AI-assisted security research has been finding implementation bugs in cryptographic libraries for a few years. Incorrect API usage, missing boundary checks, key material handled in ways that leak through side channels. Useful work, but not a surprise. Anthropic’s July 28, 2026 research is a different category of result: Claude Mythos Preview identified mathematical weaknesses in the algorithms themselves.
The two findings are an improved key recovery attack on HAWK, a NIST post-quantum signature candidate, and an improved attack on a reduced-round variant of AES. Neither compromises production systems today. What they demonstrate is that a frontier AI model can now contribute original work to cryptanalysis at a level that outpaced two years of expert human review on one of the algorithms actively under evaluation for global standardization.
HAWK Post-Quantum Signature Weakness
HAWK is a lattice-based digital signature scheme under evaluation by NIST through its Additional Digital Signatures process, a second wave of post-quantum standardization that began with a 2022 call for candidates. Lattice-based constructions are attractive for post-quantum cryptography because the problems underlying them are believed to be hard for both classical and quantum computers. HAWK grounds its security in the Lattice Isomorphism Problem (LIP).
Prior work by Ducas and van Woerden had already established a theoretical premise: if an attacker could find a nontrivial automorphism in HAWK’s lattice (a symmetry that maps the lattice back to itself in a non-obvious way), they could mount a practical key recovery attack. What remained unresolved was whether HAWK’s specific construction actually contained such a symmetry in accessible form. Claude Mythos Preview found it.
The automorphism enables a faster enumeration attack. It is still exponential in cost, but the researchers estimate it cuts the effective key strength of the HAWK-256 parameter set roughly in half:
Restoring HAWK to its original security level would require doubling its key sizes. That eliminates the compact keys and fast verification that made HAWK worth standardizing in the first place. The attack is specific to HAWK’s construction. Anthropic confirmed it does not affect the already-standardized NIST post-quantum algorithms: CRYSTALS-Kyber, CRYSTALS-Dilithium, FALCON, and SPHINCS+, nor related lattice-based schemes. Full technical details and demonstration code are available in the published paper.
Reduced-Round AES
The second finding concerns a research variant of AES, not the production cipher. Production AES-128 runs ten encryption rounds. Cryptographers study reduced-round versions to measure how much margin exists between the cipher’s design and the boundary of known attacks. Fewer rounds surviving scrutiny means less headroom.
Claude developed a technique Anthropic calls the Möbius Bridge, a fingerprinting method that eliminates one of the guesses an attacker needs to make when attacking a seven-round AES-128 variant. According to the published results, this improves previous best attacks on that variant by approximately 200 to 800 times depending on configuration. The attack requires roughly 2105 chosen-plaintext inputs, which is not a realistic condition outside a controlled research environment.
Full technical details are in the AES paper.
- Production AES-128 uses ten rounds. The demonstrated attack targets a seven-round research version only.
- The attack requires an amount of chosen-plaintext data that is not available under realistic conditions.
- HAWK is not currently deployed as a production standard. No migration is required as a result of these findings.
- The already-standardized NIST post-quantum algorithms are unaffected by both results.
- Existing systems do not require emergency changes because of either discovery.
How the Research Was Done
The HAWK attack was developed semi-autonomously over approximately 60 hours, with a single Anthropic researcher providing direction. That researcher had a background in theoretical computer science but was not a lattice cryptography expert. Their contribution was effectively project management: suggesting which computational libraries to use, advising on how to organize the search space, providing nontechnical direction when the agents needed to reorient. The mathematical reasoning and literature review were handled by the model.
The process ran on a multi-agent harness built on top of Claude Code, with worker agents collaborating, running computational experiments in Python and Sage, and accessing published cryptographic literature. One detail from the published chain of thought is worth noting: two worker agents were independently investigating the same candidate idea. The first concluded it was infeasible and moved on. The second found a path through. They continued exchanging results until both confirmed the attack was valid. Without the second agent continuing past the point where the first stopped, the finding likely would not have emerged on the same timeline.
After identifying the attack, Mythos built an end-to-end verification pipeline to confirm its own result before presenting it. Anthropic estimates the full HAWK discovery cost approximately $100,000 in API usage. The AES result was produced by a fully autonomous scaffold with no human input during the run. As a post-hoc test, Anthropic used the same AES scaffold on the HAWK problem; it re-discovered the HAWK attack independently.
The New Cryptographic Threat Model
Advanced cryptanalysis has historically required deep specialization built over years. What Anthropic describes is a workflow where AI agents handle the parts of that process that are parallelizable and computationally tractable:
Human researchers then spent hundreds of hours validating the results after the fact. That inversion, where AI-assisted discovery outpaces human verification capacity, creates pressure on the disclosure and remediation process that the security community has not had to absorb before at this pace. The bottleneck is no longer generating candidate weaknesses. It may become the ability of qualified cryptographers to confirm findings and coordinate a safe public response at the speed those findings now arrive.
What This Means for Post-Quantum Migration
NIST’s standardization process is working as designed. Public evaluation before deployment is exactly why HAWK’s weakness was found at the candidate stage rather than after widespread adoption. HAWK was a candidate. It was not deployed. The process caught this.
The practical consequence for organizations mid-migration is that selecting a post-quantum algorithm cannot be treated as a permanent decision. The remaining third-round candidates are being evaluated in an environment where frontier AI models are active participants in cryptanalysis, not just tools for implementing human ideas. Some candidates will not survive that scrutiny, and the timeline for finding out has compressed considerably compared to what prior human-only review cycles suggested.
A post-quantum strategy that treats migration as a one-time replacement of RSA or ECDSA is not built for that environment. What the research points toward is the need for crypto-agility: the organizational and technical capacity to identify where algorithms are deployed, test replacements, execute controlled migration, and maintain an auditable record of every change. A complete approach requires:
The QSHA256 Perspective
Post-quantum security is an orchestration problem as much as a cryptographic one. Organizations need visibility into where algorithms are in use, the ability to evaluate replacements under realistic conditions, migration workflows with meaningful controls, and records that show what ran where and when. As AI accelerates vulnerability discovery, the gap between when a weakness is found and when it can be safely addressed will put pressure on every part of that process. Infrastructure that cannot respond quickly to an algorithm change is exposed regardless of which algorithm it is currently running.
CryptanalysisBench
Alongside the two research papers, Anthropic released CryptanalysisBench, developed in collaboration with researchers at ETH Zurich, Tel Aviv University, and the University of Haifa. The benchmark packages a set of cryptographic ciphers and standardizes the experimental setup so other research groups can evaluate how well their models perform on cryptanalytic tasks. The goal is to make this category of AI-assisted cryptography research reproducible and extensible across institutions rather than limited to a single lab’s infrastructure.