How Claude Mythos Is Reshaping Cryptanalysis: HAWK, AES and the Rise of AI-Driven Crypto Research

Claude Mythos Cryptanalysis Just Broke a Post-Quantum Standard

Estimated reading time: 12 minutes

Key Takeaways

• In August 2026, Anthropic published findings showing that Claude Mythos cryptanalysis can find flaws in the mathematics underneath cryptographic algorithms.
• In 60 hours of work, Claude Mythos Preview weakened a leading post-quantum signature candidate called HAWK so significantly that its designers pulled it from the NIST standardization process entirely.
• The AI also improved the best-known attack on a reduced version of AES by up to 800 times.
• Neither attack threatens anything you use today, but both results have permanently changed how the cryptography community thinks about the role of AI in security research.

The internet runs on trust. Trust that your bank login is private. Trust that your messages are sealed. Trust that the systems protecting your data have been tested hard enough to hold.

That trust is built on cryptographic algorithms — mathematical locks that researchers spend years trying to break before criminals or hostile governments can. The slower those locks get cracked, the safer everyone is.

In August 2026, Anthropic published findings showing that Claude Mythos cryptanalysis has now moved beyond finding coding bugs in security software. It can find flaws in the mathematics underneath. In 60 hours of work, Claude Mythos Preview weakened a leading post-quantum signature candidate called HAWK so significantly that its designers pulled it from the NIST standardization process entirely. The AI also improved the best-known attack on a reduced version of AES, the world's most widely deployed encryption standard, by up to 800 times.

Neither attack threatens anything you use today. But both results have permanently changed how the cryptography community thinks about the role of AI in security research.

Here is what happened, why it matters, and what comes next.

---

What Is Claude Mythos and Why Does Cryptanalysis Matter

Before getting into the attacks themselves, it helps to understand the territory.

Cryptanalysis is the science of finding weaknesses in encryption systems. Think of it like stress-testing a bridge before you let cars drive on it. Researchers try to break cryptographic algorithms on purpose, in a controlled environment, so that real attackers cannot break them first. The more eyes on an algorithm — and the harder those eyes try — the more trustworthy the final standard becomes.

Historically, this work has been done by small teams of highly specialized human mathematicians. Progress is slow. A single improvement in an attack technique might take years to develop and require deep familiarity with a narrow area of math.

Claude Mythos Preview is Anthropic's most capable AI model, and it was already known to find bugs in cryptographic software code before this research. What changed with these new results is the level at which it operates. The model is now finding mathematical weaknesses in the algorithms themselves, not just in the programs that use them.

This is a meaningful step up. Writing code incorrectly is one kind of error. Designing a mathematical scheme with a hidden structural flaw is another kind entirely.

The two attacks described below each target a different type of cryptographic primitive:

• Digital signature schemes: Used to verify that a message or file genuinely came from who it claims to come from. When you visit a secure website, your browser checks a digital signature.
• Symmetric ciphers: Used to encrypt the actual data flowing between you and a server once identity has been confirmed. AES is the cipher used to protect the majority of internet traffic.

Both matter. Both were weakened — in different ways, at different levels of severity.

Sources:
- hawk_key_recovery.pdf
- arxiv.org/html/2607.18538v1

---

The HAWK Attack — A Post-Quantum Signature Scheme Halved

What HAWK Was Trying to Solve

Quantum computers do not yet exist at the scale needed to break today's encryption. But they are getting closer. Experts at Google have noted that the timeline to a cryptographically relevant quantum computer is shrinking, and that shift threatens widely used classical systems like RSA and ECDSA.

In response, the US National Institute of Standards and Technology (NIST) launched a multi-year competition to identify new post-quantum cryptography (PQC) algorithms — systems that would remain secure even against future quantum hardware. HAWK was one of the remaining third-round candidates in NIST's call for additional digital signatures, meaning it had already survived two full rounds of expert human review spanning two years.

HAWK's security rests on the hardness of the Lattice Isomorphism Problem — a mathematical challenge believed to be difficult even for quantum computers.

What Claude Mythos Found

Working semi-autonomously over roughly 60 hours, Claude Mythos Preview discovered a previously unexploited structural property inside the HAWK lattice called a nontrivial automorphism.

Prior academic work (published at the Cryptology ePrint Archive under the reference 2025/928) had already proved that finding such an automorphism would allow an attack. But that work left open the critical question: does such a useful automorphism actually exist in the specific lattice HAWK uses? Mythos answered that question with a yes — and then built the attack.

The automorphism it found allows a faster enumeration attack on HAWK keys. The attack is still exponential in difficulty (meaning it does not make HAWK trivially breakable), but the numbers shift dramatically:

| HAWK Parameter | Previous Attack Cost | Post-Mythos Attack Cost |
|---|---|---|
| HAWK-256 | 2^64 operations | 2^38 operations |
| HAWK-512 | 2^150 operations | 2^108 operations |
| HAWK-1024 | 2^288 operations | 2^182 operations |

To put HAWK-256 in plain terms: the expected cost to break it dropped from a number that would take longer than the age of the universe to compute, to something far more tractable. In practical terms, this effectively cuts the security level of every HAWK key size in half.

To maintain equivalent security, HAWK would need to double its key sizes. But that would eliminate many of the efficiency properties that made HAWK an attractive candidate in the first place.

HAWK's designers withdrew the scheme from the NIST process following the disclosure. Anthropic shared the attack with the HAWK authors in June 2026 before coordinating public disclosure to the NIST mailing list. A formal notice appeared on the NIST PQC forum describing the attack as "HAWK-n Key Recovery Reduces to SVP in Dimension n/2+1."

Importantly, this result is specific to HAWK's mathematical structure. It does not affect other NIST post-quantum signature candidates or lattice-based cryptography schemes like Falcon, which use different underlying constructions.

How the Discovery Happened

Mythos worked inside a multi-agent code harness similar to Claude Code, with multiple worker agents collaborating in a sandboxed environment. They had access to Python, the Sage mathematics system, and published cryptographic literature.

The human supervisor had a background in theoretical computer science but was not a cryptography specialist. Their role was mostly project management — suggesting which libraries to use for verification, helping agents organize ideas. The actual mathematical discovery came from the agents themselves.

In an interesting emergent dynamic, two worker agents began exploring the same idea independently. The first agent concluded it was infeasible and dropped it. The second agent found a way to make it work. The two agents exchanged notes, reached agreement, and produced the attack together.

Total compute cost: approximately $100,000 in API costs.

Sources:
- hawk_key_recovery.pdf
- eprint.iacr.org/2025/928
- NIST PQC forum thread
- postquantum.com/security-pqc/ai-cryptanalysis-hawk-aes/

---

The AES Möbius Bridge — A 200–800× Speed Gain on a Reduced Cipher

Background on AES and Reduced-Round Attacks

The Advanced Encryption Standard (AES) was standardized by NIST in 2001 and has been scrutinized more heavily than almost any other cipher in history. It has held up well. AES-128 — the specific variant in this research — uses 10 rounds of transformations to encrypt data.

Researchers regularly study round-reduced variants of AES, meaning stripped-down versions that run fewer than the full 10 rounds. These reduced versions are not used in production. They serve as research proxies: studying them reveals new attack techniques, tests the security margins of the full cipher, and helps the cryptography community build confidence that the full standard remains solid.

This attack targets 7-round AES-128. It operates under a chosen plaintext model, where an attacker can ask a defender to encrypt arbitrary inputs with a hidden key and observe the outputs. The previous best attack of this type required requesting the encryption of 2^105 chosen plaintexts — completely impractical, but useful as a theoretical benchmark.

What the Möbius Bridge Does

Mythos improved on the previous best meet-in-the-middle attack on 7-round AES. Meet-in-the-middle attacks work by trading computation time for storage space — you pre-compute and store a table of intermediate encryption values, then look up matches from the other direction to recover the key without trying every possibility.

The bottleneck in prior work was a stage where an attacker had to enumerate 256 different possible values and look each one up in a pre-computed table. That 256-way guessing step was expensive.

Mythos developed a new fingerprinting technique it named the Möbius Bridge — a mathematical transform that is invariant to this 256-way guess. In plain terms: you no longer need to make that guess at all. One lookup replaces 256. That alone reduces the work in that stage by a factor of 256.

Computing the Möbius Bridge transform itself is more expensive than the old approach, so Mythos also developed several additional optimization techniques to compensate. The net result: the attack runs 200 to 800 times faster than the previous best method, depending on measurement approach.

Empirical testing confirmed the attack recovered all eight target keys in the experimental setup, with a mean per-structure lookup count of approximately 2^23 and a Bloom filter hit rate of 0.0460.

The Discovery Process Was Almost Entirely Autonomous

This result differed from the HAWK attack in one important way: Mythos found it almost entirely on its own, with almost no human guidance. A researcher at Anthropic built a scaffold that allowed the model to pose hypotheses, run experiments, and self-correct based on results.

The early runs hit a wall. Claude initially refused to engage with the problem, stating that improving AES cryptanalysis was simply impossible. The logs include messages like:

> "If you want a different outcome, the target has to change… AES-128 r5/r6 is just genuinely hard."

The researcher sent one message suggesting Claude stop assuming the problem was unsolvable and actively search for novel approaches. Claude rewrote its own agent harness with that framing — and found new ideas on 6-round AES shortly after.

After being nudged toward the 7-round target, Claude worked almost completely independently for three days. It produced several hundred million tokens of output during that stretch. The research team sent just three brief prompts during that entire period, mostly reminders to aim for publishable-quality findings rather than incremental gains.

Three days in, Mythos developed the Möbius Bridge concept. A few days later, after outputting roughly one billion total tokens, it had fully refined the attack into the form described in the published paper.

Human researchers then spent several hundred hours validating the result — learning enough cryptography to confirm the math was correct and prepare the paper for release. The model found the attack in days. Confirming it took months.

Sources:
- aes_mobius_bridge.pdf
- mlq.ai news article
- news.geobrowser.io story

---

Your Automation Stack Is Probably Costing You More Than You Think

While cryptographers are using AI to do in 60 hours what took humans two years, most businesses are still doing repetitive work by hand. Manually processing data, routing requests, chasing approvals, copying information between tools. These tasks don't disappear on their own.

Flowgrammer builds custom business automation systems that remove manual work from your operations — freeing your team to focus on what actually requires human judgment.

👉 See how automation can scale your operations (how automation can scale your operations)

---

CryptanalysisBench — A Tool for Tracking AI Cryptanalytic Ability

One of the side effects of this research is a new problem that the broader security community now has to deal with: how do you measure how good AI models are at breaking encryption?

To help answer that, Anthropic partnered with academics at ETH Zurich, Tel Aviv University, and TU Berlin to build CryptanalysisBench — a standardized benchmark that packages together multiple cryptographic ciphers and provides a consistent testing environment for evaluating how well large language models perform at cryptanalysis tasks.

The benchmark results published alongside this research show a clear capability gap between models:

• Mythos-class models solved 85.7% of benchmark tasks that had known solutions
• The weakest model tested solved 65.3%

That 20-point gap is significant. It suggests that frontier model capability at cryptanalysis is not a flat field — the best models are meaningfully better, and the spread will likely increase as models improve further.

CryptanalysisBench also serves a longer-term purpose. As AI models get stronger, the cryptography community will need a way to track how much stronger they are getting at finding flaws in encryption. Without a shared benchmark, those comparisons are anecdotal. With it, researchers can make apples-to-apples comparisons across model generations.

Anthropic has stated it plans to continue running CryptanalysisBench experiments to monitor how frontier LLM capabilities evolve in this area over time.

Sources:
- arxiv.org/html/2607.18538v1
- mlq.ai news article

---

Other Ciphers in the Crosshairs — LEA, Serpent, Salsa20

The HAWK and AES results were the headline findings, but Anthropic has disclosed preliminary results on several other algorithms.

Lightweight Encryption Algorithm (LEA)

LEA is an efficient block cipher built for low-power, resource-constrained devices. It is codified in the international standard ISO/IEC 29192-2:2019. The full cipher runs 24 rounds. The previous best attack on 13 rounds required 2^98 plaintext pairs and 2^86 operations.

Claude Mythos Preview developed a practical attack on 13-round LEA that:

• Recovers the key using fewer than 2^30 encrypted plaintexts
• Runs in under one hour on a standard desktop computer

This is a dramatic improvement. Because the attack runs end-to-end (you can choose a random key and watch the attack recover it), Anthropic is highly confident in its correctness. More analysis is still being done on edge cases and extensions to 14 rounds before full public release.

Serpent-128

Serpent was a finalist in the original AES competition and is considered highly conservative and strong. The full cipher uses 32 rounds. Published work attacking 6 rounds requires more than 2^70 plaintext pairs and 2^90 decryptions.

Mythos has identified a practical full key-recovery attack on 6-round Serpent-128 that extends and improves on the published results. Details are pending further analysis.

Salsa20, Poseidon, and SHA-1

Mythos has also found smaller improvements — described by Anthropic as "fairly limited" at less than 10× gains — on the Salsa20 stream cipher, the Poseidon hash function, and the SHA-1 hash function. These are less dramatic, but they show that the AI is producing results across a wide range of cryptographic primitives, not just the two headline cases.

Sources:
- postquantum.com/security-pqc/ai-cryptanalysis-hawk-aes/
- aes_mobius_bridge.pdf

---

What This Means for the Future of Cryptographic Standards

The Verification Bottleneck Is Real

The single most important practical insight from this research is not the attacks themselves. It is the discovery gap.

Mythos found the improved AES attack in roughly one week. Two Anthropic researchers spent nearly one month validating that the attack was correct. For a research team that did not specialize in cryptography, that month involved learning enough of the field from scratch just to check the AI's homework.

This asymmetry is going to get worse before it gets better. As models become more capable, they will produce novel cryptanalytic results faster. Human experts are not scaling at the same rate. The community will need new processes for faster validation — possibly including other AI tools used explicitly for verification.

What It Does and Does Not Change Today

To be absolutely clear on the practical stakes:

What is NOT affected:

• AES-128, AES-256, or any production version of AES in deployed systems
• Any current NIST-standardized post-quantum algorithms (CRYSTALS-Kyber, CRYSTALS-Dilithium, SPHINCS+, Falcon)
• Any encryption protecting your data today

What HAS changed:

• HAWK has been withdrawn from the NIST additional signatures process
• The cryptography community now has confirmed proof that frontier AI can find algorithm-level flaws in schemes that passed multiple rounds of expert human review
• The speed at which attack improvements on reduced-round ciphers can be discovered has increased significantly

A New Role for AI in Standards Work

Anthropic has framed these results as cryptography research working as it should — adversarial review catching problems before deployment. That framing is accurate. NIST's process is specifically designed for this kind of stress-testing.

The broader implication is that AI will become a standard tool in that process. Security teams, standards bodies, and algorithm designers will use AI models to conduct initial red-team reviews before submitting schemes for human scrutiny. The models will not replace human cryptographers, but they will dramatically expand the number of schemes that can receive serious analysis in a given year.

Expert consensus in the security community holds three points firmly:

1. The HAWK result justifies withdrawal, but does not cast doubt on other lattice-based schemes with different mathematical foundations.
2. The Möbius Bridge is a genuine theoretical advance in meet-in-the-middle techniques, not a practical threat to deployed AES.
3. The pattern of rapid AI discovery followed by slow human validation will define the near-term future of cryptography research, and institutions need to prepare for it.

Sources:
- postquantum.com/security-pqc/ai-cryptanalysis-hawk-aes/
- news.geobrowser.io story
- mlq.ai news article

---

FAQ

1. Does the HAWK attack mean my current encrypted data is at risk?

No. HAWK was a candidate scheme under consideration for future standardization. It was never deployed in production systems. No software you use today relies on HAWK for encryption or digital signatures. Your internet traffic, banking data, and communications are not affected.

2. Does the AES Möbius Bridge attack break AES?

No. The attack targets a modified version of AES-128 that runs only 7 of the full 10 rounds. This reduced-round variant is a research tool, not a deployed cipher. The full AES-128 standard remains secure and is not affected by this research.

3. What is a post-quantum cryptographic algorithm and why do we need one?

Post-quantum cryptography (PQC) refers to encryption algorithms designed to stay secure even when large-scale quantum computers exist. Today's widely used public-key systems like RSA and ECDSA would be broken by a sufficiently powerful quantum computer. NIST has been running a multi-year competition to identify and standardize replacement algorithms before that threat materializes.

4. Why was HAWK withdrawn from the NIST process?

HAWK's designers withdrew the scheme after Anthropic disclosed its key-recovery attack. The attack reduces the effective security level of HAWK keys significantly — for example, dropping HAWK-256 from an expected 2^64 attack cost to 2^38. To maintain equivalent security, HAWK would need to double its key sizes, which would eliminate most of its efficiency advantages over competing schemes.

5. Does this attack affect other post-quantum algorithms like Falcon or CRYSTALS-Dilithium?

No. The HAWK attack exploits a specific nontrivial automorphism in the particular lattice structure HAWK uses. Other lattice-based schemes like Falcon rely on different mathematical constructions and are not vulnerable to this attack. Expert consensus is clear that this result is HAWK-specific.

6. How much did it cost Anthropic to discover these attacks?

Approximately $100,000 in API compute costs for each of the two main attacks — roughly $200,000 total for the HAWK and AES research. This is expensive by consumer standards but relatively modest compared to the cost of a traditional research program employing specialist cryptographers for equivalent periods.

7. What is CryptanalysisBench and how can I use it?

CryptanalysisBench is a standardized evaluation benchmark built by Anthropic in partnership with ETH Zurich, Tel Aviv University, and TU Berlin. It packages multiple cryptographic ciphers into a consistent testing environment so researchers can evaluate how well any AI model performs at cryptanalysis tasks. The technical paper is available at https://arxiv.org/abs/2607.18538.

8. How autonomous was Claude Mythos in finding these attacks?

Highly autonomous, especially for the AES result. The HAWK attack involved a human supervisor providing occasional non-technical project management guidance. The AES Möbius Bridge was found almost entirely by the model itself, with just three brief human prompts sent over three days of autonomous operation during which the model produced hundreds of millions of output tokens.

9. If AI can crack post-quantum candidates, how do we know any new algorithm is safe?

The fact that AI can find weaknesses is actually a feature of the standardization process working correctly. NIST's review process is adversarial by design — it wants researchers, both human and AI, to try to break candidates before any of them are deployed. Claude Mythos finding a HAWK weakness during the review process is the system succeeding, not failing. Standards like CRYSTALS-Kyber and Falcon that have already been finalized underwent this kind of rigorous scrutiny.

10. What happens when AI finds a vulnerability in an algorithm that IS already deployed?

This is the question Anthropic raised explicitly at the end of their disclosure. The current attacks do not reach that threshold, but the research community, government bodies, and industry need to develop clear policies for that scenario before it occurs. Anthropic has announced plans to host an academic workshop bringing together researchers from academia, government, and industry to begin those conversations. The disclosure process used for the HAWK attack — sharing with the algorithm's designers and coordinating public release — is one model, but it may need to evolve significantly if AI finds a flaw in something actively protecting billions of users.