Cryptographers Reviewed It for Two Years and Found Nothing. An AI Found the Flaw in 60 Hours.

Cryptanalysis is the least forgiving discipline in computer science. You cannot bluff it, you cannot hand-wave it, and you cannot ship a plausible-sounding result and hope the reviewers are tired. Either the attack works against the mathematics or it doesn't, and everybody can check.

Which is what makes the past week awkward for anyone still describing large language models as sophisticated autocomplete.

On July 29, Anthropic published results from an unreleased model it calls Claude Mythos Preview. Given a research harness and pointed at real cryptographic algorithms, the model found a previously unknown mathematical weakness in HAWK — a post-quantum signature scheme that had survived two rounds of formal expert review across roughly two years of NIST scrutiny — and cut its effective key strength in half. Separately, and almost entirely on its own, it invented a new attack technique against a reduced version of AES, the cipher sitting underneath most encrypted traffic on Earth.

Now the part that matters, stated plainly and early, because a great many summaries of this story have not been careful about it: nothing you use is broken. No software needs patching. No key needs rotating. Both results are theoretical, and Anthropic says so repeatedly and without hedging.

The significance isn't the damage. It's that the damage was found at all — by a machine, in a field where the humans are exceptionally good and the review process is exceptionally thorough.

The HAWK Result

HAWK is a candidate digital signature scheme in NIST's post-quantum cryptography process — the multi-year effort to replace the encryption that a sufficiently large quantum computer would eventually dismantle. Candidates in that process get pulled apart by the best lattice cryptographers alive, publicly, for years. That is the entire point of the process.

Mythos found something they hadn't: a previously unrecognised nontrivial automorphism in HAWK's underlying lattice structure — a hidden symmetry in the mathematical object the scheme's security rests on. Exploiting it improves the best known key-recovery attack against the scheme.

The numbers are stark. For HAWK-256, the computational cost of a key-recovery attack drops from roughly 2⁶⁴ to 2³⁸. In practical terms the scheme's effective security is halved, which means HAWK would need to roughly double its key sizes to offer the protection it was advertised as offering — and a post-quantum candidate that needs bigger keys is a less attractive post-quantum candidate.

Two caveats keep this from being a catastrophe. The attack remains exponential-time, not polynomial, so larger parameters stay out of reach — the scheme bends rather than collapses. And HAWK is a candidate, not a deployment: no production system anywhere is currently relying on it.

The timeline is the part cryptographers keep re-reading. One Anthropic researcher, working semi-autonomously with the model in an agentic harness with access to Python, the Sage mathematics system and the cryptographic literature, got from a standing start to a verified attack in about one week. Total discovery time: roughly 60 hours. Human contribution: mostly project management.

The AES Result — And the Refusal

The second finding is technically narrower and rhetorically louder, because AES is a name people recognise. Standardised by NIST in 2001, it protects a staggering fraction of the world's stored and transmitted data.

Full AES-128 runs ten rounds. Cryptanalysts routinely attack reduced-round versions — seven rounds, say — as a way of measuring how much safety margin the real cipher has left. Progress against seven-round AES tells you nothing about whether your VPN is safe; it tells you how the field is trending.

Against seven-round AES-128, Mythos invented a fingerprinting technique it named the "Möbius Bridge," slotted into the standard meet-in-the-middle attack framework. The technique eliminates one required 2⁵⁶ guessing step, cutting the attack's work by a factor of 256 and producing an overall speedup of 200× to 800× depending on how you measure it.

It is also entirely unusable. The attack requires around 2¹⁰⁵ chosen plaintexts — north of 400 octillion messages, all encrypted under the key you're trying to recover. Nobody has that. Nobody will ever have that. It is a result about mathematics, not about anyone's data.

What lifts it out of the footnotes is how it was produced. The researcher built a scaffold that let Claude pose its own hypotheses, run its own experiments and design its own attacks, then largely stepped back. Three days of autonomous work and roughly one billion output tokens later, the technique existed.

And the model's first instinct had been to decline. Asked to improve on seven-round AES, it initially argued the improvement was impossible — a defensible read of a problem the field has been grinding on for two decades. It took three prompts nudging it toward genuine novelty rather than, in the researchers' framing, the low-hanging fruit, before it committed to the search.

The Full Scoreboard

HAWK and AES drew the headlines, but they weren't the only targets. The broader run produced a spread of results, and one of them is genuinely practical.

Anthropic disclosed the findings to NIST, to HAWK's authors, and to government and industry partners before going public — the ordinary responsible-disclosure path, followed in a situation the norms were not written for.

What It Cost

Each of the two headline results ran to roughly $100,000 in API compute.

Sit with that number, because it cuts two ways at once.

Against a university cryptography group — a professor, a couple of PhD students, several years — $100,000 for a novel published result is not obviously expensive. It is, arguably, cheap. That is the optimistic reading, and it is the one Anthropic leans into: cryptographic designers equipped with capable models could stress-test their own schemes continuously rather than waiting years to find out what review missed.

The pessimistic reading is the identical sentence with a different subject. $100,000 is trivially within reach of any national intelligence service, any well-funded criminal organisation, and a fair number of individuals. If original cryptanalysis is now a purchasable commodity, it is purchasable by everyone, and the people who buy it first are not obliged to publish.

Both readings are correct. That is the uncomfortable part.

The Verification Bottleneck

There's a quieter finding buried in the methodology that may outlast both headline results.

The AES work took the model three days. Validating that the model's attack was actually correct took human researchers several hundred hours.

That ratio is the whole story of AI-assisted science compressed into two numbers. Generation has become cheap and fast. Verification has not, and verification is the part that cannot be skipped — a cryptanalytic result that hasn't been checked is worth precisely nothing, and models remain fully capable of producing confident, elegant, wrong mathematics.

Anthropic's own framing is that language models are able to discover so many candidate bugs that human verification becomes the bottleneck. Every field that adopts this pattern inherits the same problem: an inexhaustible generator of plausible results attached to a finite supply of people qualified to tell which ones are real.

The company is at least building infrastructure for the question rather than just posing it. Alongside the research, it worked with ETH Zurich, Tel Aviv University and TU Berlin on CryptanalysisBench, a benchmark for measuring how good models actually are at this — so the next claim of an AI cryptanalytic breakthrough can be evaluated against something other than a press release.

The Reaction, and the Question Underneath It

Outside response has been measured, which is the correct temperature for a result with no deployed impact.

Ellen Boehm, senior vice president at certificate-management firm Keyfactor, read the HAWK finding as a system working rather than a system failing — validation, she said, that the NIST post-quantum evaluation process is doing its job. A candidate got attacked before standardisation, which is exactly what the candidacy period exists for. She also drew the practical lesson for enterprises:

Her follow-on point is the actionable one for anyone running infrastructure: this elevates the importance of organisations knowing where cryptography actually sits inside their enterprise. If the pace of cryptanalysis is about to increase, the ability to find and swap out an algorithm quickly stops being a compliance checkbox and becomes an operational capability.

What almost nobody has answered — including Anthropic, which raised it — is the obvious next question. This time the model broke a candidate scheme and a reduced cipher, and disclosure was straightforward because nothing was at stake.

What happens the first time a model finds a genuine flaw in something already protecting production systems? There is no established playbook for that disclosure. Who gets told, in what order, and how long does the world get to migrate before the finding leaks? Those questions used to be hypothetical because the discovery rate was slow enough that the process could be improvised each time. If the rate goes up, improvisation stops being viable.

What to Actually Take From This

• Your encryption is fine. Full AES is untouched. HAWK isn't deployed anywhere. If you take one fact from this story, take that one — and be suspicious of any coverage that implies otherwise.
• Post-quantum standardisation just got harder, and better. Candidate schemes now face a reviewer that works around the clock for six figures. More will break during evaluation. That is the process succeeding, not failing — but it may slow the timeline, and the quantum migration was already behind schedule.
• Crypto-agility moved up the priority list. If algorithms start falling faster, the organisations that can identify and replace one in weeks will be in a very different position from those that need years.
• The capability curve is the actual headline. A year ago these models could not attack a toy cipher. The specific results matter less than the slope of the line they sit on.