{"slug": "ai-cryptanalysis-is-real-and-verification-is-the-bottleneck", "title": "AI Cryptanalysis Is Real, and Verification Is the Bottleneck", "summary": "Anthropic's Claude Mythos Preview model found improved attacks against the HAWK post-quantum signature scheme and a reduced-round AES, but verifying the results took researchers nearly a month, highlighting that validation is the bottleneck in AI-driven cryptanalysis. The HAWK attack halves effective security for the smallest parameter set, while the AES attack improved a classic meet-in-the-middle technique by 200x to 800x.", "body_md": "[Security](https://sourcefeed.dev/c/security)Article\n\n# AI Cryptanalysis Is Real, and Verification Is the Bottleneck\n\nAnthropic's Mythos model weakened HAWK and a reduced-round AES, but the hard part was proving it was right.\n\n[Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)\n\n## The result isn't the breakthrough — the workflow is\n\n[Anthropic](https://www.anthropic.com/research/discovering-cryptographic-weaknesses) says its Claude Mythos Preview model found improved attacks against two cryptographic algorithms: a post-quantum signature scheme called HAWK, and a reduced-round version of AES. The headline writes itself — *AI breaks crypto* — and it's wrong. Nothing you run in production changes. AES-128 is fine. HAWK isn't deployed anywhere.\n\nWhat actually happened is more interesting, and more useful to anyone who works in security: a language model did real, publishable cryptanalytic research, mostly on its own, and the hardest part of the whole exercise turned out to be *checking whether it was telling the truth.*\n\nThat inversion is the story. For a generation of security tooling, discovery was expensive and verification was cheap — you found a bug, then a proof-of-concept confirmed it in minutes. Machine-driven cryptanalysis flips that. The model generates plausible attacks faster than experts can validate them, and validation is where the human months go.\n\n## What Claude actually found\n\nTwo results are worth understanding precisely, because the precision is where the hype dies.\n\nOn [HAWK](https://csrc.nist.gov/projects/post-quantum-cryptography) — a lattice-based signature scheme that reached the third round of NIST's post-quantum standardization — Mythos identified a nontrivial automorphism in the underlying lattice that enables a faster enumeration attack. For the smallest parameter set, HAWK-256, the estimated cost of key recovery drops from roughly 2^64 to 2^38 operations. In plain terms: it halves the effective security, so you'd need to double key sizes to stand still. Anthropic reports about 60 hours of model work and roughly $100,000 in API spend to get there.\n\nHere's the caveat the press releases skate past. The attack is still *exponential* — faster, not polynomial, not a break. And the theoretical door was already open. In July 2025, Daniël van Gent and Ludo Pulles published a paper whose title says the quiet part out loud: [ HAWK: Having Automorphisms Weakens Key](https://cic.iacr.org/p/2/2/20). They proved that if you could find a nontrivial automorphism, you could reduce the problem to a smaller Lattice Isomorphism instance. What Mythos contributed was the concrete construction — turning a known \"this would hurt if it existed\" into \"here it is.\" That's a genuine and hard contribution. It is not discovering an unknown weakness from scratch, and honest reporting should say so.\n\nThe AES result is the more impressive piece of machinery. Against a 7-round variant of AES-128 (the real cipher runs 10 rounds), Mythos built a fingerprinting technique it dubbed the \"Möbius Bridge,\" improving on a classic meet-in-the-middle attack by somewhere between 200x and 800x depending on how you measure. This ran largely autonomously over about three days and roughly a billion output tokens. Reduced-round AES cryptanalysis is a crowded academic sport with decades of prior work, so an incremental improvement is expected — but the model produced a novel algorithmic idea, not a literature rehash.\n\nThere's a supporting cast, too: a practical 13-round attack on LEA, a full 6-round key recovery on Serpent-128, and sub-10x nudges on Salsa20, Poseidon, and SHA-1. Anthropic also released [CryptanalysisBench](https://www.anthropic.com/research/discovering-cryptographic-weaknesses), built with ETH Zurich, Tel Aviv University, and the University of Haifa, to measure this class of capability.\n\n## The month nobody tweets about\n\nThe AES attack took the model three days. It took two researchers **nearly a month** to gain confidence the attack was actually correct.\n\nSit with that ratio. This is the operational reality of LLM-assisted research that the demos hide. A model that hypothesizes, runs Sage and Python in a sandbox, and reports a 400x speedup is also a model that can produce a beautifully argued, internally consistent, completely wrong result. In cryptanalysis you can often settle it empirically — implement the attack, count the operations. In domains without a ground-truth oracle, that verification tax gets much worse, and it lands entirely on the humans.\n\nFor working security teams, that's the transferable lesson. If you're imagining pointing a frontier model at your own primitives — a custom KDF, a homegrown protocol, a sketchy nonce scheme — the discovery phase is now plausibly cheap and the confirmation phase is where your senior people disappear for weeks. Budget accordingly. And note the price floor: about $100,000 per headline finding. This is not a tool you casually add to CI. It's a capability a handful of well-funded labs and agencies can afford, which is its own security-model shift — the people who can run this at scale are exactly the people you least want finding your bugs first.\n\n## Who this actually moves\n\n**Standards bodies and PQC candidates.** This is the clearest win. NIST's post-quantum process exists to stress-test schemes before the world depends on them, and an AI that can grind through lattice symmetry in days is a legitimately valuable red-team member. Anthropic disclosed the HAWK finding to the authors and the NIST mailing list before publishing — the right move. Expect submission teams to start running frontier models against their own designs pre-emptively, because the alternative is finding out in public.\n\n**Anyone still running non-standard crypto.** The old wisdom — *don't roll your own* — just got sharper teeth. The barrier to a competent cryptanalyst probing your bespoke construction is dropping toward a five-figure API bill. If you have custom primitives in production, assume the economics of attacking them are changing in your adversary's favor.\n\n**Defensive security more broadly, but not yet.** The seductive read is \"point Claude at any codebase and get vulnerabilities.\" That's not what this shows. This is deep mathematical cryptanalysis with a clean empirical check and expensive human oversight — a narrow, favorable domain. Whether it generalizes to messy application-layer bugs where correctness is fuzzy is unproven, and the verification bottleneck suggests it'll be harder there, not easier.\n\n## The honest read\n\nStrip the framing and this is a real milestone told with more restraint than most: a model that functions as a capable research collaborator in a genuinely hard field, producing results credentialed cryptographers took seriously enough to spend a month confirming. It did not break anything you use. It did demonstrate that the discovery half of security research is getting automated faster than the verification half — and until that gap closes, the human in the loop isn't optional, it's the expensive part. Bet on cryptanalysis-as-a-service arriving before \"AI found a bug, ship the patch\" does.\n\n## Sources & further reading\n\n-\n[Discovering cryptographic weaknesses with Claude](https://www.anthropic.com/research/discovering-cryptographic-weaknesses)— anthropic.com -\n[Discovering Cryptographic Weaknesses with Claude](https://news.ycombinator.com/item?id=49087091)— news.ycombinator.com -\n[HAWK: Having Automorphisms Weakens Key](https://cic.iacr.org/p/2/2/20)— cic.iacr.org -\n[Anthropic says Claude found new weaknesses in cryptographic algorithms](https://cryptobriefing.com/anthropic-says-claude-found-new-weaknesses-in-cryptographic-algorithms/)— cryptobriefing.com -\n[Post-Quantum Cryptography](https://csrc.nist.gov/projects/post-quantum-cryptography)— csrc.nist.gov\n\n[Ji-ho Choi](https://sourcefeed.dev/u/jiho_choi)· Security & Cloud Editor\n\nJi-ho covers the increasingly tangled overlap between cloud architecture and security, drawing on a background as a penetration tester to keep his reporting grounded in real-world attack paths. He never lets a vendor claim go unquestioned and insists that every buzzword come with a proof of concept.\n\n## Discussion 0\n\nNo comments yet\n\nBe the first to weigh in.", "url": "https://wpnews.pro/news/ai-cryptanalysis-is-real-and-verification-is-the-bottleneck", "canonical_source": "https://sourcefeed.dev/a/ai-cryptanalysis-is-real-and-verification-is-the-bottleneck", "published_at": "2026-07-28 19:09:31+00:00", "updated_at": "2026-07-28 19:26:29.053735+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-research", "ai-safety"], "entities": ["Anthropic", "Claude Mythos Preview", "HAWK", "AES", "NIST", "ETH Zurich", "Tel Aviv University", "University of Haifa"], "alternates": {"html": "https://wpnews.pro/news/ai-cryptanalysis-is-real-and-verification-is-the-bottleneck", "markdown": "https://wpnews.pro/news/ai-cryptanalysis-is-real-and-verification-is-the-bottleneck.md", "text": "https://wpnews.pro/news/ai-cryptanalysis-is-real-and-verification-is-the-bottleneck.txt", "jsonld": "https://wpnews.pro/news/ai-cryptanalysis-is-real-and-verification-is-the-bottleneck.jsonld"}}