Claude Mythos cryptanalysis breaks on HAWK and AES-128

In roughly 60 hours of work and about $100,000 in API costs, Anthropic's unreleased Claude Mythos Preview model found a new attack on HAWK, a lattice-based signature scheme that had already cleared two rounds of NIST's post-quantum standardization review ^[1]. The model identified a previously unexploited lattice symmetry - a "nontrivial automorphism" - that cuts the cost of recovering a HAWK-256 private key from 2^64 to 2^38 operations, the kind of structural flaw that two years of expert cryptanalysis had missed ^[1]. The same weakness scales across HAWK's other parameter sets: HAWK-512's estimated attack cost falls from 2^150 to 2^108 gates, and HAWK-1024's from 2^288 to 2^182 ^[2].

In a separate research effort under a similar time and cost budget, Mythos invented a new cryptanalytic tool called the Mobius Bridge - a mathematical fingerprinting transform that stays invariant across 256 guessed values inside a meet-in-the-middle attack, letting the attacker skip an entire enumeration step. Applied to 7-round AES-128, it sped up the best-known attack by 200 to 800x, beating a record that had stood since 2013 ^[3]. Both are genuine, previously undocumented cryptanalytic contributions - the kind of result that would normally anchor a standalone academic paper - and both came out of the same general-purpose model working with minimal domain steering from a human researcher.

Neither result touches a deployed system. HAWK is a third-round candidate in NIST's post-quantum signature competition, not a scheme anyone has shipped in production ^[1]. The AES attack is narrower still: it targets a stripped-down 7-round research variant of AES-128, not the 10-round cipher that actually protects data today, and even then it requires on the order of 2^105 chosen plaintexts - described by researchers as needing over 400 octillion messages, several orders of magnitude beyond anything an attacker could practically collect ^[4]. Anthropic itself is explicit that both findings are demonstrations of capability, not exploitable vulnerabilities.

The more consequential fact is what the results do to HAWK's future as a candidate: fixing the flaw means roughly doubling its key and parameter sizes, which erases much of the compactness advantage that made HAWK attractive among the post-quantum finalists in the first place ^[2].

Anthropic's own framing describes the HAWK reduction as an order-of-magnitude collapse in security, and coverage has echoed a shorthand that key strength was roughly halved. The working cryptography community's reaction has been considerably less awed than the mainstream write-ups: domain experts pushed back specifically on that "halved" framing as overstating the actual security-margin reduction, and in the same discussion the AES result was dismissed by one expert commenter as an optimization rather than a genuine cryptographic attack.

Independent cryptographer Matthew Green, writing the day after the announcement, split the difference. He calls the HAWK result "genuinely interesting - and, frankly, a little embarrassing for the field - [because] none of the ingredients are exotic" ^[5], meaning a sufficiently persistent search over known techniques found what two years of human review didn't. He is considerably more skeptical of the AES result, treating it as incremental given how impractical its parameters are. The gap between Anthropic's press framing and the working cryptography community's read is itself part of the story: capability demonstrations from AI labs are now getting the same scrutiny any bold cryptanalytic claim would get from peer reviewers - a healthy sign, even when it deflates the headline number.

The most durable insight from this release may not be the HAWK or AES numbers at all, but what it cost to trust them. Even after Mythos produced a candidate attack, Anthropic's own researchers reportedly spent several hundred hours learning enough cryptography by hand to confirm the result actually worked before anyone would publish it ^[1]. Green frames the experience of working with these tools memorably: "Working with these tools is like swimming in a pond where the ground drops off sharply" ^[5]- the model can be shallow and unremarkable for long stretches, then suddenly produce something genuinely novel, with no reliable way to predict which mode you're in until a human checks the work.

Anthropic's own CryptanalysisBench numbers back this up: across five frontier models, Mythos 5 solved 85.7 percent of tasks with a known published solution, but every model tested - including Mythos - scored below 9 percent on full-strength schemes that have never been broken ^[6]. In other words, these systems are excellent at rediscovering or extending known weaknesses and still largely unable to break genuinely hard, unbroken cryptography from scratch. Bruce Schneier's read is the appropriately cautious one: "still early results, but this is definitely something to watch" ^[7]- not because the sky is falling, but because the bottleneck in this pipeline has visibly shifted from generating candidate attacks to the slower, more expensive human labor of verifying them.

Anthropic didn't just publish and walk away. It notified HAWK's designers in June 2026, ahead of the public announcement, coordinated with NIST's post-quantum cryptography mailing list, and briefed unspecified government and industry partners before the research went public ^[4]. That sequencing followed the norms of responsible vulnerability disclosure, and industry voices have read it as evidence the NIST evaluation process is doing its job - surfacing structural weaknesses in candidate schemes before they're standardized rather than after.

But the order of who gets told first has its own politics. Briefing government and industry partners ahead of the wider public and international research community is standard practice for a private AI lab handling a sensitive finding, yet it sits uneasily next to Anthropic's own argument that AI-driven cryptanalysis is a global concern moving faster than traditional review timelines. If AI labs are about to become a new, faster channel for finding cryptographic flaws, who sits on the early-briefing list will matter almost as much as what gets found.