On July 28, 2026, Anthropic announced two research results from cryptanalysis conducted with Claude Mythos Preview. The first is a key-recovery attack against HAWK, a post-quantum digital signature scheme currently under evaluation by the U.S. National Institute of Standards and Technology (NIST). For the small HAWK-256 parameter set, the estimated cost was reduced from 2^64 to 2^38, and the secret key was recovered on a single server within a few hours. The second result targets AES-128 reduced to 7 rounds, cutting the estimated time from 2^99 to somewhere between 2^89.3 and 2^91.4.
Neither result breaks a cryptographic system currently in production use. HAWK is a pre-standardization candidate, and what was demonstrated applies only to a small parameter set. AES-128 uses 10 rounds in its standard form, and the new attack still requires as many as 2^105 chosen plaintexts. What stands out, though, is that the scope of Mythos's search has moved beyond bugs in cryptographic library code and into the mathematical assumptions underlying cryptographic schemes and the complexity of known attacks against them.
HAWK Key Recovery: A Shortcut Hidden in Symmetries of the Public Key
HAWK is a lattice-based digital signature scheme and one of nine candidates that advanced to the third round of NIST's "Additional Digital Signature Schemes" process. This stage is not a decision to adopt the scheme—it is a selection process in which experts publicly scrutinize its security and implementation performance. Among the third-round candidates, HAWK is the only one classified as lattice-based.
HAWK's secret key is a short basis B, and its public key is the Gram matrix Q=B*B derived from it. Previous key-recovery approaches attacked the rank-2n key lattice head-on using BKZ lattice basis reduction, a technique for finding short vectors in integer lattices. A paper by Anthropic's Zygimantas Straznickas and Stephen A. Weis focused on the fact that the power-of-two cyclotomic field HAWK uses has, in addition to ordinary complex conjugation, a second order-2 Galois automorphism, τ: ζ → -ζ.
Using only the public key Q, the two researchers constructed a rank-n "cocycle lattice" that contains the secret basis transformation Vτ = B^-1τ(B) as its shortest vector. From this shortest vector, the automorphism can be extracted, and through a descent process, an equivalent signing key can be recovered. What the paper demonstrates is a method for reducing HAWK-n key recovery to a polynomial number of queries to an exact shortest vector problem (SVP) in dimension n/2+1.
Here, "polynomial number" does not mean HAWK's keys can be broken in polynomial time. The SVP instances being queried remain hard, and the overall complexity is still exponential. However, the reduction in the dimension required for the attack has a significant effect. Under the paper's gate-count model, the estimated costs for each parameter set change as follows:
| Parameter | Previous Estimated Cost | New Estimated Upper Bound | Demonstration Status |
|---|---|---|---|
| HAWK-256 | 2^64 | 2^38 | Hours on a single server |
| HAWK-512 | 2^150 | 2^108 | Not a practical attack |
| HAWK-1024 | 2^288 | 2^182 | Not a practical attack |
According to Anthropic, restoring security to its previous level would require roughly doubling the key size, which would erode the compact-key advantage that has been one of HAWK's selling points. Because the attack exploits algebraic structure specific to HAWK, it does not transfer to Falcon, another lattice-based signature scheme. Nor does it weaken other NIST post-quantum signature schemes or lattice-based cryptography in general. Anthropic states that it shared the findings with HAWK's developers in June and disclosed them to NIST's mailing list at the same time the paper was made public.
An Erased Byte of Brute Force in 7-Round AES
AES is a symmetric-key cipher that encrypts 128-bit blocks; AES-128, AES-192, and AES-256 differ in the length of key they use. AES-128, the target here, applies 10 rounds of transformation in its standard form. Cryptographic research often attacks round-reduced variants to measure security margins and probe internal structure. Updating the record for a 7-round attack does not, by itself, bring an attack any closer to the full 10 rounds.
The paper by Milad Nasr and Nicholas Carlini builds on a meet-in-the-middle attack first shown in 2013. The original method requires 2^105 chosen plaintexts, computation equivalent to 2^99, and 2^90 blocks of storage. The attacker guesses partial key bits from both the front and back halves of the cipher, and checks whether the intermediate states after 4 rounds match using a massive lookup table.
The technique Mythos found, called the "Möbius Bridge," exploits the fact that AES's S-box is built from an inverse operation over a finite field combined with an affine transformation. It constructs a fingerprint that stays the same even as an unknown key byte varies, eliminating one of the nine bytes that previously had to be guessed. Looking only at the number of candidates, this is a 256-fold reduction, but computing the fingerprint itself also carries a cost. Combining packed tables, Gray-code-based search, and an XOR-separated cache, the researchers achieved an overall speedup of roughly 200 to 800 times, bringing the estimated time complexity down to between 2^89.3 and 2^91.4.
Even this figure does not describe a feasible attack. The requirement of collecting 2^105 chosen plaintexts is itself far removed from reality, and the new time complexity remains enormous. Rather than running the full-scale attack to completion, the researchers proved the invariance of the fingerprint and formalized part of the proof in Lean. On smaller AES-like ciphers, they carried key recovery through to completion and measured the time taken by each component of the attack. While they layered verification to support their claims, they did not actually measure the attack itself, whose estimated cost is at minimum 2^89.3.
Verification Outlasts Discovery: A New Bottleneck in AI Cryptanalysis
The HAWK result came from a semi-autonomous, multi-agent setup that progressed from discovery through implementation to verification in about 60 hours. Humans provided occasional project management and non-technical advice, and Anthropic estimates API costs at roughly $100,000. That the process was overseen by a theoretical computer science researcher without a background in lattice cryptography also suggests how AI might broaden the reach of specialized research.
On the AES side, humans set up the experimental infrastructure and defined the goal. Mythos initially declined the request or responded that no new result was possible, but after humans nudged it several times to look for a genuinely new result against 7 rounds rather than a summary of known techniques, it reached the first attack within three days and several hundred million tokens, then continued refining it until total output reached roughly one billion tokens. Here too, API costs were about $100,000.
This is where the boundaries of the word "autonomous" lie. Within the scaffolding humans provided, the model discovered the core of the attack—but humans set the research problem, decided when to push for continuation, confirmed correctness, and handled disclosure and publication. Where the AES discovery took about a week, the researchers spent several hundred hours—nearly a month—on verification. Simply increasing output volume does not increase the throughput of cryptographic research. The next bottleneck lies in the work of checking novelty, weeding out flawed proofs or complexity estimates, and judging the actual impact on security.
Breaking It Before Standardization Is a Form of Defense
Both results are also examples of cryptanalysis working as intended. HAWK is a public candidate specifically exposed to attack before adoption; if weaknesses are found, its parameters or design can be revised, or it can be dropped from consideration. The attack on the reduced-round AES variant serves as a way to measure the distance to the full 10 rounds and to understand which structural elements support the security margin. Framing this more broadly—as "internet cryptography has been broken"—would be far more dangerous than the actual findings warrant.
Anthropic, together with researchers from ETH Zurich, Tel Aviv University, and the University of Haifa, also released "CryptanalysisBench," a benchmark comprising 191 problems. Five frontier models solved 65-86% of Tier 1 problems, which have known practical attacks, while on the harder Tier 2 problems, they solved 6-12 full-strength schemes and 24-61 schemes when reduced-round versions were included. Still, this reflects a single snapshot from an arXiv preprint and benchmark released at the same time—it is not evidence that models can routinely break cryptography deployed in production.
What comes next will test both the capacity to generate attacks and the capacity to absorb their results: whether independent cryptography researchers can reproduce the new findings, how NIST and HAWK's developers handle the parameters, and whether humans can keep up with verifying the flood of candidates models produce. If future results land on deployed schemes rather than pre-standardization candidates, the gap between fixing and disclosure will translate directly into risk. The real preparation for AI-driven cryptanalysis lies not in having a stronger model, but in making verification and responsible disclosure keep pace with the speed of discovery.