Two years of expert review missed it. Claude found it in 60 hours

Anthropic’s Frontier Red Team published two cryptanalysis results today, both found with an unreleased model called Claude Mythos Preview. The first weakens HAWK, a digital signature scheme designed to survive quantum computers. The second improves the best-known attack on a cut-down version of AES, the cipher that encrypts most of the internet.

Neither breaks anything you use. Anthropic says so in its own second paragraph: “neither of these results has a practical impact on today’s computer systems; no production software will have to change as a result.”

The interesting numbers are elsewhere.

The HAWK result

HAWK is a third-round candidate in NIST’s call for additional post-quantum signature schemes, a process that has been running since 2022. Its security rests on a problem called the Lattice Isomorphism Problem.

Working with Mythos Preview, an Anthropic researcher found a symmetry in HAWK’s lattice, what cryptographers call a nontrivial automorphism. Earlier work had already proved that finding one would permit an attack. Nobody had established whether one existed in the lattice HAWK actually uses.

The effect is a faster enumeration attack. Anthropic gives the figure for the smallest parameter set: the expected cost of full key recovery against HAWK-256 was thought to be 2^64, and Mythos demonstrated 2^38. The attack is still exponential, so larger keys stay out of reach. What it means in practice is that HAWK’s key sizes would have to double to deliver the security they were advertised as delivering, and as Anthropic notes, doubling them “eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate”.

HAWK survived two years of expert review before this. Mythos took about 60 hours.

That is not the embarrassment it sounds like. Finding weaknesses in candidates before they are standardised is exactly what the NIST process is for. During the ML-KEM and ML-DSA standardisation, one candidate, SIKE, was broken outright in an hour on a laptop. HAWK is not deployed anywhere.

The AES result

AES-128 runs ten rounds. Anthropic’s attack works on a version cut to seven, which academics study to estimate how much margin the real cipher has.

The prior work it builds on assumes an attacker can request the encryption of 2^105 chosen plaintexts, a number that puts it well outside anything achievable. Within that setting, Mythos improved on the strongest known meet-in-the-middle attack by inventing a fingerprinting step it named the Möbius Bridge. One stage of the earlier attack had to enumerate 256 candidate values and look each one up; the new fingerprint is invariant to that guess, removing a factor of 256 outright. Computing it costs more, so Mythos found further optimisations on top. The net result is an attack between 200 and 800 times faster, depending on how the runtime is measured.

It said the problem was impossible

The discovery process is the part Anthropic documents most closely, and it is the part worth reading.

Claude refused the AES problem at first. Anthropic publishes what the model wrote:

AES-128 r5/r6 is just genuinely hard

on AES-128 r5/r6/r7 it found nothing because there’s nothing easy to find; this is the most-studied block cipher in existence

The researcher’s fix was a message about the model rather than the mathematics: “the models tend to think it is impossible to solve so they don’t try they [sic] need a good amount of prompting.” Anthropic published the real prompts, typos included. Claude responded by rewriting its own agent harness to push itself towards genuinely novel ideas.

From there it ran on three substantive prompts over three days, all of them variations on the theme of aim higher. “again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings.” It produced a billion output tokens in total before the attack was finished.

On the HAWK side the setup was different: a multi-agent harness with Python and Sage, and a human operator with a background in theoretical computer science who was not a lattice specialist. Anthropic reports that the key idea came from two worker agents disagreeing. One rejected the approach as infeasible; the other found a way to make it work; they argued it out by message until both were convinced.

Each result cost roughly $100,000 in API spend.

The bottleneck moved

Mythos found the AES attack in a week. Two Anthropic researchers then spent nearly a month convincing themselves it was correct, and several hundred hours in total, while learning enough cryptography to check the work.

Anthropic is explicit that this is now the constraint: “we are reaching the limits of our own knowledge, and the vast majority of our time over the past few months has been in verifying the correctness of Claude’s results.”

The company that owns the model is describing a world where machine output outruns human review, and it is describing it about itself.

There is more in the pipeline than the two headline papers, and none of it touches a full-round cipher.

The LEA result is the one to watch, because it runs end to end. Anthropic can pick a random key and verify the attack recovers it, which is the same reason it trusts the HAWK result more than the AES one.

What Anthropic is careful to say

Three caveats are in the post, and they are load-bearing.

HAWK is a candidate, not a standard, and is not deployed. The AES attack is on a reduced cipher and does not break the real one. Even where a HAWK-style attack applied, Anthropic’s own footnote puts the cost at hundreds of millions of dollars.

The disclosure was handled the way it should be. The HAWK attack went to the scheme’s authors in June, with coordinated disclosure to the public NIST mailing list timed to today’s release. Anthropic says it consulted academics on validity and shared advance copies with US government and industry partners.

It also released the working: both papers, demonstration code, and a document containing Claude’s chain of thought during the key insight.

The benchmark says this is a trend, not an incident

Released alongside the two papers is CryptanalysisBench, built by Anthropic with ETH Zurich, the University of Haifa, Technische Universitat Berlin and Tel Aviv University. Its title asks the question directly: can LLMs do cryptanalysis. Its abstract answers, “we find that the answer is increasingly yes.”

The benchmark is 191 tasks across six families of cryptographic primitives, drawn mainly from four NIST standardisation competitions, in three tiers: primitives with known practical breaks, primitives with no known break, and a challenge set at the frontier of current cryptanalysis.

Five frontier models were run against it: Claude Opus 4.8, Sonnet 5, Mythos 5, GPT-5.5 and the open-weights GLM-5.2. They break 65% to 86% of the first tier, 6 to 12 of the second tier at full strength, and 24 to 61 across the scaled-down variants. The paper also reports two results its authors believe are new: a key-recovery attack exploiting a design flaw in the SpoC authenticated cipher, and an error in the published CCA-security proof for KINDI.

The framing is careful. The benchmark exists, the authors write, “to help track if (or when) AI cryptanalysis becomes a serious factor”.

What to watch

Whether verification stays the constraint. Anthropic plans an academic workshop in the coming weeks, and the benchmark is public on GitHub so the tracking is not something you have to take its word for.

And the question Anthropic raises and does not answer: what happens the first time a model finds something in a cipher that is deployed. Its own framing is that this “will require input from academia, government, and industry”. Today’s results were held back through a period of consultation with US government and industry leaders before release. That is a policy choice made by one company, about its own model, with no rule behind it yet.