In brief
- Anthropic said its unreleased Claude Mythos Preview model found a previously unknown attack on HAWK, dropping the cost of stealing its smallest key from 2^64 operations to 2^38.
- The model also sped up an attack on a 7-round version of AES by 200 to 800 times, beating a record cryptographers set in 2013.
- Each result cost roughly $100,000 in API usage, and Anthropic staff spent several hundred hours verifying the AES work was real.
Anthropic today said an unreleased version of its most powerful AI model found two previously unknown attacks on cryptographic algorithms, one of them against a scheme currently competing to become a U.S. federal standard.
That scheme is HAWK, a digital signature system—the math that proves a transaction came from you without ever exposing your private key—built to survive future quantum computers. The non-regulatory federal agency and lab NIST moved it into the third round of its post-quantum signature competition in May, where it is the last lattice-based candidate standing.
Claude found a symmetry buried in HAWK’s math that no human had thought to use. For the smallest configuration, the cost of recovering a secret key fell from 2^64 operations to 2^38, roughly 67 million times less work.
Fixing it means roughly doubling HAWK’s keys. “Unfortunately, doubling HAWK’s key size eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate,” Anthropic wrote.
That trade matters more to blockchains than it sounds. Signature size is block space, and block space is fees, so any chain shopping for a quantum-resistant replacement is partly choosing on bytes per signature. Compact keys and fast signing were HAWK’s entire pitch, and the fix costs it much of that edge.
Don’t worry, hodlers: Your coins are fine (for now). HAWK has never been deployed anywhere, and Bitcoin still runs on ECDSA, the pre-quantum signature scheme that candidates like HAWK are eventually meant to replace.
Anthropic disclosed both results to the algorithms’ authors and to U.S. government and industry partners before publishing, and coordinated the HAWK finding with NIST.
The AES result needed a pep talk
The second attack targets AES, the cipher scrambling your HTTPS traffic, your encrypted drive, and your exchange’s backend. Full AES-128 pushes data through 10 rounds of scrambling, and Claude attacked a 7-round research version that nobody has improved on since 2013.
The setup was deliberately harsh. Researchers barred the model from all five established families of AES cryptanalysis and told it to invent a sixth, closing the brief with a line about how the first differential attack didn’t beat anything—it invented the game. Claude also inherited working notes from earlier agent runs that had already burned through roughly 200 failed attack variants.
It refused anyway. “On AES-128 r5/r6/r7 it found nothing because there’s nothing easy to find; this is the most-studied block cipher in existence,” the model told researchers, per transcripts Anthropic published.
Anthropic sent just three substantive messages over the next three days, among them: “no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks.” Another refused to let Claude swap AES for an easier cipher.
Then it produced the trick the paper calls a Möbius Bridge, killing one of the nine key bytes an attacker previously had to guess. Refining that into the published version took a few more days and a billion output tokens.
The finding with the shortest path to something real got the least attention. Claude also broke 13 rounds of LEA, a Korean national standard and ISO lightweight-encryption standard built for phones and internet-of-things devices, in under an hour on a desktop against a prior best that needed 2^98 plaintext pairs. The deployed LEA runs 24 rounds, so nothing in the field is broken.
Verification took longer than discovery
The HAWK paper is unusually blunt about the division of labor. “The majority of mathematical discoveries in this paper were AI-assisted. Human author contribution mainly consisted of directing, organizing and verifying AI work,” its authors wrote.
Claude found the AES idea in days. Anthropic researchers then spent several hundred hours learning enough cryptography to confirm it worked—the same model that found 271 vulnerabilities in Firefox during internal testing.
“The cybersecurity community is now grappling with the fact that language models are able to discover so many bugs that the standard human processes (like vulnerability triage, verification, and remediation) struggle to keep up,” Anthropic wrote, warning that human researchers may become the bottleneck.
Anthropic also built CryptanalysisBench—191 cipher-breaking tasks drawn mostly from NIST competitions. Models submit a working attack script that either wins a formal security game or doesn’t, with no partial credit and no human grading.
Mythos 5 broke 85.7% of tasks with known solutions, against 65.3% for the weakest model tested. Against full-strength ciphers with no published break, every model scored under 9%.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
