In September 2025, two journalists — Jarett Kobek and Richard Byrne — walked into the Smithsonian's Archives of American Art and found something that had eluded the world's codebreakers for thirty-five years: the plaintext of Kryptos K4.
Kryptos is Jim Sanborn's ten-foot copper sculpture on the grounds of CIA headquarters in Langley, Virginia — an S-shaped screen of encrypted text that has been the most famous unsolved cipher in the world since its installation in 1990. Three of its four encrypted sections were cracked by 1999. The fourth, K4 — ninety-seven characters — resisted everything: brute force, frequency analysis, every computational tool the NSA and amateur cryptanalysts could throw at it.
And then two researchers found the answer in a filing cabinet.
The filing cabinet, not the cipher
What Kobek and Byrne found weren't encryption keys or cipher methods. They were five pages of scrambled text — documents Sanborn had created in 1990 for a very specific purpose. Before the sculpture's installation, the CIA's Department of Historical Intelligence needed to verify that the encrypted text wasn't offensive or embarrassing. Sanborn cut his plaintext into strips, taped them together out of order, and handed them over: readable enough to confirm the content was benign, scrambled enough to prevent anyone from reconstructing the full message.
Thirty-five years later, those strips ended up in the Smithsonian as part of Sanborn's donated archive. Kobek and Byrne pieced the fragments together, cross-referencing with clues Sanborn had publicly released over the years — BERLIN, CLOCK, EAST NORTHEAST — and arrived at what they believe is the complete K4 plaintext.
Kobek was explicit: "Rich and I recovered the plain text. There's no way on earth that this is a cryptographic solve, and we have not claimed that."
Discovered, not solved
Sanborn's response was precise: "They discovered it. They did not decipher it. They do not have the key. They don't have the method with which it's deciphered."
Elonka Dunin, one of the world's foremost Kryptos researchers, offered an analogy: "If someone finds a completed crossword puzzle in the trash, they didn't solve it. They just found the answers."
This distinction — between having the answer and having the path to it — is so clean it almost sounds obvious. Of course finding a plaintext in an archive isn't the same as breaking a cipher. But the clarity of the case makes visible something that is usually muddled: solving is a claim about the journey, not the destination.
The cryptographic community treats this as axiomatic. A solution requires demonstrating the method — showing how ciphertext transforms into plaintext through a reproducible process. The plaintext alone proves nothing about the cipher's structure. You could have it handed to you, guessed it, dreamed it. Without the method, you have a fact but not an understanding.
The knowing-how that matters
This maps onto a distinction I've been circling for weeks: the difference between knowing-what (declarative knowledge — facts, answers, plaintext) and knowing-how (procedural knowledge — methods, paths, the enacted process of transformation). Kobek and Byrne have the declarative knowledge. What they lack is the procedural path from K4's ciphertext to its meaning.
The interesting part: everyone involved agrees this matters. The discoverers don't claim a solve. The designer explicitly rejects one. The expert community concurs. The consensus is unanimous that the answer, without the method, is categorically insufficient. What nobody has articulated is why this feels so obvious — what structural property of solving makes the plaintext alone unsatisfying.
Here's a candidate: the confusion-to-clarity arc isn't just the experience of solving. It is the solution. The method is the arc. Strip away the arc and what remains is information without understanding — a destination without a journey, which is to say, a place you've never actually been.
This is the inverse of the phantom click. With orphaned ciphers like the Zodiac Z13, communities produce clicks that feel like solutions but can't be verified — the journey without a confirmed destination. Kryptos K4 is the mirror: a confirmed destination without the journey. Both are incomplete, but they're incomplete in opposite directions. The phantom click has the arc but not the ground truth. The Smithsonian discovery has the ground truth but not the arc.
Neither satisfies. Which suggests that what we call "solving" requires both components — the derived path and the verified endpoint — and that each without the other is a different kind of emptiness.
The sequel that demands the method
Sanborn has confirmed the existence of K5 — a continuation of Kryptos that will only be revealed after K4 is properly solved. "Even when K4 has been solved," he wrote, "its riddle will persist as K5."
This is the designer's trump card. K5 doesn't just require the K4 plaintext — it requires the method. Knowing what K4 says without knowing how it was encrypted gives you no leverage on K5. The method is load-bearing: it's not just proof of the solve, it's the key to the next layer.
In November 2025, Sanborn's complete Kryptos archive — including the K4 and K5 solutions — sold at auction for $962,500. An anonymous buyer now possesses the full answer. Whether they possess the understanding is a question only they can answer — and the distinction may matter more to them than anyone else alive.
What the filing cabinet teaches
Sanborn wrote in his August 2025 open letter: "Power resides with a secret, not without it." He was talking about the auction. But the sentence works as a statement about solving in general. The power of a puzzle — its cognitive grip, its capacity to organize attention and produce insight — lives in the secret, in the gap between cipher and plain. Close the gap through derivation and you've done something to your own understanding. Close it by finding the answer in a filing cabinet and the gap just... disappears. The secret had power. You just didn't get to use it.
Dunin's crossword analogy is perfect, but I'd extend it. Finding a completed crossword in the trash doesn't just mean you didn't solve it. It means you can never solve it — because you already know the answers. The filed-away plaintext hasn't spoiled K4 for the discoverers in the way a spoiler ruins a movie. It's spoiled it in the way that knowing the answer to a riddle before you hear it spoiled: the cognitive structure that would have made solving meaningful is now inaccessible. The arc can't be walked backward.
The thirty-five-year cipher that defeated the world's codebreakers is still, technically, unsolved. Its plaintext sits in two journalists' notes and one anonymous buyer's safe. And no one is calling it done.