- Anthropic’s HAWK paper lowers the estimated key-recovery cost for HAWK-512 from 2^150 to 2^108 gates and for HAWK-1024 from 2^288 to 2^182 under the paper’s gate-count model. [2] - HAWK is one of nine candidates in the third round of NIST’s additional post-quantum signature process. It is not deployed to secure current internet traffic. [3] - The separate AES result applies to seven-round AES-128 under a 2^105 chosen-plaintext assumption. Production AES-128 uses 10 rounds and was not broken. [1][7] - Anthropic estimates that each project used roughly $100,000 in API calls. The HAWK result took about 60 hours; the AES experiment ultimately generated roughly one billion output tokens.
[1] Anthropic said its Claude Mythos Preview model helped find a substantially faster attack against HAWK, a proposed post-quantum digital signature scheme under review by the National Institute of Standards and Technology. The company also reported a 200- to 800-fold speedup for an academic attack on a deliberately reduced version of the Advanced Encryption Standard.[1]
The results are significant cryptography research, but they do not show that the encryption protecting web traffic, bank accounts or current software has been broken. HAWK has not been deployed, while the AES work targets seven of AES-128’s 10 rounds under assumptions that make the attack impractical.[1][3][7]
The HAWK attack cuts its estimated security margin #
HAWK is one of nine third-round candidates in NIST’s process for selecting additional post-quantum digital signatures. Its fast, floating-point-free signing process and compact keys made it an attractive candidate, but its security relies on the comparatively less-established module Lattice Isomorphism Problem.[2][3][4]
Working with an Anthropic researcher, Mythos identified a previously unused symmetry, or automorphism, in HAWK’s underlying lattice. Anthropic’s paper shows how that symmetry reduces key recovery to a shortest-vector problem in dimension n/2+1, rather than attacking the full rank-2n key lattice. The researchers released demonstration code and reported recovering a HAWK-256 secret key in a few hours on one server.[2]
For HAWK’s larger parameter sets, the attack remains computationally infeasible. Under the gate-count model used in the paper, however, the estimated key-recovery cost falls from 2^150 to 2^108 for HAWK-512 and from 2^288 to 2^182 for HAWK-1024.[2] Those figures are more precise than Anthropic’s promotional description that the model cut HAWK’s effective key strength in half. The paper instead demonstrates a roughly halved lattice-attack dimension, with different reductions in the estimated work factor for each parameter set.[1][2]
Anthropic said doubling HAWK’s key sizes could recover a comparable security margin but would undermine much of the scheme’s efficiency advantage. Its paper also identifies alternative mathematical settings that evade this specific attack, indicating that the result is directed at HAWK’s current construction rather than lattice cryptography generally. The attack does not transfer to Falcon, another lattice-based signature scheme.[1][2]
A July 29 thread on NIST’s public post-quantum cryptography forum, involving Anthropic researcher Steve Weis and HAWK co-author Léo Ducas, begins with HAWK contributors thanking Anthropic for its contribution. [5] The public archive view available to MLQ did not expose enough of the reply to support a stronger claim about whether the team plans to change HAWK’s parameters or construction.
Chris Peikert, a University of Michigan cryptographer who is not listed among the Anthropic paper’s or HAWK submission’s authors, called the finding a “serious mathematical attack” on a candidate for potential NIST standardization. [6] That provides an early independent assessment of the HAWK result, although the Anthropic paper itself has not completed conventional academic peer review.
The AES result does not reach production AES #
Mythos separately developed what Anthropic calls the Möbius Bridge, a technique that eliminates one key-byte guess from an existing meet-in-the-middle attack against seven-round AES-128. The paper reports reducing the attack’s runtime from roughly 2^99 to between 2^89.3 and 2^91.4 operations, depending on how the work is counted — an improvement of about 200 to 800 times.[7]
AES-128 as deployed uses 10 rounds. Cryptographers study reduced-round versions to measure a cipher’s security margin and develop techniques that might later generalize. The Mythos attack also retains the earlier attack’s requirement for 2^105 chosen plaintexts and cannot be executed end to end with foreseeable computing resources.[7]
Anthropic’s researchers instead tested individual components, formalized one required property in the Lean proof assistant, exhaustively evaluated smaller instances and ran a complete recovery attack against a scaled-down AES-like cipher. The paper’s authors say they are highly confident in the central transform but acknowledge that they cannot run the full seven-round attack to verify the complete complexity estimate empirically.[7]
That limitation makes the AES paper less directly testable than the HAWK result. Anthropic said it consulted academics while validating its findings, but the paper lists only two Anthropic researchers as authors. MLQ did not identify a named independent cryptographer who had published a full technical assessment of the AES result as of July 29.[1][7]
Descriptions of Mythos finding vulnerabilities in algorithms that “secure the internet” therefore need qualification. HAWK is an undeployed candidate being publicly tested before standardization. The AES result concerns a deliberately weakened research variant and does not compromise the full cipher used in current systems.
Discovery was faster than human verification #
Anthropic said Mythos found and verified the HAWK approach in about 60 hours with occasional project-management guidance from a researcher with a theoretical computer science background but no specialization in lattice cryptography. The company estimated approximately $100,000 in API costs for the project.[1]
For AES, an Anthropic researcher constructed an agent scaffold that let the model propose ideas and test them with computational tools. Mythos generated several hundred million tokens before finding the central technique and roughly one billion output tokens across the completed experiment. Anthropic said its researchers then spent several hundred hours checking the work and nearly a month gaining confidence in the result.[1] A related benchmark paper co-authored by researchers from Anthropic, ETH Zurich, Tel Aviv University and the University of Haifa contains 191 tasks covering six families of cryptographic primitives. Its authors report that five frontier models solved 65% to 86% of tasks involving schemes with known practical breaks and also generated several results they believe to be novel.[8]
The benchmark and the two Anthropic papers do not establish that language models can break deployed, well-reviewed cryptography. They do show that sufficiently long and expensive model runs can contribute useful ideas to candidate review and reduced-round cryptanalysis, while shifting more of the human workload toward checking machine-produced mathematics.
For NIST, the immediate question is whether HAWK can be revised without sacrificing the properties that made it competitive. Neither paper requires emergency patches or changes to cryptography already deployed in production.[1][2][3]
Companies mentioned #
Further sources #
[[1] Anthropic, “Discovering cryptographic weaknesses with Claude,” July 28, 2026. ↗](https://www.anthropic.com/research/discovering-cryptographic-weaknesses)
[[2] Zygimantas Straznickas and Stephen A. Weis, “HAWK-n Key Recovery Reduces to SVP… ↗](https://anthropic.com/document/hawk_key_recovery.pdf)
[[3] National Institute of Standards and Technology, “Post-Quantum Cryptography: Add… ↗](https://csrc.nist.gov/projects/pqc-dig-sig/round-3-additional-signatures)
[[4] HAWK team, “HAWK v1.1 Specification Document — Round 2,” NIST submission. ↗](https://csrc.nist.gov/csrc/media/Projects/pqc-dig-sig/documents/round-2/spec-files/hawk-spec-round2-web.pdf)
[[5] NIST PQC Forum listing for “HAWK-n Key Recovery Reduces to SVP in Dimension n/2… ↗](https://groups.google.com/a/list.nist.gov/g/pqc-forum)
[6] Chris Peikert, public assessment of the HAWK attack, July 28, 2026. ↗+2 more
The stories that matter, in one email. Free — unsubscribe anytime.