SecurityArticle Anthropic's Mythos model weakened HAWK and a reduced-round AES, but the hard part was proving it was right.
The result isn't the breakthrough — the workflow is #
Anthropic says its Claude Mythos Preview model found improved attacks against two cryptographic algorithms: a post-quantum signature scheme called HAWK, and a reduced-round version of AES. The headline writes itself — AI breaks crypto — and it's wrong. Nothing you run in production changes. AES-128 is fine. HAWK isn't deployed anywhere.
What actually happened is more interesting, and more useful to anyone who works in security: a language model did real, publishable cryptanalytic research, mostly on its own, and the hardest part of the whole exercise turned out to be checking whether it was telling the truth.
That inversion is the story. For a generation of security tooling, discovery was expensive and verification was cheap — you found a bug, then a proof-of-concept confirmed it in minutes. Machine-driven cryptanalysis flips that. The model generates plausible attacks faster than experts can validate them, and validation is where the human months go.
What Claude actually found #
Two results are worth understanding precisely, because the precision is where the hype dies.
On HAWK — a lattice-based signature scheme that reached the third round of NIST's post-quantum standardization — Mythos identified a nontrivial automorphism in the underlying lattice that enables a faster enumeration attack. For the smallest parameter set, HAWK-256, the estimated cost of key recovery drops from roughly 2^64 to 2^38 operations. In plain terms: it halves the effective security, so you'd need to double key sizes to stand still. Anthropic reports about 60 hours of model work and roughly $100,000 in API spend to get there.
Here's the caveat the press releases skate past. The attack is still exponential — faster, not polynomial, not a break. And the theoretical door was already open. In July 2025, Daniël van Gent and Ludo Pulles published a paper whose title says the quiet part out loud: HAWK: Having Automorphisms Weakens Key. They proved that if you could find a nontrivial automorphism, you could reduce the problem to a smaller Lattice Isomorphism instance. What Mythos contributed was the concrete construction — turning a known "this would hurt if it existed" into "here it is." That's a genuine and hard contribution. It is not discovering an unknown weakness from scratch, and honest reporting should say so.
The AES result is the more impressive piece of machinery. Against a 7-round variant of AES-128 (the real cipher runs 10 rounds), Mythos built a fingerprinting technique it dubbed the "Möbius Bridge," improving on a classic meet-in-the-middle attack by somewhere between 200x and 800x depending on how you measure. This ran largely autonomously over about three days and roughly a billion output tokens. Reduced-round AES cryptanalysis is a crowded academic sport with decades of prior work, so an incremental improvement is expected — but the model produced a novel algorithmic idea, not a literature rehash.
There's a supporting cast, too: a practical 13-round attack on LEA, a full 6-round key recovery on Serpent-128, and sub-10x nudges on Salsa20, Poseidon, and SHA-1. Anthropic also released CryptanalysisBench, built with ETH Zurich, Tel Aviv University, and the University of Haifa, to measure this class of capability.
The month nobody tweets about #
The AES attack took the model three days. It took two researchers nearly a month to gain confidence the attack was actually correct.
Sit with that ratio. This is the operational reality of LLM-assisted research that the demos hide. A model that hypothesizes, runs Sage and Python in a sandbox, and reports a 400x speedup is also a model that can produce a beautifully argued, internally consistent, completely wrong result. In cryptanalysis you can often settle it empirically — implement the attack, count the operations. In domains without a ground-truth oracle, that verification tax gets much worse, and it lands entirely on the humans.
For working security teams, that's the transferable lesson. If you're imagining pointing a frontier model at your own primitives — a custom KDF, a homegrown protocol, a sketchy nonce scheme — the discovery phase is now plausibly cheap and the confirmation phase is where your senior people disappear for weeks. Budget accordingly. And note the price floor: about $100,000 per headline finding. This is not a tool you casually add to CI. It's a capability a handful of well-funded labs and agencies can afford, which is its own security-model shift — the people who can run this at scale are exactly the people you least want finding your bugs first.
Who this actually moves #
Standards bodies and PQC candidates. This is the clearest win. NIST's post-quantum process exists to stress-test schemes before the world depends on them, and an AI that can grind through lattice symmetry in days is a legitimately valuable red-team member. Anthropic disclosed the HAWK finding to the authors and the NIST mailing list before publishing — the right move. Expect submission teams to start running frontier models against their own designs pre-emptively, because the alternative is finding out in public.
Anyone still running non-standard crypto. The old wisdom — don't roll your own — just got sharper teeth. The barrier to a competent cryptanalyst probing your bespoke construction is dropping toward a five-figure API bill. If you have custom primitives in production, assume the economics of attacking them are changing in your adversary's favor.
Defensive security more broadly, but not yet. The seductive read is "point Claude at any codebase and get vulnerabilities." That's not what this shows. This is deep mathematical cryptanalysis with a clean empirical check and expensive human oversight — a narrow, favorable domain. Whether it generalizes to messy application-layer bugs where correctness is fuzzy is unproven, and the verification bottleneck suggests it'll be harder there, not easier.
The honest read #
Strip the framing and this is a real milestone told with more restraint than most: a model that functions as a capable research collaborator in a genuinely hard field, producing results credentialed cryptographers took seriously enough to spend a month confirming. It did not break anything you use. It did demonstrate that the discovery half of security research is getting automated faster than the verification half — and until that gap closes, the human in the loop isn't optional, it's the expensive part. Bet on cryptanalysis-as-a-service arriving before "AI found a bug, ship the patch" does.
Sources & further reading #
[Discovering cryptographic weaknesses with Claude](https://www.anthropic.com/research/discovering-cryptographic-weaknesses)— anthropic.com -
[Discovering Cryptographic Weaknesses with Claude](https://news.ycombinator.com/item?id=49087091)— news.ycombinator.com -
[HAWK: Having Automorphisms Weakens Key](https://cic.iacr.org/p/2/2/20)— cic.iacr.org -
[Anthropic says Claude found new weaknesses in cryptographic algorithms](https://cryptobriefing.com/anthropic-says-claude-found-new-weaknesses-in-cryptographic-algorithms/)— cryptobriefing.com -
[Post-Quantum Cryptography](https://csrc.nist.gov/projects/post-quantum-cryptography)— csrc.nist.gov
[Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)· Security & Cloud Editor
Ji-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept.
Discussion 0 #
No comments yet
Be the first to weigh in.