On July 28, 2026, Anthropic's Frontier Red Team published research showing that Claude Mythos Preview discovered improved attacks against two cryptographic algorithms: the HAWK post-quantum digital signature scheme and a round-reduced variant of AES. Anthropic stresses that neither result affects any production system — HAWK is only a NIST candidate and is not deployed, and the AES attack targets a weakened 7-round version, not the full 10-round cipher.
The work is research-stage, but the numbers are striking. In the HAWK case, the model improved the best-known attack after roughly 60 hours of work, against a scheme that had survived two years of expert human review across two NIST evaluation rounds. Each of the two main results cost approximately $100,000 in API spend to develop.
The HAWK attack: halving the effective key size
HAWK is one of the remaining third-round candidates in NIST's call for Additional Digital Signatures, part of a nearly decade-long effort to standardize post-quantum cryptography before cryptographically relevant quantum computers threaten RSA and ECDSA. Its security rests on the hardness of the Lattice Isomorphism Problem.
Mythos found a previously unexploited symmetry — a nontrivial automorphism — in the lattice HAWK uses. Prior work had proven that finding such an automorphism would enable an attack, but left open whether one was accessible in HAWK's specific lattice. The discovered automorphism enables a faster enumeration attack that cuts the effective key size in half: the expected cost of a full key recovery against the small HAWK-256 parameter set drops from 2^64 to 2^38.
The attack remains exponential-time, not polynomial, and larger HAWK keys stay impractical to break. It is also specific to HAWK — it does not touch other NIST post-quantum candidates or lattice-based cryptography generally. But doubling HAWK's key size to restore the intended security margin would erase much of what made the scheme an attractive candidate in the first place.
Working in a Claude Code-like harness with multiple collaborating worker agents, access to Python and Sage, and published cryptographic literature, Mythos operated mostly autonomously. The human operator had a theoretical computer science background but was not a lattice cryptography expert; input was limited to project-management-style guidance. Anthropic notes the key idea emerged from two worker agents exchanging messages — one initially rejected the approach as infeasible before the second found how to exploit it. Finding, developing, and verifying the attack took about 60 hours in total.
The AES result: 200–800× faster on a reduced-round cipher
The second result concerns AES, adopted by NIST in 2001 and among the most scrutinized encryption algorithms ever published. Cryptographers routinely study round-reduced variants to probe techniques that might one day generalize. Mythos improved the best known meet-in-the-middle attack on 7-round AES-128 (the full cipher has 10 rounds) by eliminating one of the guesses an attacker must make, improving the speed of previous best attacks by 200 to 800 times.
The attack assumes a chosen-plaintext threat model in which the attacker can request encryption of 2^105 chosen plaintexts — completely impractical in the real world, but a standard way to quantify attack cost. The full AES cipher remains unbroken.
Disclosure and a new benchmark
Anthropic says it followed responsible disclosure throughout: it shared the HAWK attack with the scheme's authors in June and coordinated disclosure to the public NIST mailing list alongside publication. It also shared advance copies with US government and industry partners, and consulted academics to validate the findings.
To help others study LLM cryptanalytic capability, Anthropic partnered with researchers at ETH Zurich, Tel Aviv University, and TU Berlin to build CryptanalysisBench, a benchmark packaging multiple ciphers for evaluating models on this task. Full technical details of the two main findings appear in two new papers, with further results the team says it hopes to release later.
Why it matters
The precedent here is less about HAWK or AES than about process. NIST competitions exist so flaws surface before deployment, and late breaks are not unprecedented — the SIKE candidate was famously broken in an hour on a laptop during an earlier standardization round. What changes is the reviewer: a general-purpose model, directed by a non-specialist, found in days what expert cryptographers missed in years. If that capability generalizes, AI-assisted review could become a standard phase of cryptographic vetting — and defenders will not be the only ones running it.
Our take
The most telling detail is the cost curve: $100,000 in API spend per result, with a non-specialist operator. That puts serious cryptanalysis within reach of any well-funded lab, not just national agencies and a handful of academic groups. Anthropic frames this as cryptography working as intended, and for undeployed candidates that is fair. The open question the post does not answer is what happens when the same capability is pointed at algorithms already protecting production traffic — where disclosure is messier and the attackers have the same models.
