Anthropic has published two cryptographic attacks that its still unreleased model Claude Mythos Preview found largely on its own. They target the post-quantum signature scheme HAWK and a shortened variant of the AES encryption standard. For the HAWK attack, the model required roughly 60 hours of compute and about $100,000 in API costs.
Attack halves the effective key length of HAWK
HAWK is a candidate in the ongoing standardization process run by the US agency NIST for signature schemes meant to withstand quantum computers. By Anthropic’s account, the scheme had already undergone two years of expert scrutiny before Mythos exploited a non-trivial automorphism in the underlying lattice – a structural symmetry that shrinks the search space.
The effect is substantial. For the HAWK-256 variant, the expected attack cost drops from 2 to the power of 64 to 2 to the power of 38 operations, according to the accompanying paper. That amounts to halving the effective key length. The attack remains exponential and therefore theoretical. Doubling key sizes would offset it – but at the cost of precisely the efficiency advantage HAWK competes on. An Anthropic researcher supervised the run only in an organizational capacity, advising the model on which programming libraries to use. The work ran in a sandboxed environment in which several agents of the model collaborated in parallel. The HAWK authors were notified in June, and publication went out simultaneously via the public NIST mailing list.
Shortened AES falls 200 to 800 times faster
The second result concerns AES-128, the encryption standard in use worldwide. Mythos improved an attack on a version cut to seven rounds; the deployed version uses ten. The technique developed for it, which Anthropic calls the Möbius Bridge, runs 200 to 800 times faster than the previous best result, depending on the baseline. The model generated several hundred million tokens across three days while receiving just three substantive prompts. In early runs it declared the task impossible and only switched approach after being told as much.
Further interim results follow the same pattern. On the block cipher LEA, Mythos reduced the requirement from 2 to the power of 98 plaintext pairs to under 2 to the power of 30 encrypted plaintexts – the attack now runs in under an hour on an ordinary desktop machine, though again only against a version cut to 13 of 24 rounds. Added to that is a full attack on Serpent-128 with six instead of 32 rounds, plus modest improvements on Salsa20, Poseidon and SHA-1.
Verifying the results takes longer than finding them
The bottleneck has shifted to verification. Anthropic researchers say they needed several hundred hours to learn enough cryptography to assess the model’s claims at all; they were not trained cryptanalysts. The same pattern already showed up in the hunt for software vulnerabilities by the same model. In parallel, the company published the benchmark CryptanalysisBench together with researchers from ETH Zurich and the universities of Tel Aviv and Haifa, bundling 191 tasks across six families of cryptographic primitives.
The attacks have not been independently confirmed. The security outlet The Hacker News found no independent reproduction of the HAWK result in its own review; the corresponding post on the public NIST mailing list was still unanswered when checked. Anthropic stresses that none of the findings have immediate consequences for systems in use today, framing both as expected steps in ordinary cryptographic research. Implementing the AES attack would cost hundreds of millions of dollars, the company says.
The real crux is how the standardization process responds. Whether NIST or the HAWK submitters will adjust parameters, revise security claims or reconsider the scheme’s candidate status is not yet visible from the public record. No date for a statement has been given.
