Researchers at Anthropic have used Claude Mythos Preview to develop improved attacks on two cryptographic systems, including a candidate designed for the post-quantum era and a simplified version of the encryption standard used across the modern internet.
The first result substantially weakens HAWK, a digital signature scheme being considered by the U.S. National Institute of Standards and Technology. The second introduces a new attack on a seven-round version of AES, the symmetric cipher used to protect data in applications ranging from online banking to secure communications.
Neither result puts current production systems at risk. HAWK has not been standardized or deployed, while the AES finding applies only to a deliberately weakened research version with seven rounds instead of the full ten used by AES-128. Anthropic said no software needs to be changed because of the discoveries.
Even with those limits, the work marks a significant advance in what frontier models can contribute to mathematics and security research. Claude did not merely identify mistakes in how programmers implemented an algorithm. It found new mathematical weaknesses in the designs themselves.
Anthropic said each discovery cost about $100,000 in model usage. Claude found the HAWK result in roughly 60 hours and conceived the AES attack in about one week. Human verification took considerably longer, with two researchers spending nearly a month gaining confidence that the AES method was correct.
Claude Cut HAWK’s Effective Security in Half
HAWK is one of the remaining candidates in NIST’s effort to identify additional digital signature systems that could remain secure after the arrival of cryptographically relevant quantum computers. Such machines could eventually break widely used classical signature schemes, making post-quantum alternatives a major priority for governments and technology companies.
HAWK had already survived two rounds of expert review over two years. Its security relies in part on the difficulty of a mathematical problem involving structured lattices. Previous research showed that finding a particular symmetry in the lattice could enable an attack, but it was not known whether that symmetry could be efficiently identified in HAWK’s construction.
Claude found the missing structure, a nontrivial automorphism that allows an attacker to search the relevant mathematical space much faster. The improvement remains exponential rather than becoming an efficient polynomial-time break, but it sharply reduces the security claimed for the proposed parameters.
For the small HAWK-256 challenge set, the estimated work needed for a full key-recovery attack fell from roughly 264 operations to 238. Larger parameter sets remain impractical to attack, but Anthropic said HAWK would need approximately double-sized keys to recover the intended security margin.
That change would eliminate several of the qualities that made HAWK attractive, including compact keys and signatures. The finding is specific to HAWK and does not affect other post-quantum candidates or lattice-based cryptography as a whole.
Claude worked semi-autonomously through an agentic research harness based on Claude Code. Multiple worker agents reviewed academic literature, proposed ideas, ran Python and Sage experiments, criticized one another’s conclusions, and built an end-to-end verification pipeline.
The decisive insight emerged through collaboration between two agents. One initially rejected the idea as infeasible, while the second found a way to exploit it. They continued exchanging messages until both concluded that the attack worked.
Human involvement was mostly limited to project management, including advice on organizing ideas and selecting software libraries. The Anthropic researcher overseeing the work had a background in theoretical computer science but was not a specialist in lattice cryptography.
The HAWK result fits a broader shift in AI-assisted security research. Microsoft’s recent MAI-Cyber system uses specialized agents to find vulnerabilities in large codebases, while Claude’s new work moves beyond software bugs into the mathematical assumptions beneath cryptographic systems.
An Almost Autonomous Attack on Reduced-Round AES
The second project focused on AES-128, which encrypts data through ten repeated transformation rounds. Cryptographers often study reduced-round versions to understand how much security each layer contributes and whether new techniques might eventually threaten the complete cipher.
Claude attacked a seven-round variant under a chosen-plaintext model, where an attacker can request encryptions of selected inputs and inspect the outputs. The prior best method required an enormous number of chosen plaintexts and remained entirely impractical.
Mythos Preview developed a new fingerprinting technique that it called the Möbius Bridge. The method removed one set of 256 guesses required by earlier meet-in-the-middle attacks. Additional optimizations offset the cost of computing the new fingerprint, producing an overall speed improvement of between 200 and 800 times.
The result does not break full AES-128. It applies to only seven of the cipher’s ten rounds and would still cost hundreds of millions of dollars to implement under unrealistic data requirements. Its value is scientific rather than operational, extending decades of research into how close reduced-round attacks can move toward the full standard.
The discovery was more autonomous than the HAWK work. An Anthropic researcher created a scaffold that let Claude generate hypotheses, run experiments, reject failures, and continue searching. The model initially resisted the task, arguing that the target was too heavily studied and that “there’s nothing easy to find.”
After researchers adjusted the instructions to emphasize genuinely novel work, Claude rewrote parts of its own research harness and began exploring more ambitious ideas. Over several days, it generated hundreds of millions of tokens, eventually producing about one billion output tokens as it refined the attack.
Anthropic said researchers gave only a small number of substantive prompts during the central search. Claude found the Möbius Bridge idea after three days, then spent several more days improving the method and preparing the reasoning later used in the technical paper.
Verification became the bottleneck. Anthropic researchers spent several hundred hours learning enough specialized cryptography to test the model’s claims, inspect its proof, confirm its runtime analysis, and prepare the paper. Claude produced the central idea in a week, while two people needed nearly a month to become confident it was correct.
That gap may be as important as the attack itself. Advanced models can now produce research outputs faster than qualified humans can evaluate them, creating a new challenge for fields where incorrect conclusions can be subtle and potentially dangerous.
Anthropic has responded by working with ETH Zurich, Tel Aviv University, and TU Berlin on CryptanalysisBench, a benchmark designed to measure how well language models can analyze a wide range of cryptographic systems. The company also followed responsible disclosure procedures and consulted academics, government officials, and industry partners before releasing the results.
A Scientific Breakthrough With a Dual-Use Warning
Anthropic says the discoveries show cryptography operating as intended. New schemes are published and attacked before deployment so weaknesses can be found while changes are still possible. In that sense, the HAWK result strengthens the standards process rather than undermining it.
The AES work is similarly part of a long academic tradition. Studying weaker variants does not mean the deployed cipher has failed. It helps researchers understand the margin separating current attacks from the complete algorithm.
Yet the pace of improvement raises a more difficult question. Anthropic says language models went from struggling with basic cryptanalysis to finding weaknesses that escaped years of expert review in roughly one year. The company expects AI systems to inspect far more algorithms than human specialists could review manually.
Claude has already produced preliminary attacks on reduced versions of LEA and Serpent-128, along with smaller improvements involving Salsa20, Poseidon, and SHA-1. None of these results currently threaten full production ciphers, but they suggest the two published attacks may not be isolated cases.
The advance also reinforces the dual-use problem behind Anthropic’s earlier safeguards for its most capable cyber models. The same system that helps standards bodies find flaws before deployment could help an attacker search for weaknesses in algorithms already protecting real data.
That risk is one reason Mythos Preview is not generally available. Anthropic has restricted access through Project Glasswing while it develops methods for distinguishing legitimate defensive research from requests that could enable harmful exploitation.
The broader security industry is moving in a similar direction. NVIDIA, Microsoft, IBM, and other companies recently formed an open security alliance to develop shared tools for defending AI systems and critical software. Anthropic’s cryptography work suggests those efforts may eventually need to cover the algorithms beneath software as well as the code implementing them.
The immediate conclusion is reassuring: HAWK is not deployed, reduced-round AES is not the cipher protecting current systems, and the published attacks do not require emergency fixes. The longer-term message is less comfortable.
AI systems are beginning to perform cryptographic research at a level that Anthropic compares with top human experts. If that progress continues, the main constraint may shift from finding weaknesses to validating, disclosing, and repairing them before less responsible actors can use the same capabilities.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
