Anthropic's Claude Mythos halves HAWK's security, dents AES modestly

Anthropic published two cryptanalysis results it says came out of Claude Mythos, an advanced model the company has not released. A cryptography researcher who writes the Cryptography Engineering blog reviewed both results after readers asked what they meant, and concluded the two are very different in substance and quality.

The first result is a new key-recovery attack against HAWK, a proposed post-quantum signature scheme built on the module Lattice Isomorphism Problem. HAWK is not deployed and is not yet a standard, but it had been well along in the process of being evaluated for one; it is related to the Falcon signature scheme (which is being standardized), though the new attack does not carry over to Falcon since that scheme rests on a different hard problem. The attack is still exponential time, so it does not break HAWK in a dramatic sense, but it roughly halves the number of security bits the scheme offers. That could in principle be patched by doubling key sizes, except HAWK's entire reason for existing is efficiency, and larger keys erode exactly that advantage. Crucially, the attack is not just a paper exercise: it produced working code that recovers keys in a few hours of wall-clock time against a weakened "challenge instance" the HAWK authors had provided for exactly this kind of testing. The author's read is that the result does not rest on new mathematics; it just applies a set of well-known, unexotic tools more thoroughly than anyone had before, which is precisely the kind of work an AI system is well suited to.

The second result is an improved attack on AES reduced to 7 rounds (full AES runs 10, 12 or 14 rounds depending on key size, and has held up since becoming a standard in 2001, including against extensive private testing by the NSA). Attacks on 7-round AES already existed; this one is a modest constant-factor improvement on a 2013 result. The new attack needs about 2^89 cipher operations and, on top of that, requires convincing a real encryptor to produce roughly 2^105 encryptions of chosen plaintexts under one secret key, neither of which is remotely achievable in practice. It is also an on-paper analysis rather than something that has actually been run end to end, so it is not fully clear how real the claimed speedup is once every detail is worked out. The author calls it real, interesting cryptanalytic progress, but a small increment, not a practical attack, and notes that the HAWK result is the one that actually matters: HAWK had a genuine shot at standardization and, after this, very likely does not anymore.

On how Anthropic got these results, the author's summary is blunt: the company did not assemble a large team of domain experts to carefully steer the model. Based on the prompts Anthropic published, the company essentially told Claude Mythos to go find results and let it work at the problem until it did. The author argues this shows models can now understand existing cryptanalysis literature, synthesize it into genuinely new attacks and extend it, without close human supervision, even if this is not yet superintelligent cryptanalysis.

The author's central worry is that verifiability, not generation, is now the bottleneck. Models can produce results that look real but are misleading, so human attention matters more, not less. The HAWK case is easy to check because it comes with runnable code that either recovers keys or does not; the AES case is harder, since confirming a subtler theoretical speedup usually needs formally verified proofs, and even those are sensitive to exactly how the underlying theorem is stated, which still requires expert human judgment.

On the broader stakes, the author separates symmetric and public-key cryptography. Symmetric ciphers like AES are, in the author's framing, deliberately built to be messy and hard to untangle, and extra raw intelligence is unlikely to change that quickly. Public-key cryptography is a different story: humans have only a handful of conveniently structured hard problems to build it on (RSA, elliptic-curve discrete log, lattice problems, code-based problems), and far fewer human-years have gone into stress-testing the newer ones, especially the post-quantum candidates now being evaluated for standardization. The author frames the timing as double-edged: this new capability arrives exactly when cryptography is mid-transition to new post-quantum schemes, so either AI cryptanalysis helps stress-test and validate the surviving candidates, making the field more robust, or it starts undermining assumptions faster than humans can check them.

Key facts

Anthropic says two new cryptanalysis results came from Claude Mythos, an advanced model it has not released.
The HAWK attack roughly halves that post-quantum signature scheme's security bits and includes working code that recovers keys in hours against a weakened challenge instance; HAWK had been under consideration for standardization and now likely is not.
The AES result is a modest constant-factor improvement on a 2013 attack against 7-round reduced AES, needing about 2^89 operations and access to roughly 2^105 chosen-plaintext encryptions, far outside practical reach.
The author says Anthropic largely let the model work at the problems on its own rather than having domain experts carefully steer it, based on the prompts Anthropic published.
The author argues verifiability, not generation, is now the limiting factor: the HAWK attack is easy to check with runnable code, while the AES result needs harder, more expert-dependent verification.

Why it matters

Anthropic is claiming its unreleased Claude Mythos model produced two genuine cryptanalysis results largely on its own, and an independent cryptography researcher's review broadly backs the HAWK result up: real working code, a real security-bit reduction, against a scheme that was seriously in the running for a post-quantum standard. That likely removes HAWK from contention, since fixing the weakness would require bigger keys, which would erase the efficiency HAWK existed to provide. It is also a signal that AI systems can now synthesize known cryptanalytic techniques into new, non-trivial attacks without heavy human hand-holding.

Who it affects

HAWK's designers and the standards process evaluating post-quantum signature schemes are the most directly affected; the HAWK result narrows the field of candidates. More broadly, it concerns anyone building or reviewing newer public-key schemes, since those rest on hard problems (lattice-based, code-based) that have had far less cumulative human scrutiny than RSA or elliptic-curve cryptography. AES users are not affected in practice: the new attack needs about 2^89 operations and roughly 2^105 chosen-plaintext encryptions, both far beyond real-world reach.

How to use it

There is no released product here; Claude Mythos itself remains unreleased, and neither result is something a developer can deploy. What Anthropic did publish is a detailed account of its process and the prompts it used to direct the model, which the author treats as useful reading for understanding how these results were actually produced rather than as a tool anyone can pick up.

How solid is it

The two results differ sharply in how well they hold up. The HAWK attack ships as working code that recovers keys in a few hours against a weakened challenge instance the HAWK authors themselves provided, so it is directly and easily verifiable; the author treats it as solid, real cryptanalysis. The AES result is a paper analysis with a claimed 2^89-operation complexity that has not been run end to end, so it is harder to confirm how much of the claimed speedup survives once every detail is filled in; the author calls it credible but modest, not a practical break.

Risks and caveats

Neither result threatens deployed systems today: HAWK was never deployed, and the AES attack's resource requirements (about 2^89 operations, roughly 2^105 chosen-plaintext encryptions) rule out any practical use. The bigger caution the author raises is general: models are good at producing results that look real but are not, so verifying claimed results now matters more than generating them, and subtler results without a runnable proof of concept, like the AES case, are the hardest to check without dedicated expert review.

“what makes this genuinely interesting (and, frankly, a little embarrassing for the field) is that none of the ingredients are exotic”

— Claude, quoted on the Cryptography Engineering blog