Claude just did cryptanalysis that used to need a specialist lab. On July 28, 2026, Anthropic’s Frontier Red Team published Discovering cryptographic weaknesses with Claude: Mythos Preview helped produce (1) a serious hit on HAWK, a NIST post-quantum signature candidate, and (2) a much faster attack on 7-round AES — each on the order of ~$100,000 in API cost.
Headline for operators: no live systems are broken. Headline for researchers: LLMs are now in the PQC review loop.
TL;DR
| Result | What it is | Production impact |
|---|---|---|
| HAWK | Lattice automorphism → ~½ effective key strength | Candidate only — not deployed; notify/redesign path |
| AES-128 (7 rounds) | “Möbius Bridge” meet-in-the-middle fingerprint → 200–800× faster vs prior | Research cipher, not full 10-round AES |
| Cost / time | ~$100k API each; HAWK ~60h semi-auto | Validation still human-heavy |
| Extra | LEA / Serpent reduced-round follow-ups; CryptanalysisBench | Tracking LLM crypto skill |
HAWK: cutting a PQC candidate down to size
HAWK sits in NIST’s Additional Digital Signatures effort (post-quantum). Mythos found a nontrivial automorphism in HAWK’s lattice — prior theory said that would enable a faster attack; Mythos showed it was reachable.
Example Anthropic cites: full key recovery on small HAWK-256 thought ~2⁶⁴, demonstrated ~2³⁸. Still exponential — not a laptop-instant break of large keys — but doubling key size to restore margin kills much of why HAWK looked attractive.
Process note: multi-agent workers disagreed; one rejected the idea early, another pushed through — then they converged. Human operator: TCS background, not a lattice specialist; mostly project management.
What NIST Additional Signatures is for
In 2022 NIST opened a call for additional post-quantum signature schemes beyond the first PQC selections — because quantum-capable adversaries would break RSA/ECDSA-class signatures. HAWK entered that pipeline and survived two rounds of expert human review over ~two years. Mythos’s ~60-hour semi-autonomous campaign still improved the best-known attack. That timeline contrast is the story: review processes that assume only human cryptanalysts now share the table with agent harnesses that burn ~$100k of API compute per result.
Security basis: hardness of the Lattice Isomorphism Problem. Mythos exploited a previously unused nontrivial automorphism. Prior work had shown that finding such an automorphism efficiently would permit an attack; it had not shown that HAWK’s lattice made one accessible. Anthropic released demonstration code with the paper — including an end-to-end key-recovery path against the NIST reference implementation patterns discussed in their cryptography-research-demo materials.
Impact boundaries Anthropic emphasizes:
- Attack is specific to HAWK — not a general break of lattice PQC or other NIST signature candidates.
- Still exponential, not polynomial — large parameters remain impractical to attack with this method, but proposed small sizes are weaker than claimed.
- HAWK is a candidate, not a deployed internet standard — no emergency patch Tuesday for browsers.
NIST contests exist to surface exactly this class of finding before deployment. Anthropic cites SIKE — broken on a laptop during earlier PQC work — as the cautionary precedent for late, decisive cryptanalysis.
Semi-autonomous workflow details
Anthropic describes a Claude Code–like multi-agent harness with Python/Sage, literature access, and sandboxed workers. Humans mostly did project management (“track ideas,” “which library for verification”). The decisive idea emerged when two workers investigated the same automorphism lead — one abandoned it as infeasible; the other exploited it; they messaged until both agreed. After discovery, Mythos built a verification pipeline to convince itself and the operator. Total: ~60 hours, ~$100k API.
AES: Möbius Bridge on round-reduced cipher
Classic academic setting: attack 7 of 10 AES-128 rounds under chosen-plaintext assumptions used in papers (including huge plaintext budgets — prior work assumes on the order of 2¹⁰⁵ chosen plaintexts). Mythos improved meet-in-the-middle fingerprinting so one 256-guess stage collapses — net 200–800× depending on timing methodology.
Discovery drama: early runs refused (“AES is too studied”). After the researcher told the harness the models give up too easily, Mythos rewrote its own setup and eventually found the transform — then spent ~1B output tokens refining. Humans spent hundreds of hours learning enough crypto to trust the claim.
How meet-in-the-middle attacks work (plain English)
Reduced-round AES papers often trade time for memory: precompute intermediate states into a huge table, then match from both ends of the cipher. Fingerprinting decides which table lookups are worth trying. Prior best attacks still had a stage that enumerated 256 values and looked each up. Mythos’s Möbius Bridge fingerprint is invariant to that guess — removing a factor-of-256 of work — then added other optimizations so the more expensive transform still nets a large wall-clock win (Anthropic’s 200–800× range).
Threat model: chosen plaintext — attacker can repeatedly encrypt chosen inputs under a fixed unknown key and observe outputs. That is the standard academic assumption for studying AES security margins; it is not “AES-128 in TLS is broken tomorrow.”
Full AES-128 uses 10 rounds. Seven-round attacks inform margin estimates and technique research; they do not decrypt your HTTPS session.
The refusal → breakthrough prompt arc
Anthropic published the researcher’s real (typo-laden) prompts. Early Mythos quit with lines like “AES-128 r5/r6 is just genuinely hard.” One meta-message — models think it’s impossible so they don’t try — caused Claude to rewrite its own harness toward novel search. Over three days, only a handful of substantive human prompts (“don’t change the target,” “we want publishable research,” “not low-hanging fruit”) steered a mostly autonomous run that produced the Möbius insight, then ~1B tokens of refinement. Anthropic is also releasing chain-of-thought material from the key insight session.
Verification asymmetry: HAWK’s end-to-end implementable attack is easier to trust. AES took researchers nearly a month of validation after roughly a week of model discovery — the new bottleneck Anthropic keeps stressing.
Why this matters beyond the papers
- PQC contests exist to find this before deployment — SIKE’s laptop break is the cautionary tale Anthropic cites.
- Verification is the new bottleneck — idea generation is getting cheaper than expert checking.
- Same week as Pacing the Frontier — capability to find math flaws is exactly the acceleration people want tools to pace.
- Defensive dual use — pairs with Mythos cyber and OpenAI’s Codex Security narrative: frontier models as attackers and auditors.
Follow-ups Anthropic already flags
Beyond HAWK and AES, the research post sketches additional Mythos cryptanalysis (still under heavier verification):
- LEA (ISO lightweight block cipher): practical key recovery on 13-of-24 rounds — under ~2³⁰ plaintexts, under an hour on a desktop in Anthropic’s account — vs prior ~2⁹⁸ pairs / ~2⁸⁶ work on that round depth. Not full-round.
- Serpent-128: practical full key recovery on 6-of-32 rounds, improving on published plaintext/work bounds.
- Smaller (<10×) gains mentioned on reduced attacks against Salsa20, Poseidon, and SHA-1 — framed as early, not headline-grade yet.
CryptanalysisBench (with ETH Zurich, Tel Aviv University, University of Haifa) packages ciphers so other labs can track LLM cryptanalysis over time — the evaluation layer this field was missing while demos stayed anecdotal.
What operators and standards people should do
| Audience | Action |
|---|---|
| App security teams | No emergency AES migration. Keep patching implementations — Mythos still finds library bugs too. |
| PQC / standards watchers | Read the HAWK paper before citing HAWK parameter sets; expect AI-assisted review to become normal in NIST-like processes. |
| AI policy | Budget for verification labor, not just model access — Anthropic’s own bottleneck. |
| Defenders | Assume capable models will keep attacking both code and math; wire Codex Security-class tooling into review, and track Mythos-class research disclosures. |
Responsible disclosure checklist from the post: HAWK authors notified June; NIST mailing-list coordination aligned with public release; US government and industry partners got advance copies; academics helped validate. Mythos Preview remains gated — this is not a public “break crypto” API.
Related math/capability context on explainx.ai
Anthropic places this beside other research-math wins (Gemini on Erdős problems, OpenAI on unit-distance conjecture, Claude Fable 5 on the Jacobian Conjecture). Cryptography is simply the domain where “research math” becomes “internet trust assumptions.” See also Fable 5 Jacobian and export-control context in Fable 5 / Mythos export controls.
Related on explainx.ai
- Claude Mythos Preview + cybersecurity
- VulnCheck — AI-found bugs exploit rate vs Glasswing hype
- OpenAI Codex Security CLI open source
- OpenAI Daybreak / Codex Security
- Pacing the Frontier letter
- Fable 5 / Mythos export controls
- Project Pilot drone bench
- Fable 5 Jacobian conjecture counterexample
Official
- Anthropic research post
- Anthropic on X
- Linked papers: HAWK attack · AES + CoT · CryptanalysisBench (from the post)
Bottom line
Mythos did not “break the internet.” It showed a gated frontier model can do publishable cryptanalysis with mostly project-management humans and expensive verification. For explainx.ai readers shipping agents: assume your code and your crypto assumptions will face AI-assisted review — and budget humans who can say “this proof is wrong.” Follow @explainx_ai when the LEA/Serpent write-ups land. Until then, the operator lesson is simple: treat PQC candidate parameters as provisional, and treat AI-assisted cryptanalysis as a normal part of standards review — not a sci-fi footnote.
Security levels and speedup factors are Anthropic-reported as of July 28, 2026. Read the papers before citing numbers in standards discussions.