Anthropic announced on July 28 that Claude Mythos Preview autonomously discovered novel cryptanalytic attacks, including a key-recovery attack on HAWK, a candidate in NIST's post-quantum signature standardization process, within 60 hours of autonomous operation.
1. HAWK Attack: A Weakness Two Years of Expert Review Missed
HAWK is a digital signature candidate based on the Lattice Isomorphism Problem. Two rounds of human expert review over two years found no exploitable algebraic symmetries. Claude Mythos Preview, running in a Claude Code-style multi-agent harness with a sandbox, Python, and Sage, autonomously:
1. Performed extensive literature review on state-of-the-art attacks 2. Conducted mathematical reasoning and computational experiments 3. Discovered a nontrivial automorphism in HAWK's lattice structure — previously assumed not to exist — and built a full exploitation path from the automorphism to accelerated key recovery
Result:
| Parameter | Before | After Mythos Attack | |---|---|---| | HAWK-256 full key recovery cost | 2^64 | 2^38 (effective key length halved) |
Anthropic notes that matching the original security level would require doubling key sizes, which would eliminate HAWK's core advantages (small keys, fast signing) — directly undermining its NIST candidacy.
2. AES Attack: The 'Mobius Bridge' Algorithm, 200-800x Speedup
The second target was the best known meet-in-the-middle attack on reduced-round AES-128 (7 of 10 rounds) — not full AES. Mythos invented the Mobius Bridge algorithm: a fingerprint function invariant across 256 guesses, reducing a costly enumeration stage by 256x, yielding a net 200-800x speedup over prior best attacks.
- Fully autonomous runtime: 3 days
- Output: ~1 billion tokens
- API cost: ~$100,000
- Scope: reduced-round AES only; full AES is not broken
- Two modes: HAWK used semi-autonomous operation with occasional non-technical human guidance; AES ran fully autonomously with a scaffold for posing and testing hypotheses.
- Multi-agent collaboration: two HAWK workers researched the same idea; one prematurely abandoned it as infeasible, the other found the full exploitation path. Message exchange led both to agree the attack worked.
- Overcoming model reluctance: Mythos initially declined the AES task, calling reduced-round AES-128 "genuinely hard." Three short prompts — including simply stating the goal was a publishable new attack by a "highly intelligent model as good top researcher" — changed its behavior. Anthropic published the original prompts verbatim, typos included, to show the encouragement required no PhD-level expertise.
- Cryptanalysis community: the bottleneck shifts from discovery to verification — validating the AES results took two researchers nearly a month.
- NIST / standardization bodies: schemes vetted by years of expert review can now be probed by AI in 60 hours; AI attack surfaces must enter review processes.
- Companies using cryptography: long-lived credentials, signing keys, and encrypted backups need rolling upgrades and crypto-agility planning.
- Regulators: this lands in the same month as employee petitions on frontier-AI control, reinforcing oversight debates.
- Anthropic blog post: https://www.anthropic.com/research/discovering-cryptographic-weaknesses
- HAWK attack paper: https://www.anthropic.com/document/hawk_key_recovery.pdf
- AES Mobius Bridge paper: https://www.anthropic.com/document/aes_mobius_bridge.pdf
- AES Mobius Bridge chain-of-thought: https://www.anthropic.com/document/aes_mobius_bridge_cot.pdf
- CryptanalysisBench: https://arxiv.org/abs/2607.18538
- HAWK demo code: https://github.com/anthropics/cryptography-research-demo
- HAWK NIST spec: https://csrc.nist.gov/csrc/media/Projects/pqc-dig-sig/documents/round-1/spec-files/hawk-spec-web.pdf
- Anthropic announcement: https://x.com/AnthropicAI/status/2082153297670992134
It also achieved, on 13-round LEA, key recovery with fewer than 2^30 chosen plaintexts running in one hour on a desktop machine — described as the first "practical" grade in a cryptanalysis paper.
3. Methodological Details
4. Why This Matters to Everyone
Anthropic is explicit that there is no practical impact on deployed systems today: HAWK is only a candidate, and the AES attack targets a reduced version. But it warns:
> "We should not assume that language model capabilities will plateau at this level... Many ciphers protecting modern systems have received less scrutiny than they deserve — they might still have important weaknesses lying dormant that LLMs will soon be able to discover."
Implications:
5. CryptanalysisBench
Anthropic also open-sourced CryptanalysisBench (arXiv 2607.18538), developed with ETH Zurich, Tel Aviv University, and TU Berlin. It packages cryptanalysis tasks across multiple ciphers into a reproducible benchmark, letting frontier models be compared on unified cryptanalysis scores — analogous to LMSYS Chatbot Arena or ARC-AGI as shared evaluation infrastructure.