Jonathon's AI Wiki

Mythos Preview Cryptanalysis — HAWK and Reduced-Round AES

8 min read

Source: Discovering cryptographic weaknesses with Claude — Anthropic Research (Frontier Red Team), anthropic.com/research/discovering-cryptographic-weaknesses, published 2026-07-28; announced via 2082153297670992134.

Anthropic reports that Claude Mythos Preview discovered improved attacks on two cryptographic algorithms — a mathematical result about the algorithms themselves, distinct from the implementation-bug hunting that drove Project Glasswing. The first attack halves the effective key strength of HAWK, a NIST post-quantum signature candidate, in ~60 hours of model work; the second speeds up an existing attack on 7-round AES-128 by 200-800x. Each result cost roughly $100,000 in API usage, was found mostly autonomously, and — critically — neither affects any deployed system (HAWK is not deployed; the AES result is on a reduced-round variant). The practical significance is directional: this is the first public demonstration of a frontier model doing expert-level cryptanalysis, and the defensive framing (stress-test ciphers before adversaries can) is the same finder-outpaces-fixer dynamic already visible in software vulnerability discovery.

Key Takeaways

  • HAWK — effective keysize halved in ~60 hours. Working semi-autonomously with an Anthropic researcher, Mythos improved the best-known key-recovery attack against HAWK, a lattice-based post-quantum digital signature scheme that had survived two rounds (two years) of NIST expert review. It found a previously unexploited nontrivial automorphism in HAWK’s lattice, enabling a faster (still exponential) enumeration attack. Concretely, full key recovery against HAWK-256 was thought to cost 2^64 but was demonstrated at 2^38 — meaning HAWK’s key sizes would need to double to keep their intended security, which removes much of what made the scheme attractive.
  • Reduced-round AES — 200-800x speedup. On a 7-of-10-round variant of AES-128 (studied by academics to probe the full cipher’s security margin), Mythos improved the strongest meet-in-the-middle attack via a new fingerprinting method it named a “Mobius Bridge”, eliminating one 2^56 enumeration guess. Result: 200-800x faster than prior best, depending on measurement. The prior work assumes 2^105 chosen plaintexts, so the attack is not remotely practical — it quantifies a security margin, it does not threaten AES.
  • **~100,000 in API usage to develop. The AES run alone produced several hundred million tokens over three days and ~1 billion output tokens total before the attack was refined.
  • High degree of autonomy, human bottleneck on verification. The AES attack was found “almost entirely autonomously” — the researcher built a scaffold and gave just three substantive prompts. The HAWK attack was semi-autonomous with occasional nontechnical project-management guidance. In both cases the humans became the bottleneck: two researchers spent nearly a month validating the AES result’s correctness (the human operators were not cryptography experts).
  • CryptanalysisBench. Anthropic partnered with academics at ETH Zurich, Tel Aviv University, and University of Haifa to release CryptanalysisBench (arxiv.org/abs/2607.18538), a benchmark packaging many ciphers so others can track LLM cryptanalytic capability over time.
  • Two papers + a chain-of-thought document released. Full technical papers on HAWK (hawk_key_recovery.pdf, with runnable demonstration code) and AES (aes_mobius_bridge.pdf), plus a published document of Claude’s chain of thought during the key AES insight (aes_mobius_bridge_cot.pdf).
  • Responsible disclosure. Anthropic followed responsible-disclosure procedures: the HAWK attack was shared with HAWK’s authors in June and coordinated to the public NIST mailing list at release; advance copies went to US government and industry partners, with discussions on implications. Academics confirmed validity.
  • Explicit limits. Anthropic is emphatic that “no production software will have to change as a result.” Both are expected-class results — finding weaknesses in NIST candidates before deployment is the point of the standardization process, and reduced-round AES attacks are a long-standing research line.

The two attacks in detail

HAWK (post-quantum signature)

  • What HAWK is: a third-round candidate in NIST’s call for Additional Digital Signatures (part of the ~decade-long post-quantum cryptography standardization effort), secure against quantum attack by resting on the hardness of the Lattice Isomorphism Problem.
  • The finding: a nontrivial automorphism in HAWK’s lattice. Prior work had proved that efficiently finding such an automorphism would enable an attack but left open whether one was accessible; Mythos found that it was.
  • Nature of the result: a faster exponential-time attack, not a polynomial break. It is specific to HAWK and does not generalize to other NIST post-quantum signature candidates or to lattice-based cryptography broadly.
  • Discovery texture: ran in a Claude Code-like multi-agent harness (workers + sandbox + Python/Sage + literature access). The key idea emerged from two worker agents — one prematurely rejected the idea as infeasible, the second found how to exploit it, and they converged through message exchange. Mythos built an end-to-end verification pipeline to prove correctness.

Reduced-round AES-128

  • Scope: a 7-round variant of the 10-round AES-128, under the standard chosen-plaintext threat model. Studied to understand attack techniques and estimate the full cipher’s margin.
  • The technique: a “Mobius Bridge” fingerprint invariant to a guess that prior attacks had to enumerate over 2^56 values — directly cutting that work by a factor of 2^56, then offsetting the transform’s added cost with further optimizations for a net 200-800x speedup.
  • Discovery texture: initially Claude refused, insisting improving AES cryptanalysis was impossible; a single researcher prompt (“the models tend to think it is impossible to solve so they don’t try…”) led Claude to rewrite its own agent harness to search for novel ideas. It then progressed from 6-round to 7-round after the prompt “why not do aes-128 r7?”.

Follow-up results (preliminary)

Anthropic notes it broadened the search after these two and has early, not-yet-fully-published results:

  • LEA (13 rounds): a practical key-recovery attack running in under an hour on a desktop with under 2^30 plaintexts (vs prior 2^98 plaintext pairs / 2^86 work) — end-to-end runnable, so high-confidence, but does not touch the full 24-round cipher.
  • Serpent-128 (6 rounds): a practical full key-recovery attack extending published work; the full cipher is 32 rounds.
  • <10x improvements on Salsa20, the Poseidon hash, and SHA-1.

Why it matters — defensive security with Claude

  • The defensive thesis is the same as Glasswing, moved up a layer. Where Mythos and the Glasswing program surface implementation bugs faster than teams can patch, this shows the same finder-outpaces-fixer curve reaching algorithm design. Anthropic’s own framing draws the parallel explicitly: “human researchers may become bottlenecked on studying and validating these results.”^[inferred] The practical read for defenders is that AI-assisted adversarial review of your own cryptographic dependencies is now a real capability — most useful against the “long tail” of under-scrutinized ciphers rather than AES/RSA.
  • Verification is the binding constraint. The month-long human validation of the AES attack is the operative lesson: a model can produce a novel result far faster than non-expert humans can confirm it. Any team using Claude for security research needs a verification plan (end-to-end runnable attacks are far cheaper to trust than proofs), mirroring the verification-frontier pattern the wiki tracks across agentic work.
  • This is gated frontier capability, not a shipping product. Mythos Preview is a gated research preview, not on the API — so this is a capability-ceiling signal for what generally-available successors will eventually do, not a tool WEO or most orgs can invoke today.
  • Disclosure discipline is part of the deliverable. The HAWK-authors-then-NIST-mailing-list sequence is a concrete template for how AI-discovered cryptographic weaknesses should be handled — advance notice to algorithm owners and government/industry before public release.

Open Questions

  • When does an AI find a break with real-world impact? Anthropic explicitly flags this as the unanswered question: how should researchers react if a model discovers a vulnerability in a deployed cryptosystem? It says answering will need academia + government + industry input, and it is convening an academic workshop “in the coming weeks.”
  • Does the capability curve keep climbing? Anthropic cautions against assuming a plateau — in a year, models went from unable to attack basic ciphers to beating years of expert review on HAWK. CryptanalysisBench is the instrument to watch.
  • How much is model vs scaffold vs spend? Each result cost ~$100k and relied on a purpose-built multi-agent harness; the degree to which the result is attributable to the model versus the scaffold and the compute budget is not separable from the public write-up.
  • Independent replication. As with the Glasswing CVE figures, the strongest hardening would be external cryptographers reproducing the HAWK and AES results from the released papers and demonstration code.

Graph View

Backlinks