Claude AI cracks post-quantum test scheme and finds faster attack on cryptographic algorithms

Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack

Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK attack exploits a previously unused symmetry in the lattice behind the signature scheme. Anthropic's released implementation gives an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server. The AES result removes a 256-way guessing step from an existing meet-in-the-middle attack. Anthropic said neither result affects production systems. HAWK remains a candidate in a National Institute of Standards and Technology (NIST) post-quantum standardization process, and the public recovery code only targets the smaller HAWK-256 parameter. The Advanced Encryption Standard (AES) result applies to seven of AES-128's ten rounds and still requires an impractical number of chosen plaintexts. The company said no production software needs to change as a result. Anthropic published the findings alongside two technical papers and reproducibility artifacts. The company said Mythos Preview largely conducted the research itself, with humans supplying project direction, computing resources, and extensive verification. A symmetry hiding in HAWK's lattice HAWK is the only lattice-based scheme among the nine candidates that NIST advanced to the third round of its additional post-quantum digital-signature process in May 2026. Its NIST security-level parameter sets are HAWK-512 and HAWK-1024; HAWK-256 is a challenge parameter provided as a cryptanalytic target. Direct HAWK key recovery is an instance of the search module Lattice Isomorphism Problem (smLIP). An attacker must recover a hidden transformation between two lattices. A paper by Daniël van Gent and Ludo Pulles showed that a nontrivial automorphism, a symmetry that preserves the lattice, would reduce HAWK key recovery to finding a short vector in a lattice of roughly half the original dimension. That work opened the attack path, but the authors said it did not then affect HAWK. Anthropic says Mythos Preview found the additional automorphism needed to exploit the path. The resulting HAWK-n attack constructs what the researchers call a τ-cocycle lattice from the public key. It then uses lattice reduction and sieving to recover short vectors before reconstructing a secret basis that can sign messages for the original public key. Anthropic's released implementation verifies the recovered key by signing a message and checking it with the NIST reference implementation. It does not recover the original 96-byte secret-key seed. Instead, it produces a 592-byte decoded key containing functionally equivalent signing material. Anthropic's released code supports HAWK-256 only and rejects every non-HAWK-256 input. The repository includes two public keys that Anthropic says it successfully attacked. It also supports generating and testing fresh HAWK-256 keys. Anthropic estimates that the expected HAWK-256 key-recovery work factor falls from 264 to 238. In a same-day NIST-forum announcement, it said the gate-count estimate falls from 2150 to 2108 for HAWK-512 and from 2288 to 2182 for HAWK-1024. Both larger parameters remain impractical to attack. As of this review, the public record does not show whether NIST or the HAWK submitters will change the scheme's parameters, security claims or standing in the standardization process in response to those lower estimates, if at all. The attack remains exponential. It is not a polynomial-time break of HAWK, and Anthropic said it does not extend to other NIST signature candidates or lattice cryptography generally. Anthropic said Mythos Preview developed and verified the result over approximately 60 hours in a multi-agent environment. A human researcher provided occasional project-management guidance but was not a lattice-cryptography specialist. The company put the application programming interface (API) cost at about $100,000. Faster, but still impractical The second result targets AES-128 reduced from ten rounds to seven. Studying reduced-round ciphers is standard cryptanalytic practice because it measures how much safety margin remains before an attack reaches the full construction. The attack assumes an adversary can obtain about 2105 chosen plaintexts encrypted under one fixed, unknown key. That requirement alone puts it far outside real-world use. Previous meet-in-the-middle attacks trade memory for computation by storing intermediate cipher states and matching calculations made from opposite ends of the cipher. One stage in the prior attack required testing 256 possible values before searching the table. Mythos developed an invariant fingerprint Anthropic calls the Möbius Bridge. Because the fingerprint does not change across that guessed value, the attack can remove the 256-way enumeration. After accounting for the transform's cost and other optimizations, Anthropic estimates the seven-round AES-128 attack is 200 to 800 times faster, depending on how runtime is measured. The accompanying AES paper presents the mathematical construction, while the released artifact provides code for each experiment cited in the paper. Anthropic's code performs complete black-box key recovery against a smaller AES-like cipher with a 24-bit key. For real seven-round AES-128, it measures individual table entries and online candidates. Separate C, Python, and Rust implementations test the component claims, and Anthropic projects those measurements to the complete attack. It does not execute the full AES-128 recovery from beginning to end. The practical result is narrower than the names HAWK and AES might imply. The complete HAWK recovery targets HAWK-256, a challenge parameter rather than either NIST security-level parameter set. For seven-round AES-128, Anthropic projects the complete attack's cost from component measurements, and the attack remains infeasible at realistic scale. The company said the model initially refused to engage, insisting that improving on AES was impossible. Anthropic published the researcher's blunt follow-up prompts, typos and all, that pushed the model to keep looking. Anthropic said Mythos Preview found the Möbius Bridge after about three days and several hundred million output tokens. It refined the method over the following days, ultimately generating roughly one billion output tokens. The higher cost was human. The model run cost approximately $100,000 in API usage, but researchers spent several hundred hours checking the method. Anthropic said two researchers took nearly a month to reach confidence that it was correct. On Anthropic's account, verification was the visible bottleneck. The disclosures follow the July 20 release of CryptanalysisBench, a 191-task benchmark developed by researchers from ETH Zurich, Anthropic, the University of Haifa, Technische Universität Berlin and Tel Aviv University. Five models broke between 65% and 86% of its easier first-tier schemes and six to 12 full-strength schemes in its second tier. That benchmark evaluated Mythos 5, which Anthropic describes as the latest update to Mythos Preview. The HAWK and AES disclosure specifically names Mythos Preview. As of July 29, 2026, NIST continued to list HAWK as a third-round candidate. Anthropic's NIST-forum announcement thanked the HAWK team for helping verify the result and providing feedback, but did not say whether that involved reviewing the proof, running the public artifact, or both. The public thread contained no replies when checked, and The Hacker News did not locate an independent reproduction of Anthropic's HAWK-256 recovery during this review.

An Anthropic Claude AI Model Finds Flaws in Tough-to-Crack Encryption Algorithms

Claude Mythos Preview discovered new attacks in testing against weakened cryptographic algorithms, which protect online financial transactions, private communications and more. A leading A.I. model built by Anthropic has found flaws in a weakened version of a digital encryption standard that is in pervasive use throughout the internet, the company's researchers said Tuesday, underscoring the potential risks to global cybersecurity posed by ever-improving artificial intelligence software. During a research-led test, the model, Claude Mythos Preview, was able to detect new ways to attack cryptographic algorithms that keep everything from online bank transactions to private communications to state secrets safe from the prying eyes of hackers or other unwanted third parties. The research shows that A.I. could one day challenge core assumptions for how the internet operates. While experts say A.I. is likely to upend many industries, A.I. systems have made particularly rapid advancements in coding and cybersecurity. The flaws identified do not concern a cryptographic standard currently in use today, which means that modern banking and communication systems are not subject to immediate potential intrusions from A.I. Instead, Anthropic's technology cracked a watered-down version of an algorithm for Advanced Encryption Standard, or A.E.S., a ubiquitous protocol that safeguards web traffic, wireless networks, data storage and more. It is common to perform tests on weaker versions of encryption algorithms to understand whether more powerful computers could someday crack the actual standards, akin to solving a simpler math problem to identify whether patterns may exist for a more complicated one. In the testing, Mythos was able to break the weaker version of Advanced Encryption Standard in a way that Anthropic said made an assault 200 to 1,000 times faster than what previous human research had managed to do. While the immediate ramifications are minimal, the long-term implications could be significant. In previous tests, large-language models seemingly could not match or best what humans can do in the mathematically dense field of cryptographic research, but their rapid advances could suggest a future in which top models can surmount traditional internet security protections that are foundational to just about everything that takes place on the internet.

Claude found mathematical flaws in two cryptographic algorithms that years of expert review missed

Claude Mythos found mathematical weaknesses in HAWK (halving key strength) and reduced-round AES (200-800x faster attack). Both discovered mostly autonomously. No production systems affected. Each cost ~$100K. Anthropic announced on Monday that Claude Mythos Preview has discovered mathematical weaknesses in two cryptographic algorithms. The first substantially weakens HAWK, a post-quantum digital signature scheme under review by NIST, by cutting its effective key strength in half. The second improves the best-known attack on seven-round AES, the most widely used symmetric cipher, by 200-800x. Neither result affects production systems. HAWK is not deployed, and the AES attack targets a reduced variant, not the full cipher. The distinction from Anthropic's earlier cybersecurity work is critical. Claude had previously found vulnerabilities in cryptographic libraries, meaning bugs in how programmers implemented algorithms. These new results are flaws in the mathematics of the algorithms themselves, discovered after years of expert human review failed to find them. HAWK survived two rounds of NIST review over two years. Mythos found the weakness in 60 hours of semi-autonomous work, with one researcher providing project management direction rather than technical guidance. The AES result was discovered almost entirely autonomously after Claude initially refused to try, claiming improvement was impossible. A researcher sent three encouraging prompts over three days. Claude produced one billion output tokens and invented a technique it named the "Möbius Bridge." Each discovery cost approximately $100,000 in API compute. Anthropic followed responsible disclosure, sharing the HAWK attack with its authors and coordinating with NIST, the US government, and industry partners before publication. The company also partnered with ETH Zurich, Tel Aviv University, and University of Haifa to release CryptanalysisBench, a benchmark for evaluating AI cryptanalytic capabilities. Claude Mythos found 10,000 critical software vulnerabilities in one month, and moving from implementation bugs to algorithmic flaws represents a qualitative leap in what AI can do to security infrastructure. Anthropic acknowledged follow-up results: a practical attack on 13-round LEA that recovers keys in under an hour on a desktop, and attacks on Serpent-128, Salsa20, Poseidon, and SHA-1. "In just one year, language models have gone from being unable to perform cryptanalysis of even the most basic ciphers to being capable of finding flaws in cryptographic designs that have escaped discovery despite years of human expert review," the company wrote. The White House launched Gold Eagle to coordinate AI-powered cyber defence, but there is no equivalent programme for cryptographic review. The question Anthropic raised at the end of its post is the one that matters: what happens when a model finds a flaw in a cipher that is already protecting production systems?

Claude Mythos Cracked Post-Quantum Cryptography That Humans Spent Years Failing to Break

Each result cost roughly $100,000 in API usage, and Anthropic staff spent several hundred hours verifying the AES work was real. Anthropic today said an unreleased version of its most powerful AI model found two previously unknown attacks on cryptographic algorithms, one of them against a scheme currently competing to become a U.S. federal standard. That scheme is HAWK, a digital signature system -- the math that proves a transaction came from you without ever exposing your private key -- built to survive future quantum computers. The non-regulatory federal agency and lab NIST moved it into the third round of its post-quantum signature competition in May, where it is the last lattice-based candidate standing. Claude found a symmetry buried in HAWK's math that no human had thought to use. For the smallest configuration, the cost of recovering a secret key fell from 2^64 operations to 2^38, roughly 67 million times less work. Fixing it means roughly doubling HAWK's keys. "Unfortunately, doubling HAWK's key size eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate," Anthropic wrote. That trade matters more to blockchains than it sounds. Signature size is block space, and block space is fees, so any chain shopping for a quantum-resistant replacement is partly choosing on bytes per signature. Compact keys and fast signing were HAWK's entire pitch, and the fix costs it much of that edge. Don't worry, hodlers: Your coins are fine (for now). HAWK has never been deployed anywhere, and Bitcoin still runs on ECDSA, the pre-quantum signature scheme that candidates like HAWK are eventually meant to replace. Anthropic disclosed both results to the algorithms' authors and to U.S. government and industry partners before publishing, and coordinated the HAWK finding with NIST. The AES result needed a pep talk The second attack targets AES, the cipher scrambling your HTTPS traffic, your encrypted drive, and your exchange's backend. Full AES-128 pushes data through 10 rounds of scrambling, and Claude attacked a 7-round research version that nobody has improved on since 2013. The setup was deliberately harsh. Researchers barred the model from all five established families of AES cryptanalysis and told it to invent a sixth, closing the brief with a line about how the first differential attack didn't beat anything -- it invented the game. Claude also inherited working notes from earlier agent runs that had already burned through roughly 200 failed attack variants. It refused anyway. "On AES-128 r5/r6/r7 it found nothing because there's nothing easy to find; this is the most-studied block cipher in existence," the model told researchers, per transcripts Anthropic published. Anthropic sent just three substantive messages over the next three days, among them: "no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks." Another refused to let Claude swap AES for an easier cipher. Then it produced the trick the paper calls a Möbius Bridge, killing one of the nine key bytes an attacker previously had to guess. Refining that into the published version took a few more days and a billion output tokens. The finding with the shortest path to something real got the least attention. Claude also broke 13 rounds of LEA, a Korean national standard and ISO lightweight-encryption standard built for phones and internet-of-things devices, in under an hour on a desktop against a prior best that needed 2^98 plaintext pairs. The deployed LEA runs 24 rounds, so nothing in the field is broken. Verification took longer than discovery The HAWK paper is unusually blunt about the division of labor. "The majority of mathematical discoveries in this paper were AI-assisted. Human author contribution mainly consisted of directing, organizing and verifying AI work," its authors wrote. Claude found the AES idea in days. Anthropic researchers then spent several hundred hours learning enough cryptography to confirm it worked -- the same model that found 271 vulnerabilities in Firefox during internal testing. "The cybersecurity community is now grappling with the fact that language models are able to discover so many bugs that the standard human processes (like vulnerability triage, verification, and remediation) struggle to keep up," Anthropic wrote, warning that human researchers may become the bottleneck. Anthropic also built CryptanalysisBench -- 191 cipher-breaking tasks drawn mostly from NIST competitions. Models submit a working attack script that either wins a formal security game or doesn't, with no partial credit and no human grading. Mythos 5 broke 85.7% of tasks with known solutions, against 65.3% for the weakest model tested. Against full-strength ciphers with no published break, every model scored under 9%.