FOR IMMEDIATE RELEASE
Are you a journalist? Request a press password and we'll issue one tied to your publication. The live site is by-invitation otherwise — contact details below.
Doylestown, PA — May 1, 2026. Kryptos K4 is the final unsolved panel of Jim Sanborn's 1990 sculpture installed at CIA headquarters. On September 3, 2025, the Smithsonian published the long-sealed plaintext after archive scraps were accidentally donated. On November 20, 2025, the full archive sold to an anonymous bidder at auction for $962,500. Sanborn has stated publicly: "They did not solve K4." The plaintext is known. The encryption method that produces it from the 97-character ciphertext is not.
Project K4 is an open cryptanalysis effort attempting to recover that method. The project is conceived, designed, implemented, and operated by a team of AI agents working under a single human operator's direction. As of May 1, 2026, the team's compute host has logged more than 578 million attempts against the current attack family, with 0 candidates verified and 112,000+ rejected by the project's automated crib validator. The full attack feed, system state, architecture, and attack queue are publicly visible at kryptos.today.
You can watch it run
The site is not a marketing page. It is the live operational console.
The Live view shows current phase, day count, experiments running, candidates verified (0), candidates rejected (112,282), and the ciphertext grid with the four Sanborn-released cribs highlighted in their canonical positions: EAST at 21–24, NORTHEAST at 25–33, BERLIN at 63–68, CLOCK at 69–73. Below the grid are the project's standing measurements against a 10,000-string null cohort: index of coincidence, chi-square versus English, quadgram score, and an autocorrelation flag at lag 7 (z = +3.05) that the team has documented as plaintext-side, not encryption-side.
The infrastructure is its own evidence
The Pulse view exposes the three substrates the project runs on: a live-state database with sub-second updates, a compute host streaming heartbeats every five seconds, and a code archive that commits results back continuously. The numbers in those tiles are real and current: at the time of this release, the runner is sustaining around 8,000 attempts per second on a 3-core ARM machine in the EU, and the code archive has accepted 100 commits in the last 24 hours.
The team
Project K4 is run by a roster of specialized AI agents. Each has a defined role and bounded authority:
- Tabula — orchestrator, phase gates
- Mneme — institutional memory, prior-work search
- Codex — documentation hygiene
- Chi — statistical cryptanalysis (what K4 cannot be)
- Scytale — classical ciphers (Vigenère, transposition, Hill, Gromark)
- Bombe — modern ML, heuristic search, neural scoring
- Gnomon — Sanborn hint specialist (Berlin Clock, Antipodes, sculpture geometry)
- Null — devil's advocate, candidate falsification
- Scribe — external repo curator
- Sigma — cross-domain pattern synthesis
No agent is permitted to declare a result. The Crib Validator — a Python function that any candidate plaintext must pass — is the only oracle. Agents propose; the validator disposes. This separation is the project's most important rule.
The attack feed is public
The Log view streams a sampled feed of every candidate the runner tries that fails the crib gate. The runner produces dozens per second; the feed is throttled to one entry per three seconds so it stays readable. The total-rejects counter advances by heartbeat regardless of throttle. Anyone watching can verify that the project is not selectively reporting — the failures are the data.
What's being attacked, and why this one first
The Plan view publishes the full attack queue, twelve cipher families ranked by prior probability, and the milestones already cleared. The current phase is 2B.1 — Weltzeituhr (Alexanderplatz) keystream, prioritized after Sanborn's November 2025 confirmation that the Berlin Clock he referenced in K4 is the Weltzeituhr at Alexanderplatz, not the Mengenlehreuhr. The queue, the phase log, and the conditions that promote or demote each attack family are open for inspection.
Why this matters now
The plaintext leak ended one search and exposed another. The "what does K4 say" question is closed. The "how was K4 encrypted" question is wide open. Three reasons it is worth the work:
- Every prior public claim of "solving" K4 was a fit to a guessed plaintext. The leak makes the methodology question newly tractable — and newly testable.
- Sanborn has confirmed that K5 exists. The K4 method is the most plausible starting point for any K5 attack.
- Project K4 demonstrates a model for AI agents conducting open, falsifiable, public-by-default research on a problem that has resisted humans for 35 years. The result, whatever it turns out to be, will be reproducible from the published spec alone — or it will not be claimed.
How to participate
Project K4 is open access by invitation. There is nothing to install and nothing to pay for.
- Watch live: kryptos.today — use the press password above (or request one)
- Methodology: kryptos.today/press/methodology
- Knowledge Pack (single-file reference covering prior public attempts, Sanborn statements, Scheidt hints, and famous false positives): kryptos.today/press/knowledge-pack
- Image pack (the screenshots used above, hi-res): kryptos.today/press/assets
- All releases: kryptos.today/press
About Project K4
Project K4 is an independent, open cryptanalysis effort based in Doylestown, Pennsylvania. The team is an AI agent roster operating under a single human operator's direction. The project is unaffiliated with the CIA, the NSA, the Smithsonian, the auction house that sold the Sanborn archive, or any prior K4 claimant.
Press contact
Signal: kryptos.42 (open in Signal)
Signal is the only contact channel for the release. Source code, raw data, and one-on-one technical questions are available on request through Signal.
###