Did Claude Mythos Change Cryptanalysis? HAWK's Withdrawal and the Reduced-Round AES Result¶

The decision to make now

Decision	Conclusion
Replace cryptography in current systems?	No. HAWK was not deployed, and the AES result covers 7 of 10 rounds
Keep HAWK under consideration?	No. Its team withdrew it and NIST marked the withdrawal
Change pre-standardization review?	Yes. Separate AI exploration from human reproduction, novelty review, and disclosure control

A headline saying "AI broke AES" does not justify incident response. Current AES deployments and deployed post-quantum standards do not need emergency replacement. The real change is that AI can now act as an additional attacker during pre-standardization review, while people verify and disclose the results.

Different impact boundaries for HAWK and reduced-round AES

The two results have different validation strength¶

Anthropic reported on July 28, 2026 that Claude Mythos Preview had developed a key-recovery attack on the post-quantum signature candidate HAWK and an improved attack on 7-round AES-128.¹ Both technical papers and the process account were produced by Anthropic researchers evaluating Anthropic's own model, so they are self-evaluation materials rather than independent assessments. The first result includes public code and an end-to-end break of a small parameter set, followed by confirmation and withdrawal by the HAWK team. The second introduces a new fingerprinting method called a Möbius Bridge, but its validation is primarily author-side component testing and complexity accounting; the complete attack is far too large to execute. The two results therefore differ in external confirmation, validation strength, and practical impact.

"Half the key strength" is an imprecise shortcut¶

HAWK had advanced to the third round of NIST's Additional Digital Signature standardization process.² Recovering an equivalent secret key was previously thought to require finding a shortest vector in a large lattice.

Mythos found an unused symmetry in HAWK's lattice. The paper uses that symmetry to reduce key recovery to a shortest-vector problem at roughly half the original dimension.³ The HAWK team confirmed the narrower technical point: the attack approximately halves the lattice-reduction block size needed to recover an equivalent secret key.⁴

The phrase "halves key strength" summarizes this dimensional reduction; it does not mean every security exponent is divided by two. Under the paper's cost model, estimated work for HAWK-512 falls from 2^150 to 2^108, while HAWK-1024 falls from 2^288 to 2^182.³ Those larger targets remain impractical to attack. The design problem is that increasing parameters enough to restore the intended margin removes HAWK's size advantage.

On July 29, the HAWK team withdrew the candidate from NIST's process. NIST updated its Round 3 page to mark HAWK as withdrawn.⁴⁵ This is not a deployed-system incident. It is the public standardization process finding a weakness before deployment, as intended.

The 60-hour search was not a fully human-free experiment¶

Anthropic estimates that discovering, implementing, and checking the HAWK attack took about 60 hours and roughly $100,000 in API usage.¹ Mythos did not conduct the project in a vacuum.

Researchers provided a Claude Code-like environment with collaborating workers, mathematical software, and access to published papers. An operator with a theoretical computer science background gave project-management guidance, including suggestions about recordkeeping and computational libraries. The model reviewed literature, exchanged hypotheses, ran experiments, and produced a verification pipeline that recovered a HAWK-256 secret key on one server in a few hours.¹³⁶

The accurate comparison is not that the same human experts worked continuously for two years and failed. HAWK had survived about two years and two rounds of public review, then a model in a purpose-built harness found a new attack path quickly. That is enough to justify adding AI agents as another adversarial reviewer of candidate standards.

Möbius Bridge advances research without breaking AES¶

AES-128 normally performs 10 rounds. The Mythos result applies to a deliberately weakened 7-round variant used to study security margins.¹⁷

The earlier attack assumed 2^105 chosen plaintexts and roughly 2^99 work. Möbius Bridge exploits the algebraic structure of the AES S-box so the attacker no longer guesses one key byte. In the paper's complexity accounting, estimated work falls to 2^89.3–2^91.4 after including the transform's cost, equivalent to an estimated 200–800× improvement over the earlier result. This is not a measured full-attack speedup, and the 2^105 chosen-plaintext requirement stays unchanged.⁷

Those conditions are infeasible, and the researchers did not run the complete AES attack. They combined a full run on a small-scale AES analogue, component benchmarks, exhaustive tests on small instances, and a Lean proof of a required property.⁷ The Lean theorem establishes an algebraic property of the transform; it does not directly prove the false-positive behavior of the actual truncated fingerprint. That accounting still relies on measurements and a heuristic that wrong-key outputs behave randomly. The result therefore updates a cryptanalytic research record; it is not a vulnerability in deployed AES.

Human verification and disclosure are becoming the slower stages¶

Unlike the occasional human project guidance reported for HAWK, Anthropic characterizes the AES discovery as "almost entirely autonomous." That is the vendor's description of work performed after researchers supplied the task, prompts, and experimental scaffold—not an independent autonomy assessment.¹ Within that scaffold, Mythos generated hypotheses and experiments. Anthropic reports that the model used about one billion output tokens and reached the main idea in roughly a week. Two researchers then spent hundreds of hours and about a month building confidence in the result.¹

This asymmetry suggests a workflow change. In this Anthropic-reported case, the slower stage moved from generating attack ideas to human validation, novelty review, and coordinated disclosure. Independent reproduction and more cases are needed before treating that as a field-wide shift. Anthropic shared the HAWK attack with its authors in June, synchronized publication with the NIST mailing list, and briefed government and industry partners.¹⁴

Future work should keep four roles distinct:

AI generates attack hypotheses from specifications and literature.
People try to falsify them with executable small cases, formal proofs, and independent implementations.
Specialists judge novelty and the exact impact boundary.
Disclosure is sequenced for designers, standards bodies, operators, and users according to deployment status.

These results do not mean cryptanalysis is fully automated¶

The HAWK result has an end-to-end small-parameter demonstration, confirmation from the design team, and a withdrawal. The AES result has proofs, scaled experiments, and component measurements, but its complexity analysis still needs continuing specialist scrutiny. Calling both equally demonstrated attacks would erase an important difference.

CryptanalysisBench provides broader evidence that LLMs can reproduce known attacks and surface new design-level weaknesses. Its harder tiers remain far from saturated, however, and traces cannot always separate memorized attacks from genuine rediscovery.⁸ One successful workflow does not establish that a model can autonomously break arbitrary cryptography.

The present decision has two parts. Do not make emergency changes to current systems. For candidate standards and under-reviewed ciphers, add reproducible AI exploration, independent review, and responsible disclosure as one controlled process.

Sources¶

Anthropic, Discovering cryptographic weaknesses with Claude, July 28, 2026. ↩↩↩↩↩↩↩
NIST, Nine Candidates Advance to the Third Round of the Additional Digital Signatures Process, May 14, 2026. ↩
Zygimantas Straznickas and Stephen A. Weis, HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1, July 28, 2026. ↩↩↩
NIST pqc-forum, HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1, July 29, 2026. Includes the HAWK team's confirmation and withdrawal and NIST's acknowledgment. ↩↩↩
NIST, Round 3 Additional Signatures, accessed July 31, 2026. ↩
Anthropic, cryptography-research-demo, accessed July 31, 2026. ↩
Milad Nasr and Nicholas Carlini, Cryptanalysis of 7-Round AES via the Algebraic Structure of its S-box, July 28, 2026. ↩↩↩
Lukas Fluri et al., CryptanalysisBench: Can LLMs do Cryptanalysis?, July 20, 2026. ↩