Glonce

Anthropic's Mythos AI model finds flaw that sinks NIST candidate HAWK

securityThe Glonce editorsArs Technica🔥73Glonce rating73Impact65Novelty68Relevance88Surprise62Players78Credibility87
Anthropic's Mythos AI model finds flaw that sinks NIST candidate HAWK

A post-quantum cryptography algorithm under consideration for an official US standard has been pulled from the running after an Anthropic security model helped uncover a flaw that broke it. The algorithm, called HAWK, is a digital signature scheme designed to resist future attacks from quantum computers. It had already survived two rounds of testing by NIST, the National Institute of Standards and Technology, as part of the agency's evaluation of post-quantum cryptographic (PQC) algorithms, and had advanced to a third round meant to catch exactly the kind of flaw that turned up.

Anthropic announced the results on a Monday, saying its Mythos AI security model had found weaknesses in the mathematical problems underpinning HAWK. The next day, HAWK's developer said he was withdrawing the algorithm. Mythos separately found weaknesses in the mathematical problems underlying AES, the symmetric cipher used across most of today's encrypted communications and storage, though this did not break AES itself.

The piece frames these results with two caveats. First, the outcomes are incremental: they do not break any cryptosystem anyone relies on today. Instead, they show ways to moderately reduce the computational work needed to defeat the systems in principle. Second, the cryptosystems Mythos was tested against were weakened versions of the ones defined in the algorithms' formal specifications. These "challenge instances" are supplied by the specification authors themselves for use in adversarial peer review; using weakened versions for this kind of testing is standard practice, but the real, production versions of the algorithms are considerably more robust.

The report also notes it is hard to know how much of Anthropic's own framing of the results is marketing rather than substance, even as it argues the findings are worth attention because they could point to real advances in the kind of cryptanalysis that underlies privacy and security infrastructure.

Key facts

  • Anthropic's Mythos AI security model found a mathematical flaw that broke HAWK, a post-quantum digital signature scheme that had passed two rounds of NIST's PQC evaluation and reached the third round.
  • Anthropic announced the finding on a Monday; HAWK's developer withdrew the algorithm the following Tuesday.
  • Mythos separately found weaknesses in the mathematical problems underlying AES, the widely used symmetric cipher, without breaking AES itself.
  • The results are described as incremental: they reduce the computational work needed to attack the systems rather than breaking any cryptography currently relied on in production.
  • The systems Mythos was tested against were weakened 'challenge instance' versions used for adversarial peer review, not the full production specifications, which remain considerably more robust.

Why it matters

This is a case of an AI system contributing directly to the withdrawal of a candidate from a live government cryptography standardization process rather than to a research paper or a benchmark score. NIST's PQC program exists to pick the algorithms that will protect data against future quantum computers, and a flaw serious enough to sink a third-round candidate is a concrete signal that AI-assisted cryptanalysis is starting to reach into that process, not just academic toy problems.

Who it affects

NIST's PQC standardization effort loses one of its third-round candidates, and HAWK's own developer is the one who pulled it, a day after Anthropic's announcement. The finding on AES touches a far larger audience in principle, since AES underlies most everyday encrypted communication and storage, though the piece is explicit that AES itself was not broken. Anthropic is the party whose AI model and public framing of the results are under scrutiny.

How to use it

There is no product, price or access tier here: Mythos is described as an internal Anthropic security model applied to specific cryptographic test problems, not something offered for public use. The practical takeaway for anyone following PQC standardization is to watch whether other third-round candidates face similar scrutiny, and to note that HAWK's withdrawal does not itself require any action from users of currently deployed cryptography.

How solid is it

The account is explicit that it is hard to know how much of Anthropic's reporting of these results is marketing hype versus substance. The company made the announcement itself, and the results came from testing against weakened 'challenge instance' versions of the cryptosystems, supplied by the specification authors for exactly this kind of adversarial peer review, rather than against the full production specifications. HAWK's withdrawal by its own developer is a concrete, independently verifiable outcome, which lends the HAWK finding more weight than the AES result, where no comparable action followed.

Risks and caveats

The results are explicitly incremental: they do not break any cryptosystem anyone currently relies on, only moderately reduce the work required to attack weakened test versions of them. Production implementations of both HAWK and AES are considerably more robust than the challenge instances that were tested. The gap between 'a NIST third-round candidate was withdrawn' and 'AI can break the cryptography protecting your data today' is real, and the piece warns against collapsing it.