opposition filing during the window, "the last call was not a last call. It was theater."
• The private-record problem. The shepherd writeup moved "details regarding past appeals and mailing list conflicts" to private email with the responsible AD. Bernstein argues this violates RFC 2026's public-record requirement and has signalled a formal complaint.
• No language models. Bernstein states the filing was assembled without LLM assistance "precisely so the record would be accurate and checkable" — a pointed contrast with the week's other big cryptanalysis story (§5).

Watch: the IESG telechat agenda, an RFC 2026 complaint, and appeals from whichever side loses. All three scenarios from last week's table remain live.

Sources: datatracker.ietf.org/doc/rfc10024; datatracker.ietf.org/doc/draft-ietf-tls-mlkem; freenode.net Aug 16 analysis; mailarchive.ietf.org last-call and tls threads (Aug 11–13); PostQuantum.com Last Call analysis (Ivezic, July 30).

4. CRYPTO 2026 Wrap — The Conference the Refutation Upstaged

CRYPTO 2026 (46th, Santa Barbara, Aug 17–20; Heninger & Rosulek chairs; 189 full papers from 791 submissions) ran the week after the no-go landed. (Last week's note said 781 — the accepted-papers page was the source; treat 781/791 as a transposition discrepancy until checked against Springer proceedings.)

Signals from the program and IBM's conference writeup:

• Lattice proof systems are the practical frontier. Comparisons of aggregate signatures from Falcon via LaZer (Lyubashevsky–Seiler–Steuer, CCS 2024) + LaBRADOR (Beullens–Seiler, CRYPTO 2023): lattices win proof size and prover time, lose ~10× on verification. "Slower verification is the main obstacle to adoption of succinct lattice-based proof systems" — relevant to STARKs-adjacent and ZK-lattice convergence.
• Lattice isomorphism cuts both ways. Bennett–Lai–Stephens-Davidowitz (ePrint 2026/465, CRYPTO 2026): new IBE and FHE constructions from lattice isomorphism — building advanced crypto on the same problem family Mythos just attacked HAWK over (§5). The week the ring-specific weakness was old news, the general problem got more useful.
• Wen–Zheng in the proceedings — the bridge paper is now formally part of the record.
• No Simon statement. As of Aug 22: no withdrawal note on ePrint 2026/1591, no post-refutation response, no announced repair attempt. The Lean-checked no-go sits unanswered.

Sources: crypto.iacr.org/2026 program; IBM Research "IBM at Crypto 2026" writeup; ePrint 2026/465.

5. Backfill — AI Cryptanalysis Goes Tier-Two (July 28)

Missed by the July and August updates; material for the risk picture and covered here for the record.

Event: Anthropic disclosed July 28 that Claude Mythos Preview (frontier cryptography research model) recovered signing-equivalent keys from two HAWK-256 challenge public keys, in hours, on a single server. A separate team independently attacked HAWK through a different mathematical path using GPT-5.6. In the same release, Mythos improved the best-known attack on 7-round AES-128 (standsince-2013 record; requires 2^105 chosen plaintexts; full 10-round AES unaffected).

The HAWK attack (Straznickas & Weis, anthropic.com/document/hawk_key_recovery.pdf): every prior module-LIP attack worked through complex conjugation; Mythos used a different order-2 Galois involution (ζ → −ζ), showed the associated cocycle sits as a shortest vector in a rank-n lattice computable from the public key, then Ducas block reduction + van Gent–Pulles descent (ePrint 2025/928) reduces key recovery to exact-SVP calls in dimension n/2 + 1. The HAWK paper itself confirms the flaw follows the algebra (it identifies which ring conductors evade the attack) — a specification-level weakness, not an implementation bug.

Tier discipline (Ivezic's framing, worth keeping in this library):

Economics: a publishable cryptanalytic result now costs ~USD 100,000 and a week of model time; three independent efforts produced attacks on three cipher families within days of each other. For freedom-tech: the AI-cadence argument for crypto-agility — tier-2 findings will arrive faster than standardization cycles were designed to absorb.

Round 3 impact: HAWK remains one of nine NIST additional-signature candidates (lattice family representative). Its reparameterization response and the evaluation committee's treatment of the ring-symmetry result through the ~2027–28 window is now a named watch item. June's "former NIST cryptographer identified flaws in the June HAWK attack-paper heuristics" (covered in the June updates) is now prologue: the July result is the confirmed, non-heuristic version.

Sources: anthropic.com/research/discovering-cryptographic-weaknesses; anthropic.com/document/hawk_key_recovery.pdf; PostQuantum.com analysis (Ivezic, July 29); ePrint 2025/928.

6. Backfill — Classic McEliece Quasipolynomial Distinguisher (Aug 10)

Paper: Ghoshal (IIT Madras), Ishai (Technion + AWS), Jain & Sun (CMU), "Quasipolynomial Cryptanalysis of the McEliece Cryptosystem (or: PIR Meets McEliece)," ePrint 2026/1630 (received Aug 7, approved Aug 10).

• What it does: decides whether a matrix generates a Classic McEliece public code or a uniform random binary code, in classical time n^O(log n). Hold out one column; compute multilinear homogeneous polynomials of degree d whose order-<s Hasse derivatives vanish on remaining columns; check vanishing at the held-out column. Goppa keys force this (Hermite interpolation); random matrices fail with constant probability. Multiple hold-outs amplify to 1−o(1).
• The numbers: 2^114 (mceliece348864) → 2^124 (mceliece8192128) Boolean-circuit cost vs information-set decoding's 2^151–2^287 for the same sets. Storage 2^66.45–2^71.37 bits (13–380 EB, unoptimized). Previous best structural distinguisher (Hemmert–Wiemers 2025/1661 + key-recovery extension 2026/1339): 2^298–2^691.
• Why it is not a break: Classic McEliece never claimed public-key pseudorandomness — OW-CPA on the encryption primitive + tight CCA2 conversion. No security claim fell. ISO added Classic McEliece to its asymmetric-ciphers standard June 2026.
• Why it matters anyway: staying above generic-decoding cost was "the quantitative argument that made structural attacks easy to set aside, and that argument is gone" — the first heuristic-free structural distinguisher cheaper than ISD on every NIST parameter set. Improves on Randriambololona's Eurocrypt 2025 Best Paper syzygy distinguisher (which leaned on Betti-number heuristics). The subtitle ("PIR Meets McEliece") hints the technique came from PIR research — a cross-pollination to note for the PIR research line.
• HQC connection: HQC uses quasi-cyclic codes, not Goppa codes — not directly affected. But the code-based-diversification thesis now carries a asterisk: the other code-based KEM's structural margin story changed this month. Track the HQC standardization timeline (2026–27) with this context.

Sources: ePrint 2026/1630; classic.mceliece.org; PostQuantum.com analysis (Ivezic, Aug 10); Bernstein & Chou CryptAttackTester (ePrint 2023/940).

7. Google Cloud's Dated Roadmap (Aug 11) — The Execution-Gap Counterpoint

While HKMA banks score 2.3/10 and DigiCert respondents cite legacy complexity as barrier #1, Google Cloud published the most granular hyperscaler migration schedule yet (Haridas & Bachman post; Ivezic analysis Aug 13):

Load-balancer hybrid TLS: opt-in today → enabled by default after Oct 2026 → always-on after Oct 2027. API endpoints already run ML-KEM hybrid. Signature dates (Domain 2) trail confidentiality by a year across every line — the Cloudflare thesis ("ML-DSA will have to do," see the Aug 01 update) reproduced at Google scale. The PLANTS/MTC dependency shows up precisely here: Google Trust Services MTC support dated 2028, aligned with the PLANTS draft's RFC trajectory.

Freedom-tech read: the pattern to copy is the three-domain split (confidentiality / integrity / foundations) with per-service dates and a customer-journey risk ordering — it is the structure the HKMA found missing in banks. And the MTC 2028 date is another independent data point for Merkle Tree Certificates timeline modelling.

Sources: cloud.google.com blog (Haridas & Bachman, Aug 11); PostQuantum.com analysis (Ivezic, Aug 13); Google Quantum Threat Model (bughunters.google.com); docs.cloud.google.com PQ-TLS docs.

Evidence at a Glance

The Nine-Day Verification Arc — Process Lessons

The Simon episode (Aug 6 → Aug 15) is the fastest community refutation of a high-stakes cryptographic claim on record, and the process deserves as much attention as the mathematics:

1. Open venue, expert density. The qcryptalysis Discord assembled Bernstein, Kirshanova (BKSW co-author — the paper being built on), Apon (ex-NIST), Jaques within days, with the author participating. Kirshanova worked in an open Overleaf; Apon published his negative assessment on LinkedIn the same day he formed it.
2. AI as accelerant, not authority. Kirshanova reported her AI-assisted analysis independently found the Lemma-4 substitution bug — the same site the human analysis identified. Machine assistance compressed the search; humans signed the findings. (Contrast §5: the same class of AI found a real tier-2 break in HAWK.)
3. Machine-checked refutation. GRZ shipped Lean 4 code. The claim was an unverified preprint; the refutation is a verified theorem. The rigor asymmetry is the story: skepticism got the stronger formal tools.
4. Author engagement is not consensus. Simon participated, acknowledged gaps, and posted a revision — which Apon countered within hours. Participation accelerated convergence on where the problem was; it did not soften the verdict on whether.
5. Base rate updated, again. Chen 2024 (withdrawn in days), Luo 2026 (fatally flawed), Simon 2026 (no-go in nine days). The pattern for extraordinary quantum-lattice claims from serious authors: initial credibility high, survival rate zero so far. Plan verification capacity for the next one — it will arrive on AI timescales.