Claude Just Halved HAWK's Key Strength. Each Result Cost $100K.

TL;DR

Anthropic published research on July 28 showing that Claude Mythos, running as a multi-agent research system, produced two genuinely new cryptanalytic results. It found a previously unused symmetry in HAWK, a post-quantum signature candidate under NIST review, that cuts the scheme's effective key strength in half: for the smallest parameter set, key recovery drops from 2^64 to 2^38 operations. It also invented a technique it named the Mobius Bridge that makes the best known attack on 7-round AES-128 between 200 and 800 times faster. Each discovery cost roughly $100,000 in API usage. Nothing deployed is weaker today, and Anthropic says so plainly. The story is what did the finding: an AI produced novel, publishable mathematics against designs that survived years of expert human review.

The HAWK result: a symmetry nobody used

HAWK is a digital signature scheme built on the Lattice Isomorphism Problem, designed by a ten-person team spanning NXP Semiconductors, CWI, PQShield, and others. It matters because it is the only lattice-based scheme still standing in NIST's additional post-quantum signatures track, the pipeline meant to diversify the signatures we will all be using when quantum computers make today's ones unsafe.

Claude found a nontrivial automorphism in the lattice HAWK uses: a structural symmetry that pairs keys up, so an attacker only has to search a folded version of the keyspace. Anthropic's write-up says the attack reduces the effective keysize by a factor of two across the scheme. On HAWK-256, the smallest, challenge-grade parameter set, the estimated cost of recovering a key falls from 2^64 operations to 2^38.

The whole thing took about 60 hours of discovery, development, and verification, at roughly $100,000 in API cost. The human in the loop was a single Anthropic researcher with a theoretical computer science background, not a lattice cryptographer, providing what the company describes as occasional guidance and nontechnical direction. Simon Willison's read of the transcripts is blunter: the main human contribution was persuading Claude to stop settling for low-hanging fruit and go find something genuinely hard. Roughly $100,000 of API spend, some fraction of it dedicated to morale.

The practical consequence, per CyberScoop's report: holding HAWK to its target security margin now means doubling key sizes, which dents the compactness pitch that got it this far in the process. HAWK is a candidate, not a deployed standard, so nothing in production is affected, and Anthropic notes the attack does not extend to other NIST post-quantum candidates or to lattice cryptography in general.

The AES result: the Mobius Bridge

The second result targets a reduced, 7-round research variant of AES-128. The deployed standard runs 10 rounds, and this attack does not touch it. What changed is the price of the best known theoretical attack on the 7-round version, which cryptographers have been whittling at for two decades.

Prior attacks in this line get stuck paying for a guess: you assume one of 256 possible values, run your distinguisher, and repeat for every candidate. Claude invented a fingerprinting algorithm that is invariant to that guess, so the work no longer depends on which value is right, deleting the factor of 256 outright. Think of it as interviewing 256 suspects: instead of questioning them one at a time, Claude found a question whose answer comes out the same no matter which suspect is guilty, and asked it once. Combined with further optimizations, the attack lands 200 to 800 times faster than the previous best, depending on the exact techniques stacked on top.

The effort profile inverted here compared to HAWK. Mythos spent about a week conceiving the idea and emitted around one billion output tokens doing it; the humans then spent several hundred hours learning enough of the surrounding cryptography to validate that the attack was real. Claude coined the Mobius Bridge name itself, and nobody at Anthropic appears to have fought it, which was the right call.

Nothing you run today is weaker

The caveats deserve to be stated as flatly as Anthropic states them. Neither result has practical impact on today's systems, and no production software has to change. HAWK is under NIST review, not in your TLS stack. Full 10-round AES-128 is untouched, and even the improved 7-round attack is purely theoretical: CyberScoop puts its data requirement at over 400 octillion messages.

Outside reaction has treated this as the system working as designed. Ellen Boehm, an SVP at Keyfactor, told CyberScoop that research like Anthropic's proves the NIST post-quantum evaluation process is doing its job: better to burn a candidate's security margin on paper in 2026 than in the field in 2036. Anthropic also shared advance copies with US government and industry partners before publishing, and consulted academics to confirm validity.

Why this one should update your priors

AI finding security bugs is no longer news; this year has been wall-to-wall SQL injections, memory corruption, and a $25 WordPress RCE. Those are software artifacts: mistakes someone made in code. This is different in kind. HAWK's math survived years of review by the small set of humans qualified to review it, and the AES attack line had two decades of incremental expert progress. Claude added to both, autonomously enough that the write-up's most persistent human input was encouragement.

Anthropic also shipped the measurement story alongside the trophy results. CryptanalysisBench, built with researchers at ETH Zurich, Tel Aviv University, and the University of Haifa (the author list includes Nicholas Carlini and Florian Tramer), poses 191 cryptanalysis tasks across six primitive families drawn from NIST competitions. Frontier models already break 65 to 86% of the schemes known to be breakable, and along the way the benchmark work surfaced previously undocumented flaws, including design issues in the SpoC cipher and an error in KINDI's security proof. Demonstration code for the headline attacks is on GitHub.

One access note for anyone reaching for their API key: the model that did this is Claude Mythos, the gated variant of Fable 5 with cyber safeguards lifted, available only to vetted partners. The capability exists; the general public gets the version that declines to help you with exactly this kind of work. That gap between what the model can do and what your model will do is now itself a load-bearing security control.

Key Takeaways

• Claude Mythos found a nontrivial automorphism in HAWK's lattice that halves its effective key strength; HAWK-256 key recovery falls from 2^64 to 2^38 operations.
• Its self-named Mobius Bridge makes the best known 7-round AES-128 attack 200 to 800x faster by replacing a 256-way guess loop with one guess-invariant fingerprint.
• Each discovery cost about $100,000 in API usage; HAWK took 60 hours, the AES idea about a week plus roughly a billion output tokens and months of human validation.
• Nothing in production is affected: HAWK is an undeployed NIST candidate, and full 10-round AES is untouched by a data-infeasible theoretical attack.
• This is the first credible case of an AI producing novel, publishable cryptanalysis against designs that years of expert review had cleared.
• CryptanalysisBench shows frontier models already breaking 65-86% of known-breakable schemes, so expect candidate-vetting to become an AI workload.

Sources: Anthropic Research, CyberScoop, The Next Web, Simon Willison, CryptanalysisBench (arXiv), HAWK