Conor Deegan says AI models exposed mathematical flaws in HAWK and Classic McEliece, two schemes built to survive quantum computers
The cryptography designed to protect us from quantum computers just ran into a different kind of machine. According to Conor Deegan, co-founder of Project Eleven, AI models have found exploitable mathematical flaws in two post-quantum schemes: HAWK and Classic McEliece.
No quantum computer was required. The weaknesses were in the math itself, and AI spotted them.
Deegan made the comments on October 19, 2026. The timing matters because the industry has spent years preparing for a quantum threat. Now it may have to plan for a much faster cryptanalyst that is already here.
What happened to HAWK and McEliece #
Start with HAWK, a digital signature scheme that was competing in the National Institute of Standards and Technology’s (NIST) post-quantum signature standardization round.
In July 2026, Anthropic’s AI model, Claude Mythos, reportedly discovered a symmetry-based key-recovery attack on the scheme. A key-recovery attack is the worst kind. It means an attacker can work backward to the secret key, not just forge a single message.
The research findings describe the attack as halving HAWK’s effective security levels. For HAWK-512, effective security dropped from 2^150 to 2^108 under the attack.
HAWK was withdrawn from the NIST round in July 2026 following the attack. Deegan indicated that the AI findings behind HAWK’s vulnerability surfaced within the two months before his October 19 remarks.
AI, tech, and the markets they move—in one daily briefing.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Classic McEliece is the second casualty. Recent analyses have suggested key-recovery complexity for Classic McEliece is much lower than previously estimated, as low as 2^94 operations in some estimates. By early October 2026, Germany’s Federal Office for Information Security (BSI) had advised against deploying it.
Why the AI angle changes the math #
Post-quantum cryptography exists because quantum computers, once powerful enough, are expected to break many of the encryption and signature systems the internet relies on today. The replacement schemes are built on different math problems that quantum machines are not known to solve efficiently.
AI compresses the timeline for finding flaws. If a model can scan the structure of a scheme and surface a hidden symmetry or shortcut, flaws that might have stayed buried for years could surface in months.
That is the core of Deegan’s warning. The threat model for post-quantum security now has to account for two things at once: quantum hardware that does not yet exist at scale, and AI tools that are already finding weaknesses.
According to the research findings, no production systems using standardized post-quantum algorithms have been compromised by these vulnerabilities. Both HAWK and Classic McEliece were in the candidate stage.
Project Eleven’s response and what it means for digital assets #
Project Eleven was founded in 2024 and focuses on the cryptographic threats facing digital assets. In October 2026, the company launched Strongpoint, a custody platform built around hybrid signing and modular algorithm integration.
Hybrid signing pairs a classical signature with a post-quantum one. An attacker would need to break both to get through. Modular integration allows algorithms to be swapped in or out as new attacks emerge, rather than requiring a rebuild of the whole system.
For the digital asset industry, the stakes are specific. Custody systems guard private keys, and a key-recovery attack against a signature scheme is exactly the kind of failure that could put holdings at risk. The research findings suggest investors and operators may need to look harder at the security assumptions underneath their holdings as AI-assisted attacks become more capable.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our