# Claude Breaks Post-Quantum HAWK Cipher in Just 60 Hours > Source: > Published: 2026-07-29 00:12:16+00:00 Anthropic’s Claude Mythos Preview found a practical key-recovery attack on HAWK-256 — a post-quantum digital signature candidate under active NIST evaluation — in roughly 60 hours of semi-autonomous work. The same vulnerability survived two years of expert human review. The attack reduces the effective security cost from 264 to 238 operations. No deployed systems are at risk today, but the implications for how the cryptographic community validates new standards are hard to dismiss. ## What Claude Found HAWK is a lattice-based signature scheme competing for a slot in NIST’s post-quantum cryptography standard. It’s the only lattice-based candidate among the nine algorithms NIST advanced to Round 3 in May 2026. Its pitch to standardizers: integer-only arithmetic, no floating-point dependencies, and a compact footprint compared to alternatives like Falcon. Mythos discovered a “nontrivial automorphism” in HAWK’s underlying lattice structure — a previously unexploited mathematical symmetry. Prior research had established that if such a symmetry existed in HAWK’s lattice, it would enable attacks. Nobody had confirmed it existed. Claude confirmed it does, then built the attack on top of that finding. The practical result: key recovery runs in approximately 3 hours and 42 minutes on a 96-core server. Anthropic has published the proof-of-concept at [github.com/anthropics/cryptography-research-demo](https://github.com/anthropics/cryptography-research-demo). Mythos also invented what researchers call the “Möbius Bridge” — a technique that improves attacks on seven-round AES-128 by 200 to 800 times. Full AES-128 uses ten rounds, so production systems are unaffected. However, inventing a novel technique on the world’s most-studied block cipher, with no prior roadmap, is notable on its own terms. ## 60 Hours vs. Two Years The headline number deserves a moment of attention. Two years of expert human cryptographic review, across two NIST evaluation rounds, did not surface this flaw. Claude’s multi-agent system found it in approximately 60 hours at a cost of around $100,000 in API compute. The researcher overseeing the process had no specialist knowledge of lattice cryptography — they managed the agents and provided direction, but didn’t contribute to the mathematical discovery. There’s a detail in the methodology worth noting: verification became the real bottleneck. Once Mythos returned the attack, Anthropic’s team spent several hundred hours learning enough cryptography to confirm it was correct. The AI found the flaw faster than experts could check the AI’s work. That asymmetry matters — and it’s only going to grow. [Anthropic’s research post](https://www.anthropic.com/research/discovering-cryptographic-weaknesses) notes that Mythos initially refused the AES task, claiming “there’s nothing easy to find; this is the most-studied block cipher in existence” — then found something novel anyway. Anthropic practiced responsible disclosure throughout: HAWK’s authors were notified in June 2026, and findings were shared with NIST and US government partners before the public release on July 28. ## What This Means for HAWK HAWK-256 is a challenge parameter, not the standard-level configuration. HAWK-512 and HAWK-1024 remain secure. But the problem is structural: to restore security across all parameter sets, HAWK’s designers would need to double key sizes. That change undercuts most of HAWK’s appeal — its compact signatures and efficient arithmetic were the reasons it stood out from competitors. Doubled key sizes erode both advantages significantly. NIST’s deadline for Round 3 parameter tweaks is August 14, 2026. The agency has historical precedent here: SIKE was eliminated entirely after being broken in an hour on a laptop during the previous round. HAWK’s situation is less severe, but the timing is tight. As covered by [The Hacker News](https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html), significant parameter changes typically signal to NIST that an algorithm isn’t mature enough for standardization. NIST has not publicly responded as of July 29. ## What Developers Should Do Right Now In practical terms: nothing urgent. HAWK has never been a finalized standard and isn’t deployed in any production system. If you’ve been following the NIST process and deciding what to implement for post-quantum readiness, the answer hasn’t changed — use what NIST already finalized in 2024. **Digital signatures:** ML-DSA (formerly CRYSTALS-Dilithium), standardized as FIPS 204**Key encapsulation:** ML-KEM (formerly CRYSTALS-Kyber), standardized as FIPS 203**Don’t build on Round 3 candidates**— this is exactly why they’re still candidates Watch NIST’s August 14 deadline for signals on HAWK’s fate. If the authors submit significant parameter changes, that’s likely its exit from the process. ## The Part That Should Change The real news here isn’t that a crypto candidate has a flaw — candidates have always had flaws. The news is that AI found a *novel mathematical insight* that specialists with years of experience didn’t. Mythos didn’t search an existing database of known attacks. It identified a symmetry that prior work had noted as theoretically dangerous but had never proven existed in HAWK’s actual construction. A $100,000 AI run that weakens a NIST candidate is accessible to a determined adversary today. The NIST evaluation process does not currently include systematic AI-assisted cryptanalysis. That gap needs to close before the next generation of standards goes through the same years-long gauntlet — only to have an AI find a hole in 60 hours. Anthropic and a team from ETH Zurich, Tel Aviv University, and the University of Haifa built CryptanalysisBench to standardize this kind of evaluation. NIST should integrate something equivalent into its process now. This isn’t the first time AI has been caught probing security boundaries — ByteIota covered [how AI agents are increasingly operating as red-team operators](https://byteiota.com/t3mp3st-ai-red-teaming-autonomous-operator/) in autonomous contexts. But finding a flaw in an active cryptographic standard is a different category of event. The post-quantum migration timeline hasn’t changed. But the question of who finds the next flaw — and when — just got considerably more complicated. More context is available in [The Next Web’s analysis](https://thenextweb.com/news/anthropic-claude-mythos-cryptographic-attacks-hawk-aes), which raises the pointed question: what happens when AI finds flaws in production systems, not just candidates?