Claude Mythos finds cryptographic weaknesses in HAWK and AES

Anthropic's Frontier Red Team used its Claude Mythos Preview model to autonomously find mathematical weaknesses in cryptographic algorithms — not in their implementations, but in the design of the ciphers themselves. The company published the results on July 28, 2026: the model improved the best-known attacks on the post-quantum signature HAWK and on a reduced-round variant of AES, doing so in a few days with minimal human oversight.

Key takeaways

• Claude Mythos Preview cut the attack cost on HAWK-256 from … to … — effectively halving the key strength.
• The attack on a 7-round AES-128 variant was sped up 200–800× via a new method named Möbius Bridge.
• HAWK: about 60 hours of work by one researcher. AES: about 3 days of near-autonomous model work.
• Cost per attack: roughly $100,000 in API fees.
• No deployed system is at risk — the AES attack covers 7 of the full cipher's 10 rounds.

Not an implementation bug, but a weakness in the cipher itself

Most published cryptographic vulnerabilities concern code errors — poor randomness, timing leaks, developer mistakes. Anthropic aimed higher: at the mathematical design of algorithms that specialists scrutinize for years. The first target was HAWK, a candidate post-quantum^?post-quantum: resistant to attacks by quantum computers digital signature scheme, currently in the third round of NIST's additional signatures call.

In HAWK's lattice the model discovered a nontrivial symmetry (an automorphism^?automorphism: a structure-preserving mapping of an object onto itself) that prior work had theoretically anticipated but never located in this specific construction. Exploiting it enabled a stronger key-recovery attack: for the HAWK-256 variant the expected cost dropped from … to … operations. In practice that halves the effective key strength and forces a doubling of key sizes to keep the intended security level. The whole effort took one researcher about 60 hours.

AES: the model first called the task impossible

The second target was AES — the symmetric cipher NIST adopted in 2001 and the most-studied block cipher in existence. The researchers did not aim at the full 10 rounds but at a reduced 7-round AES-128 variant, a standard object of academic cryptanalysis. Claude initially resisted, judging the task genuinely hard.

If you want a different outcome, the target has to change. AES-128 r5/r6 is just genuinely hard.

The quote comes from a Claude Mythos Preview work log released by Anthropic.

After three short human prompts over three days — a clarification to seek novel ideas, a reminder to stay on target, and words of encouragement — the model produced several hundred million tokens and developed a concept it called Möbius Bridge. It is a fingerprinting algorithm that improves a meet-in-the-middle^?meet-in-the-middle: an attack that computes from both ends at once and looks for where they meet attack: it eliminated one enumeration step, reducing … lookups to …, and achieved a 200–800× speedup over the best prior attacks. Validation by two human researchers took about a month.

Beyond HAWK and AES

Beyond the two headline results, Mythos found a practical attack on the 13-round LEA cipher, recovering keys with fewer than … plaintexts and runnable in under an hour on a desktop. For 6-round Serpent-128 the model extended a published attack into a full key recovery. Smaller gains (below 10×) covered Salsa20, Poseidon and SHA-1. Anthropic also released CryptanalysisBench, described in an arXiv preprint, to benchmark models in this area.

The bottleneck shifts to verification

The most telling figure is not the number of attacks but the ratio of time. The model needed days; humans needed weeks to check its reasoning, partly because they had to learn cryptography first. That inverts the classic setup in which the human is the creative bottleneck. Anthropic places its result alongside others from 2026, when Google used Gemini to resolve several open Erdős problems and OpenAI reported similar achievements.

In just one year, language models have gone from being unable to perform cryptanalysis of even the most basic ciphers to being capable of finding flaws in cryptographic designs that have escaped discovery despite years of human expert review.

The passage is from the study published by Anthropic's Frontier Red Team.

Why it matters

Cryptanalysis has been a domain where deep, years-long mathematical intuition mattered — hard to automate and poorly scalable. If a model costing about $100,000 can find, in a few days, a symmetry that NIST reviewers missed, the economics of both attack and defense shift. Standards bodies must now assume that candidate algorithms will be probed not only by human teams but by models generating hundreds of millions of tokens of analysis. At the same time, none of the results threatens deployed systems: the AES attack covers 7 of 10 rounds and assumes a threat model that is impractical in reality, while HAWK is deployed nowhere. The real risk is not in these specific ciphers but in the fact that a tool capable of such analysis is already available — and that verifying its output becomes the new constraint. It raises the question of how to responsibly disclose AI-found vulnerabilities before they reach less scrupulous hands.

What's next?

• The HAWK attack was shared with the algorithm's authors in June 2026 and placed under coordinated disclosure to NIST — the third round of the additional post-quantum signatures call is ongoing.
• Anthropic released CryptanalysisBench (arXiv preprint) to track model progress in cryptanalysis.
• The company calls on the academic community to establish norms for handling model-discovered vulnerabilities in systems of real-world significance.

Sources

• Anthropic — Discovering cryptographic weaknesses with Claude
• Anthropic — HAWK key recovery (PDF)
• arXiv — CryptanalysisBench
• NIST — PQC Round 3 Additional Signatures