On 10 July 1941 a German soldier transmitted 82 characters of Enigma ciphertext: he was in the town of Rosenau, he needed instructions for his march route, and he wanted an answer by radio immediately. For 83 years nobody could read it. Carter Leffen, of Bloomberg LP in New York, broke it using OpenAI's GPT-6 Astra — the Astra Extra High variant worked the problem for roughly ten hours — and published the code, the search data and a working three-dimensional Enigma simulator so the result can be replayed.
The message, designated MVUEH, sat in an archive of intercepted German army radiograms and was listed as unsolved. Enigma was one of the principal cipher devices of its era, first broken in 1932 by the Polish mathematician Marian Rejewski, and the machine offered roughly 159 quintillion possible daily settings. Searching that space directly was never the route in; it was not the route in here either.
The first attempts failed. Keys already known for that same day did not fit the message, and automated search produced nothing useful.
The break came from a message sent the same day that had already been decrypted. In it, the place name Rosenau appeared twice in succession. Leffen and his AI agents proposed that the name might also occur in the unread radiogram, and used it as the thing to search for. A known weakness of Enigma did the rest of the narrowing: the machine could not encipher a letter as itself, so an R in the plaintext ruled out an R at the corresponding position of the ciphertext. That single constraint eliminates a large share of candidate alignments immediately.
At one position everything matched. The team computed the corresponding machine settings, and the remaining 68 characters resolved into coherent German, including the phrases "Sofort Funkantwort" — immediate radio reply — and "Angabe des Marschweges," give the march route. The message header, preserved separately, confirmed the settings.
The plaintext also contains errors that the radio operator himself probably made: "BTTE" for "BITTE," and "WASCHBBSCH" for what is presumed to be the sender's name, Waschbusch. Leffen treats those mistakes as evidence the decryption is genuine, on the reasoning that an artificially constructed result would most likely come out without typos.
GPT-6 Astra and several specialized AI agents were used as tools at different stages. Some analyzed historical sources, some wrote the search programs, some compared output against messages that had already been decrypted. Over its ten hours the model searched historical archives, compared letters that had been read uncertainly, built an Enigma simulator, wrote cryptanalytic code, ran parallel experiments, tested keys and matched results. Leffen set the goals and decided how to proceed.
By his own account the code-breaking was not the hard part: he spent 99 times more effort building the website describing the problem and the solution than on the decryption itself.
That line is the most honest thing in the whole project, and it points at what actually happened here. The decisive move was a hypothesis — that a place name in one message would recur in another from the same day — and the machine's contribution was to make testing that hypothesis, with a simulator and a search harness written from scratch, a ten-hour job rather than a hobby carried across several winters. This is not a model that outthought Enigma. It is a model that collapsed the cost of the tooling and the grinding around a human guess, which is a less cinematic claim and a considerably more useful one.
The caveats are Leffen's own, and they are the right ones. The published materials let anyone check the computation and repeat the key search; they do not establish that the message is historically what it appears to be, and they do not prove the solution found is the only one. The work builds on the cryptanalytic research of Frode Weierud, Geoff Sullivan and Olaf Ostwald. A final verdict depends on independent experts going through what has been published.
If it holds, the interesting number is not 83 years or ten hours. It is that the same loop — crib, constraint, simulator, exhaustive test — can now be pointed at the rest of the traffic still sitting in that archive marked unsolved, by people with no cryptanalytic training and a weekend to spend.