Claude Mythos Preview finds real cracks in HAWK (post-quantum signature) and in reduced AES

Anthropic has published the results of research in which its Claude Mythos Preview model was used to successfully attack two benchmark cryptographic algorithms: HAWK, a digital signature scheme designed to resist quantum computers, and a reduced version of AES, the most widely used symmetric cipher in the world. According to Anthropic, this is the first time it has demonstrated that Claude is capable of finding mathematical flaws in the algorithms themselves, and not just implementation errors in the code that uses them (something it had already shown previously with Claude Mythos Preview on several cryptographic libraries).

The article insists from the outset on an important nuance: neither of the two findings affects systems in production today. HAWK is only a candidate in a standardization process that has not yet been deployed, and the AES attack is limited to a 'reduced-round' variant of the cipher (7 of the 10 rounds of AES-128), not full AES. No software will have to change as a result of these findings. Even so, Anthropic argues that both cases show the potential of frontier AI models to help uncover weaknesses in important cryptographic algorithms, both before and after their actual deployment, and frames it as cryptographic research working exactly as it should: stress-testing algorithms to build confidence and, ultimately, more secure systems.

On HAWK: it is one of the third-round candidates in NIST's process (the U.S. government's standards body) for additional quantum-resistant digital signatures, an effort spanning nearly a decade in the face of the prospect that sufficiently powerful quantum computers could break classical schemes such as RSA or ECDSA. HAWK's security rests on the difficulty of a mathematical problem called the 'Lattice Isomorphism Problem'. Despite having already passed two rounds of expert review over two years, Mythos managed to improve on the best known attack against HAWK in just 60 hours of work, finding a previously unexploited symmetry in the lattice used by the scheme, known as a 'non-trivial automorphism'. Previous work had already shown that efficiently finding such an automorphism would make it possible to attack the scheme, but it was not known whether such an automorphism was accessible in HAWK's specific lattice. The automorphism found by Mythos enables a faster enumeration attack that, while still exponential-time, forces HAWK's key sizes to be doubled to maintain the same level of security, which in practice removes much of the appeal that made HAWK an interesting candidate compared with other post-quantum schemes. In concrete terms, the expected cost of a full key-recovery attack against the small HAWK-256 size was believed to be 2^64 operations, and Mythos showed that it is actually 2^38. For the larger key sizes, HAWK remains impractical to attack. Anthropic stresses that this finding is specific to HAWK and does not affect other NIST post-quantum candidates or lattice-based cryptography in general, and recalls that late critical findings in standardization processes are not unprecedented: during the standardization of ML-KEM and ML-DSA several competing proposals turned out to be insecure, and one candidate, SIKE, was broken completely in an hour on an ordinary laptop.

The discovery process for this attack was semi-autonomous: Mythos worked in an agentic environment with occasional, non-technical guidance from a human, following an extensive literature review and substantial mathematical reasoning and computational experimentation. After finding the attack, Mythos implemented an end-to-end verification process on its own to convince itself and the human operator that the attack was correct. An environment similar to Claude Code was used, allowing several worker agents to collaborate in an isolated environment ('sandbox'), with access to computational tools such as Python and Sage and to published cryptographic literature. The human operator had a background in theoretical computer science but was not an expert in lattice-based cryptography; their contribution was largely limited to project management tasks (how to organize ideas, which libraries to use for verification). A curious detail of the process: the key idea behind the attack came from a pair of agents working together; the first prematurely discarded the idea as unworkable, but the second found a way to exploit it fully, and both ended up agreeing that they had hit on an effective attack. In total, finding, developing and verifying the attack took some 60 hours, at an estimated cost of approximately $100,000 in API consumption.

On the second finding, concerning AES: the Advanced Encryption Standard was adopted by NIST in 2001 and is probably the symmetric cipher that has received the most scrutiny from the cryptographic community. AES works by repeatedly applying the same round function; full AES-128 has 10 rounds, but the Mythos attack works only on a modified version with 7 of those 10 rounds. Studying versions with fewer rounds is standard academic practice for extracting attack techniques that may one day generalize to the full cipher, and for estimating AES's real security level through simpler subproblems. The attack assumes the 'chosen plaintext' threat model (the attacker can request that arbitrary inputs be encrypted with a fixed unknown key and observe the outputs, repeatedly), which is the most common assumption in this type of study. The previous work that Mythos improved on assumed the attacker could request the encryption of 2^105 chosen plaintexts — a figure that makes the attack completely impractical in real life, but that serves to quantify the theoretical cost of the best known attack against AES under those conditions.

The starting technique is the one known as the 'meet-in-the-middle' attack, which trades time for space: intermediate computations are stored in a very large lookup table to reduce subsequent execution time. One of the stages of the earlier attack required enumerating 256 different values and looking them up in the precomputed table. Mythos devised a more sophisticated fingerprinting algorithm, which it called 'Möbius Bridge', that is invariant to that enumeration, directly reducing the work required by a factor of 256. This comes at a cost: computing the transformation is more computationally expensive, so Mythos also developed several additional optimization techniques that, combined, produce an attack between 200 and 800 times faster than the best known to date (the range depends on exactly how execution time is measured).

The account of how this second result was discovered is perhaps the most striking part of the article, because Anthropic details — publishing the actual messages sent to the model (including typos and grammatical errors, which the article reproduces verbatim) — how Claude initially refused to tackle the problem, claiming it was impossible to improve on AES cryptanalysis, with lines such as 'if you want a different result, the target has to change... AES-128 r5/r6 is simply very hard' or that it 'found nothing because there is nothing easy to find; this is the most studied block cipher there is'. In response, the researcher wrote a message noting that 'models tend to think it's impossible to solve, so they don't try; they need quite a bit of instruction'. In response to that single message, Claude itself rewrote its agent environment ('scaffold') with an improved configuration geared toward seeking genuinely novel ideas, which allowed it to find improvements for 6 rounds of AES. Then, faced with the question 'why not tackle AES-128 r7? the goal is to find something better than existing approaches', Claude worked autonomously over the following three days, producing several hundred million tokens, with only three substantive interventions from the researcher: a reminder that the goal was to act as a highly intelligent model at the level of a top researcher and find new attacks; another reminder, when Claude wanted to switch target ciphers, that it had to stick to the original target because the aim was something publishable; and a final encouraging message insisting that what was wanted was not 'low-hanging fruit' but genuine research that would turn up genuinely hard findings. Three days after that last message, Mythos hit on the Möbius Bridge idea, and a few days later — after generating a total of one billion output tokens — it had refined the attack into the version described in the technical paper. Anthropic researchers then spent several hundred hours learning the cryptography needed to validate the model's claim and prepare the scientific paper. Alongside the paper, Anthropic is also publishing a document with Claude's 'chain of thought' during the moment it discovered the key algorithmic idea.

One comparison the article itself offers: while it took Mythos a week to conceive the idea for the AES attack, verifying its correctness took two researchers nearly a month, in contrast to the HAWK attack, which, being implementable end to end, proved much easier to verify as a whole.

Beyond these two main results, Anthropic describes several additional preliminary experiments. On LEA (Lightweight Encryption Algorithm), an efficient block cipher designed for low-power environments, internationally standardized (ISO/IEC 29192-2:2019) and whose full 24-round version has withstood full cryptanalysis: the best known attack against 13 rounds of LEA required 2^98 plaintext pairs and 2^86 work, and Mythos developed a practical attack capable of recovering a 13-round LEA key with fewer than 2^30 encrypted plaintexts, running in under an hour on a modern desktop computer; because this attack does run end to end (making it possible to choose a random key and check that the attack recovers it within a few hours), confidence in its correctness is much higher, although Anthropic clarifies that aspects remain to be understood (the exact limits on the plaintext pairs needed, why some keys are harder to recover, or whether it extends to 14 rounds) before publishing the full results. Mythos has also identified a practical full key-recovery attack on 6 rounds of the Serpent-128 cipher (32 rounds in its full version), improving on published work that required more than 2^70 plaintext pairs and 2^90 decryptions. In addition, more limited improvements (under 10x) have been found on attacks against the Salsa20 stream cipher, the Poseidon hash function and the SHA-1 hash function; Anthropic describes these as 'not so powerful for now' but says it plans to keep working to improve them and to develop new attacks against other ciphers.

As part of this work, Anthropic has partnered with academic researchers from ETH Zurich, Tel Aviv University and TU Berlin to build CryptanalysisBench, a benchmark that brings together numerous cryptographic ciphers and makes it easier for others to evaluate language models' capabilities in this area; Anthropic plans to keep using this benchmark to track how frontier models' capabilities evolve over time. The company says it followed responsible disclosure procedures throughout the research, consulting academics to confirm the validity of the findings, sharing advance copies with U.S. government and industry partners, and holding conversations about the implications of this research. In the case of HAWK, it shared the attack with the scheme's own authors in June and coordinated public disclosure on the NIST mailing list at the same moment the results were published.

The article closes by placing these findings within a broader trend of language models tackling research-level mathematics — mentioning, without further detail in the available content, that in recent months Google has used Gemini to solve several open Erdős problems and OpenAI has used GPT to make progress on the unit distance conjecture — although the text cuts off before developing the full conclusion about what all this means for the future of cryptography in the AI era.