An AI Found Real Cryptographic Weaknesses. None of Them Break Your Bank Yet
Anthropic says one of its AI models has done something no AI could do a year ago. It found genuine mathematical flaws in cryptographic algorithms, not bugs in the code that implements them. The company’s Claude Mythos Preview improved the best known attack on HAWK, a post-quantum signature candidate, and broke a weakened version of AES, the cipher that guards most internet traffic. Before anyone reaches for the panic button, the true headline is that nothing you use today is at risk. The reason it still counts sits one layer down, in how fast the machine got here and who has to check its work.
What Claude Mythos discovered
According to the July 28 blog post, the first result targets HAWK, one of the remaining candidates in NIST’s near-decade-long contest to pick digital signatures that can survive quantum computers. HAWK’s security rests on a lattice problem, and Anthropic says the model found a previously unexploited symmetry in that lattice, a nontrivial automorphism, that earlier work had shown would enable an attack without confirming it was reachable.
The payoff is a faster attack that halves HAWK’s effective key strength. For the small HAWK-256 parameters, the cost of a full key recovery drops from a claimed 2⁶⁴ to 2³⁸. It’s still an exponential attack, not a fast one, and larger keys stay out of reach, but keeping the same security would mean doubling HAWK’s key sizes and erasing the speed that made it attractive in the first place.
The second result is on AES, the most-studied cipher in existence. Claude didn’t touch the ten-round AES-128 that protects real traffic. It worked on a seven-round research version, the kind cryptographers study to probe the full cipher’s margins, and improved a “meet-in-the-middle” attack with a new fingerprinting trick it named a Möbius Bridge. The improvement runs 200 to 800 times faster than the prior best, and it’s still completely impractical, assuming an attacker can request about 2¹⁰⁵ chosen encryptions. Even then, Anthropic notes, running it would cost hundreds of millions of dollars.
Read every caveat, because they carry the story
Hold the result exactly where Anthropic itself places it. HAWK is a candidate, not a deployed standard, so nothing runs on it. The AES work is on a deliberately weakened variant and does not dent the full cipher. Both attacks, in the company’s own words, are “expected” results, because NIST’s process exists precisely to surface weaknesses in candidates before standardization, and reduced-round AES is a long-running research target. Past NIST contenders have been broken far more dramatically, including one, SIKE, that researchers cracked in about an hour on a laptop.
There’s a verification wrinkle too, and Anthropic is candid about it. The HAWK attack runs end-to-end with demonstration code, so it’s easy to check. The AES attack was not, and the researchers validating it say plainly they aren’t cryptography experts, which is worth weighing when the finding is fresh and not yet through independent peer review. The company also details how un-autonomous parts of the process were. Claude at first refused the AES problem outright, insisting there was nothing to find, until researchers re-prompted it to hunt for genuinely novel ideas. That’s a human steering the machine, not a machine working alone.
Importance of the findings without threatening today’s encryption
Here is what makes this more than a NIST footnote. Anthropic reports that Claude found the AES attack in about a week, and two of its researchers then needed nearly a month to convince themselves the math was correct. Flip that ratio forward and the constraint on cryptography research stops being the discovery of attacks and becomes the human capacity to verify them. The company states its trajectory claim directly.
“In just one year, language models have gone from being unable to perform cryptanalysis of even the most basic ciphers to being capable of finding flaws in cryptographic designs that have escaped discovery despite years of human expert review.”
So, the immediate targets are safe, but the world runs on a long tail of lesser-studied ciphers that never got AES-level scrutiny, and a tireless model that costs about $100,000 a run can now comb through them faster than experts can audit the output. Anthropic has already pointed Claude at more, reporting a practical attack on a reduced-round lightweight cipher called LEA and a key recovery on reduced-round Serpent, with smaller nudges against Salsa20, Poseidon, and SHA-1 still under investigation. None of it touches production versions, the company says.
What changed, and what didn’t
Keep two things separate. This is a capability demonstration for a product, Claude Mythos Preview, released through a company blog and fresh papers rather than a peer-reviewed venue, so the results deserve the same independent scrutiny as any vendor’s account of its own system. Anthropic did handle disclosure carefully, sharing the HAWK attack with its authors in June and coordinating with the public NIST mailing list, and it built a benchmark, CryptanalysisBench, with academics at ETH Zurich, Tel Aviv University, and the University of Haifa to let others measure the same thing.
What didn’t change is your security today. RSA, deployed AES, the signatures in your browser, all untouched. What did change is the cast of adversarial review. Cryptography has always advanced by having smart, hostile people try to break proposed algorithms until the community trusts them, which is the same pressure that makes the post-quantum standards process work and the same reason the migration to quantum-resistant crypto is under way at all. A fast, cheap, hard-to-check new reviewer just joined that process.
It can strengthen the signature schemes whose key sizes and performance are still being weighed, and it can just as easily find something in a cipher nobody thought to re-examine. That double edge, the same convergence of AI and hard math now aimed at the locks themselves, is why Anthropic, a company whose own models raise the questions regulators are still catching up to, is asking how governments and academia should react before an AI finds a break that does land on something real.