Glonce

Anthropic's Claude Mythos won't break symmetric crypto, blog argues

securityThe Glonce editorsHacker News🔥69Glonce rating69Impact45Novelty55Relevance90Surprise40Players75Credibility85
Anthropic's Claude Mythos won't break symmetric crypto, blog argues

On July 28, Anthropic said it had used its own large language model, Claude Mythos, to find two new cryptanalytic results. The first is a key-recovery attack on HAWK, a post-quantum signature scheme that is a candidate in NIST's Additional Digital Signatures standardization project. Against the toy variant HAWK-256, whose 64-bit security is already practically breakable on its own, this changes nothing. Against HAWK-512, the real candidate, the new attack is still not practical, but it lowers the scheme's estimated security from its 128-bit target to at most 108 bits, and, per Appendix C of the paper, speculatively as little as 81 bits; the blog author calls it a meaningful break of HAWK's security precisely because of that margin, even without a working exploit. The second result is an improved key-recovery attack on AES-128 that reaches 7 of the cipher's 10 rounds. It threatens nothing at full strength and, per the author, is not a surprise, but new cryptanalytic results against AES are rare, so the advance is notable in its own right; the author treats the accompanying negative result, that Mythos found nothing stronger and nothing at all against the full 10-round cipher, as the more significant half of the finding.

In the paper describing the AES-128 result, Anthropic writes that it wants to keep exploring LLM-assisted cryptography research, especially for attacks that are too computationally expensive to actually carry out and instead need the model to demonstrate its own correctness through other means, and that formalizing the cryptographic community's attack techniques is a particularly important direction. Anthropic also helped build CryptanalysisBench, a benchmark of cryptanalysis tasks covering full and reduced-round versions of AES and ChaCha, plus algorithms submitted to NIST's competitions, such as BLAKE, including post-quantum schemes.

The blog post, written in direct response to Anthropic's announcement, sets out to answer the question a non-specialist naturally asks, illustrated by a friend who asked the author whether Mythos could break BLAKE3. The author's answer is no. Despite the HAWK and AES-128 results, the author is confident LLMs will not break any established cryptographic scheme, including AES, ChaCha, SHA-3 and BLAKE3, and will not disprove the conjectures behind Too Much Crypto.

The argument rests on five points, in the order the author lays them out. The high-level structures used to build symmetric systems, such as the GCM and CTR modes for block ciphers and the sponge construction for hash functions, are themselves already secure. Symmetric ciphers are deliberately built to have no usable mathematical structure: unlike public-key schemes, they cannot be described as clean transforms that a security proof, or an attack, could exploit. BLAKE3, the author notes, is essentially just a long sequence of XORs, modular additions and bit rotations, with no higher-level pattern to reason about. Nearly every cryptanalysis technique in wide use, linear cryptanalysis, rectangle, boomerang, cube and slide attacks among them, is a form of differential cryptanalysis, a space that has already been explored extensively, so an LLM is more likely to refine a known attack than to discover an entirely new class. Differential cryptanalysis is also partly empirical: cryptanalysts often find statistical biases by running experiments before they fully understand why the bias exists, and designing, running and interpreting experiments like that is harder for a model than analysis alone. Finally, these ciphers are time tested and battle tested, having absorbed thousands of hours of mostly unpublished, unsuccessful scrutiny, with the consistent finding that reduced-round variants are easier to break while full-round strength grows sharply as rounds are added.

The author also points to a separate post by Matthew Green, quoted approvingly, that compares symmetric cipher design to a farmer who drags a tractor into a patch of quicksand and then buries it in cement: deliberately built from operations that are quick and easy to apply per round, but very hard to untangle once many rounds are iterated, so pouring more raw intelligence hours into the problem is unlikely to undo that difficulty.

The author adds one more data point from personal experience: earlier in the year, they asked LLMs to find bugs in the security proofs of EUROCRYPT 2026 papers, and the models found issues in most of the proofs tested, meaning the proof, though not necessarily the underlying result, was flawed. The author reads this as pointing to where LLM effort is actually useful right now: symmetric cryptography, in their assessment, is already the strongest part of current security systems, so tokens are better spent checking proofs and hunting for bugs elsewhere, including in the less-analyzed post-quantum standardization candidates such as HAWK.

Key facts

  • On July 28, Anthropic said its LLM Claude Mythos found a key-recovery attack on HAWK-512 that lowers its estimated security from a 128-bit target to at most 108 bits, and speculatively as little as 81 bits per the paper's Appendix C, though the attack itself is still not practical.
  • The same LLM produced an improved key-recovery attack reaching 7 of AES-128's 10 rounds; it does not threaten the full cipher, but new AES results are rare enough that the advance is notable on its own.
  • Anthropic helped build CryptanalysisBench, a benchmark of cryptanalysis tasks covering full and reduced-round AES and ChaCha, plus algorithms submitted to NIST's competitions such as BLAKE, including post-quantum schemes.
  • The blog author argues LLMs will not break AES, ChaCha, SHA-3 or BLAKE3, citing five reasons: the ciphers' already-secure high-level structure, their deliberate lack of exploitable mathematical structure, the already-explored territory of differential cryptanalysis, its partly empirical nature, and thousands of hours of prior scrutiny.
  • The author separately says LLMs asked earlier in the year to check security proofs from EUROCRYPT 2026 papers found issues in most of them, which the author reads as pointing to where LLM effort in cryptography is actually useful right now.

Why it matters

New cryptanalytic results against AES are rare, so a fresh one is notable even before an LLM enters the picture. Here, Anthropic's Claude Mythos produced two: a narrower estimated security margin for HAWK-512, and an improved key-recovery attack reaching 7 of AES-128's 10 rounds. Neither is a practical break, but the story is a real test case for a question that matters well beyond this one paper: how far LLM-assisted research can push a mature, heavily studied field, and whether it could ever reach the ciphers people actually rely on today. HAWK is a live candidate in NIST's Additional Digital Signatures standardization project, so a genuine reduction in its assumed margin, from a 128-bit target to at most 108 bits and speculatively as little as 81, is the kind of result a standards process has to register even when it changes nothing today. The blog's answer to the bigger question, prompted directly by a friend asking whether Mythos could break BLAKE3, is a considered no, explained in enough technical depth to be checked rather than just taken on faith.

Who it affects

Nobody using AES, ChaCha, SHA-3 or BLAKE3 today needs to do anything: the piece's whole point is that none of those ciphers were touched. The people who should actually register this result are narrower: NIST's Additional Digital Signatures standardization project and anyone evaluating HAWK as a post-quantum candidate, since HAWK-512's estimated margin has now measurably narrowed on the record, even without a working exploit. Cryptography researchers get a new benchmark out of it too: CryptanalysisBench, which Anthropic helped build to cover full and reduced-round AES and ChaCha plus NIST-competition submissions such as BLAKE, including post-quantum schemes, giving the field a shared way to measure future LLM cryptanalysis claims. Anthropic's own paper frames its audience even more specifically: it is talking to the cryptographic community about formalizing attack techniques, not to end users about anything they need to patch.

How to use it

There is no product or setting to change here; the useful action is knowing where to look. Anyone who wants the HAWK numbers first-hand should check Appendix C of Anthropic's paper for the speculative 81-bit low estimate, since this post only cites it secondhand. Researchers curious whether an LLM can be pointed at their own cipher or protocol now have a concrete place to start, CryptanalysisBench, instead of building an evaluation harness from scratch. Anyone tracking HAWK specifically inside NIST's standardization process should treat the new HAWK-512 estimate as an input to that review, not as a reason to drop the candidate outright, since the attack itself is still not practical.

How solid is it

The two headline numbers, HAWK-512's margin falling to at most 108 bits and speculatively 81, and the AES-128 attack reaching 7 of 10 rounds, come from Anthropic's own published cryptanalysis paper, so they carry the weight of a primary disclosure rather than a rumor. Anthropic's own quoted words are modest: the company calls the direction worth exploring, flags that these are the kind of attacks that are too costly to actually carry out and instead need the model to demonstrate its own correctness, and names formalizing the field's attack techniques as a priority. Nothing in that statement claims current ciphers are at risk. The larger conclusion, that LLMs will not break symmetric crypto, is the blog author's own argument, not Anthropic's, built on textbook cryptographic reasoning: that almost all cryptanalysis is a form of differential cryptanalysis, a space already explored at length, and that these ciphers carry thousands of hours of prior, mostly unpublished scrutiny. It is echoed, not proven, by an independently published post from Matthew Green, quoted by the blog author with the author's own bracketed notes mixed in, comparing cipher design to a tractor buried in quicksand and cement. No named institution or peer review stands behind the won't break argument itself; it is one technically detailed opinion responding to Anthropic's disclosure, not a third-party audit of it.

Risks and caveats

The reassuring framing can undersell the HAWK result: the author calls it a meaningful break of HAWK's security despite being impractical, and the 81-bit figure is explicitly the paper's own speculative low end, not its headline 108-bit estimate, a distinction worth keeping straight. The source names Matthew Green and Too Much Crypto without giving either a title, affiliation, or any description of what Too Much Crypto's conjectures actually claim, so those references rest on the names alone. This is also a single author's response to Anthropic's announcement, not an independent replication or audit of it. Readers who need the exact attack details, rather than the argument for why they do not matter yet, should go to Anthropic's own paper.

“One direction we believe to be particularly important is to formalize the attack techniques used in the cryptographic community.”

— Anthropic, in the AES attack paper