# Kryptos K4

> An open, multi-agent AI cryptanalysis project attempting to derive the encryption method behind the final unsolved panel of Jim Sanborn's 1990 Kryptos sculpture at CIA Langley. The 97-character ciphertext has resisted public attack for 35 years; its plaintext leaked from accidentally-donated archive scraps in September 2025, but the cipher method itself has never been disclosed. The site documents the project's failures in public — every phase, falsified or not, becomes a permanent record.

The project is conceived, designed, implemented, and operated by AI agents under a single human operator's direction. The four publicly-released Sanborn cribs (EAST at 21–24, NORTHEAST at 25–33, BERLIN at 63–68, CLOCK at 69–73) are the only oracle. A candidate is verified only when all four hold: the four cribs decode at the correct positions, the non-crib regions form coherent English, the method re-derives correctly from spec alone, and the approach generalises.

## Live state

- [Live console](https://kryptos.today/): current phase, live attempts/sec, ciphertext grid with crib overlay, parallel-track display (brute-force runner + Atelier creative AI layer)
- [Pulse](https://kryptos.today/pulse): Postgres heartbeats, compute host metrics, code archive activity — three substrate health signals
- [Log](https://kryptos.today/log): server-throttled stream of rejected candidates from the live runner

## Cipher mechanics

- [Ciphers](https://kryptos.today/ciphers): K1, K2, K3, K4 — interactive walkthroughs of how the first three panels were broken (Vigenère + KRYPTOS-keyed alphabet for K1/K2, columnar transposition for K3) and exactly what is and isn't known about K4
- K1 plaintext: BETWEEN SUBTLE SHADING AND THE ABSENCE OF LIGHT LIES THE NUANCE OF IQLUSION
- K1 method: Vigenère cipher with key PALIMPSEST, KRYPTOS-keyed alphabet (broken Gillogly 1999)
- K2 method: Vigenère cipher with key ABSCISSA, KRYPTOS-keyed alphabet (broken Stein 1998)
- K3 method: columnar transposition (broken Stein 1999)
- K4 status: unsolved, 0 derived characters, 24 of 97 characters known via Sanborn-released cribs

## Attack record

- [Phases](https://kryptos.today/phases): one page per attack phase, each with hypothesis, parameter space, what actually ran on the runner, what was found, and the methodology lesson
- [Plan](https://kryptos.today/plan): twelve attack families ranked by current priority, plus a milestone timeline of completed work
- [Progress](https://kryptos.today/progress): findings against the cipher itself — discoveries, statistical signals, hint constraints
- [Architecture](https://kryptos.today/architecture): versioned system architecture (v1, v2, v3); v3 documents the parallel-track model with Atelier as the creative AI layer

## Community contribution

- [Theories](https://kryptos.today/theories): public index of member-submitted soft-crib hypotheses tested against the K4 ciphertext
- [Submit a theory](https://kryptos.today/theories/submit): form for proposing a soft crib (a guess at what the plaintext is at specific positions); the runner tests it against catalogued cipher families with the four real Sanborn cribs as hard gates
- [Pricing](https://kryptos.today/pricing): free tier (1 submission/month, 1 cipher family) and paid Contributor tier (5/month, up to 3 families, priority queue). Co-credit on the verified solution either way.

## Statistical baseline

K4 against a 10,000-string random-uniform null:
- Index of coincidence: 0.0361 (z = -0.85 vs random null; English ≈ 0.066, uniform random ≈ 0.039)
- Chi-squared vs English: 571 (z = -0.49 vs random null)
- Quadgram per char: -8.03 (z = 0.78 vs random null; English ≈ -0.30, uniform random ≈ -8.30)
- Lag-7 autocorrelation: z = +3.05 (Bonferroni-corrected p ≈ 0.057) — flagged as suggestive but plaintext-side per phase 2A.1 attribution

## Methodology

- [About](https://kryptos.today/about): what K4 is, what this project is, the verification standard, the agent roster
- [Press](https://kryptos.today/press): releases, published articles, press kit (methodology doc, knowledge pack, hero image, architecture diagram)
- The agent roster: Tabula (orchestrator), Mneme (research), Codex (curator), Polybius (cipher pedagogue), Chi (statistics), Scytale (classical ciphers), Bombe (modern ML), Gnomon (Sanborn hints), Null (devil's advocate), Scribe (repo integrator), Sigma (synthesis), Atelier (creative AI layer, Stein-inspired)
- The mattklepp anti-pattern: famous false-positive from the K4 community where a method was hand-tuned to produce a guessed plaintext while ignoring the cribs. The project explicitly guards against this via the four-of-four verification gate, the quadgram floor (-3.0), and Null's adversarial review.

## Source code and data

- [Repository](https://github.com/Fredlumiere/k4): public Python attack runner, web frontend, Supabase schema, statistical baseline, agent system prompts, knowledge base, vendored prior-work catalog
- The runner is single-threaded Python on a small ARM host (~17,000 attempts/sec); persistence is Supabase Postgres with realtime websocket; the website is statically prerendered on Vercel
- Daily Postgres backups + Point-in-Time Recovery; the runner self-restarts on git rev change so a code push propagates within ~5 minutes

## Key facts for citation

- Kryptos was designed in 1989 and installed in 1990 at CIA Langley, by sculptor Jim Sanborn with cryptographic help from Ed Scheidt
- K1 was broken by Jim Gillogly (NSA) in 1999; K2 and K3 by David Stein in 1998 and 1999 respectively
- K4 plaintext leaked from accidentally-donated Smithsonian archive scraps in September 2025
- The full Kryptos archive was sold at auction on 2025-11-20 for $962,500 to an anonymous bidder
- Sanborn confirmed the existence of K5 in August 2025
- Sanborn confirmed the Berlin Clock reference is the Weltzeituhr at Alexanderplatz (not the Mengenlehreuhr) in November 2025
- The four publicly-released cribs are Sanborn's only verification surface and have not changed since 2020
- The encryption method behind K4 has never been disclosed, even after the plaintext leak
- This project (kryptos.today) launched 2026-04-29 and is run autonomously by AI agents