AIArticle Anthropic's cryptanalysis results say less about AES than about who checks the machine's homework.
Rachel Goldstein A frontier AI model just ended a post-quantum signature scheme's shot at standardization. This week Anthropic published two cryptanalysis results produced by Claude Mythos Preview: a new key-recovery attack on HAWK, a lattice-based signature candidate in NIST's additional post-quantum signature process, and a 200–800× speedup on the best known attack against 7-round AES-128. The HAWK team has since withdrawn the scheme, concluding that the obvious fixes — doubling parameters or moving to higher-rank modules — would erase its competitive edge.
Before anyone reaches for the incident channel: nothing you run in production got weaker this week. But if you build or depend on cryptographic tooling, the interesting part isn't either attack. It's what the process around them revealed.
What actually broke #
The HAWK result is the substantive one. HAWK's security rests on the module Lattice Isomorphism Problem, and the model found a nontrivial automorphism in HAWK's lattice that nobody had exploited — a symmetry that roughly halves the scheme's effective security. Against HAWK-256, a deliberately scaled-down challenge parameter set, the estimated attack cost dropped from 2^64 to 2^38, and the model's own code recovered a key in hours of wall-clock time. The attack is still exponential, so this is a margin collapse rather than a full break. But when your pitch to NIST is "smaller and faster than the alternatives," a fix that doubles your key sizes is fatal. Withdrawal was the rational move.
The AES result is flashier and matters less. The model improved on the 2013 meet-in-the-middle line of attacks against AES-128 reduced to 7 of its 10 rounds, inventing a fingerprinting trick it called the "Möbius Bridge" that collapses an enumeration stage. A 200–800× speedup sounds dramatic until you see the totals: Matthew Green pegs it at around 2^89 operations and 2^105 chosen plaintexts — you'd need the target to encrypt more data than has ever existed. Full AES is untouched. This is a real contribution to a thirteen-year-old academic literature, not a threat model change.
Green's sharpest observation cuts the other way, though: none of the ingredients in either attack were exotic. The model composed known techniques that human cryptanalysts had every opportunity to combine — HAWK survived years of expert review with this symmetry sitting in plain sight. That should sting. Cryptanalysis was supposed to be the discipline too deep for pattern-matching machines, and it turned out the frontier wasn't new mathematics but sheer willingness to grind through the combinatorial space of known tricks.
Discovery is cheap; belief is expensive #
Here's the number that should reframe how you evaluate every AI-found-a-vulnerability announcement from now on: Anthropic spent roughly $100,000 in API costs per result — and then substantially more human time verifying than the model spent discovering. The HAWK attack took the model about a week of agent time; humans needed around 60 hours to validate it end-to-end. The AES attack ran three days autonomously, burning on the order of a billion output tokens, and took two researchers nearly a month to confirm.
That inversion is the actual story. We've watched it play out before in software security: Google Project Zero's Big Sleep found a real SQLite vulnerability in 2024, XBOW's agents climbed HackerOne leaderboards in 2025, and in the same window curl's maintainers were drowning in plausible-sounding AI slop reports they had to disprove one by one. Cryptanalysis raises the stakes on both ends. A subtle speedup attack can look airtight on paper and be wrong in a way only weeks of expert scrutiny will catch — Green flags exactly this failure mode. Anthropic's answer, a verification harness where the model proposes hypotheses and validates them experimentally against real implementations, is why these two results survived and why the "preliminary" attacks on LEA, Serpent, and Salsa20 are still labeled preliminary.
The economics land unevenly. Scheme designers just got a tireless red team that works for API credits — genuinely great for a NIST process whose whole premise is surviving adversarial attention, and it's hard to see future submissions not getting this treatment as table stakes. Academic cryptanalysts get scooped on low-hanging compositions of known techniques, and the field's prestige economy — built on attack papers — gets strange fast. And maintainers of anything cryptographic should brace for the curl problem at higher difficulty: a flood of AI-generated "attacks" where refuting each one costs senior-expert-weeks. Anthropic's CryptanalysisBench, built with ETH Zurich, Tel Aviv University, and TU Berlin, at least gives the community a shared yardstick for which models' claims deserve that attention.
What to do with this #
Concretely, for most teams: nothing changes in your migration plan. ML-KEM, ML-DSA, and SLH-DSA — the standards NIST already finalized — are unaffected, and this attack technique doesn't transfer to them. If you were tracking the additional-signature onramp for a FALCON-style compact lattice signature, HAWK just left the board; adjust accordingly. AES stays exactly where it was.
The judgement call I'd defend: this is a genuine capability shift, not a hype cycle — but a narrow one. The model didn't "crack encryption"; it demonstrated that combinatorial search over known cryptanalytic techniques is now automatable at around $100K per result, with human verification as the hard bottleneck. That price falls every year. The uncomfortable question isn't whether AI will find weaknesses in something deployed — at this trajectory, eventually one will — it's whether the community's verification capacity scales anywhere near as fast as the discovery side. Right now it doesn't, and the teams investing in verification tooling and reproducible attack artifacts, rather than raw discovery, are the ones building the part that will actually be scarce.
Sources & further reading #
[Some thoughts about Anthropic's new cryptanalysis results](https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/)— blog.cryptographyengineering.com -
[Discovering cryptographic weaknesses with Claude](https://www.anthropic.com/research/discovering-cryptographic-weaknesses)— anthropic.com -
[Anthropic's Claude Mythos finds weaknesses in encryption algorithms](https://cyberscoop.com/anthropic-claude-mythos-encryption-flaws-hawk-aes-pqc/)— cyberscoop.com -
[Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack](https://thehackernews.com/2026/07/claude-ai-just-cracked-post-quantum.html)— thehackernews.com
[Rachel Goldstein](https://sourcefeed.dev/u/rachel_goldstein)· Dev Tools Editor
Rachel has been embedded in the developer tooling ecosystem for nearly eight years, covering everything from IDE wars and package-manager drama to the quiet rise of AI-assisted coding. She has a soft spot for open-source maintainers and an unhealthy number of terminal emulators installed on a single laptop.
Discussion 0 #
No comments yet
Be the first to weigh in.