When AI Does Cryptanalysis: What Claude's HAWK and AES Findings Mean

On July 29, 2026, Anthropic published research describing something cryptography has not seen before at this scale: an AI model finding genuinely new attacks against two established cryptographic schemes on its own initiative, guided but not hand-held by human researchers. The model, a research preview called Claude Mythos Preview, improved the best-known attacks on HAWK, a post-quantum digital-signature scheme, and on a reduced-round version of AES, the block cipher that underpins a large share of the world's encrypted traffic. Within hours, the team behind HAWK withdrew it from NIST's post-quantum standardization process.

That is a genuinely notable result. It is also very easy to misread. Neither finding breaks anything currently protecting your data, your bank account, or your messages, and Anthropic said so explicitly in its own writeup. This piece walks through what HAWK and AES actually are, what Mythos found in each, why the "no production impact" caveat is not a hedge but the accurate description of the result, and what the episode says about where AI-assisted cryptanalysis is actually headed.

Anthropic

Claude

Anthropic's Claude Mythos Preview produced both findings described in this piece.

60 hrsTime to improve the best HAWK attack

2^64 to 2^38HAWK-256 security level, before and after

200-800xSpeedup on the reduced-round AES attack

~$100KApproximate API cost per result

What actually happened

Anthropic's research post, titled "Discovering cryptographic weaknesses with Claude," described two separate exercises. In the first, Mythos was pointed at HAWK, a digital-signature scheme built to resist attacks from future quantum computers, and asked to search for weaknesses in the mathematical structure it relies on. In about 60 hours of work and roughly $100,000 in API cost, the model surfaced a structural symmetry inside HAWK's lattice that nobody had previously identified, despite HAWK having survived roughly two years and two rounds of expert human review during its life as a NIST post-quantum signature candidate.

In the second, Mythos was set on a different kind of target: a deliberately weakened, reduced-round version of AES, the Advanced Encryption Standard used across the internet, in disk encryption, and inside most modern security protocols. Building on an existing family of techniques called meet-in-the-middle cryptanalysis, the model invented a new fingerprinting method it named a "Mobius Bridge," which let it eliminate one of the guesses an attacker would otherwise have to make, cutting the search space involved by a factor of 2^56. That work combined about a week of human-guided setup with roughly a billion output tokens of largely autonomous model effort spread across about three days, again at a cost near $100,000.

Later on July 29, the same day Anthropic published its findings, the team responsible for HAWK withdrew it from NIST's additional post-quantum signature standardization process, having confirmed the weakness Mythos identified.

The NIST Historic District research buildings on the Gaithersburg, Maryland campus, seen across the lawn from outside the perimeter fence — The NIST research campus in Gaithersburg, Maryland, home to the post-quantum standardization process from which HAWK was withdrawn on July 29, 2026. Photo by Jerrye & Roy Klotz, M.D., CC BY-SA 4.0.

HAWK, lattices, and what "automorphism" means here

HAWK is one of several candidate schemes competing to become a NIST-standardized way to sign digital messages that would still be secure even against a sufficiently powerful quantum computer. Like many post-quantum signature schemes, its security rests on lattice problems: mathematical structures made of evenly spaced points in many dimensions, where certain tasks, like finding the shortest path between points, are believed to be extremely hard for both classical and quantum computers to solve efficiently. That believed hardness is what makes the scheme's private key hard to recover from its public key.

What Mythos found was not a way to solve the underlying lattice problem faster in general. It found what mathematicians call a nontrivial automorphism, essentially an unexpected symmetry, a way the lattice structure HAWK is built on maps onto itself that nobody had previously noticed. A symmetry like this matters because it effectively means an attacker has more equivalent starting points to search from than the scheme's designers accounted for, which is mathematically similar to shrinking the space that needs to be searched. Applied to HAWK, the effect was to cut the scheme's effective key strength roughly in half: for HAWK-256, the estimated security level dropped from about 2^64 operations to about 2^38.

The attack Mythos found is still exponential time, not polynomial. It remains completely impractical to actually run, and HAWK was never deployed in any production system.
The caveat that matters most in Anthropic's own framing

That drop sounds dramatic, and in relative terms it is: 2^38 is roughly 26 orders of magnitude smaller than 2^64. But it is worth being precise about what it does and does not mean. The improved attack is still exponential in cost, not the kind of shortcut that turns into an instant break. Nothing about this finding lets anyone forge a HAWK signature today, because 2^38 operations, while small compared to 2^64, is still large enough, combined with the practical overhead of actually running the attack, that no real system used it. HAWK itself was never deployed anywhere in production; it was a candidate under evaluation. Its withdrawal from the NIST process is the standardization system working as intended: a weakness was found, confirmed, and the scheme was pulled before it could ever become a real-world standard.

Reduced-round AES and the Mobius Bridge

AES is different from HAWK in an important way: it is not a candidate, it is one of the most widely deployed encryption algorithms in the world, protecting everything from HTTPS connections to encrypted hard drives. Full AES-128 runs its encryption process through 10 rounds of mathematical transformation; AES-192 and AES-256 use 12 and 14 rounds respectively. Cryptographers routinely study reduced-round variants, versions with fewer rounds than the real algorithm, because a weaker version is easier to analyze and any progress against it can suggest where the full algorithm's margins actually stand. A reduced-round variant is a research object, not a product.

Mythos was set on a 7-round variant. Using meet-in-the-middle cryptanalysis, a long-established technique where an attacker works forward from one end of the cipher and backward from the other, meeting in the middle to prune impossible key guesses, the model devised a new fingerprinting approach that let it discard an entire class of candidate guesses without checking them individually. That single insight, the "Mobius Bridge," eliminated a factor of 2^56 from the search, and the resulting attack ran roughly 200 to 800 times faster than the previous best published approach against the same 7-round target.

Even with that speedup, the attack still requires around 2^105 chosen plaintexts, an amount of data so large it has no plausible path to being collected against a real system, let alone a full 10-round AES-128 deployment, which the finding does not touch at all. As Anthropic put it directly: neither of these results has a practical impact on today's computer systems, and no production software will have to change because of them.

Two research results, not two broken systems

Both findings improved the best-known attack on a research target. Neither produced an attack fast enough to matter against anything deployed today.

HAWK

Post-quantum digital-signature scheme, NIST candidate

What Mythos found: A previously unknown "nontrivial automorphism" (symmetry) in the lattice structure HAWK relies on
Effect on key strength: Roughly halved; HAWK-256 security dropped from about 2^64 to about 2^38
Effort: About 60 hours of work, roughly $100,000 in API cost
Still true after the finding: The attack remains exponential time, not polynomial, and stays impractical to actually run
Real-world exposure: None. HAWK was never deployed in production; it was withdrawn from NIST standardization the same day

Reduced-round AES

7-round research variant of AES, not the deployed cipher

What Mythos found: A new fingerprinting technique it named a "Mobius Bridge," built on meet-in-the-middle cryptanalysis
Effect on the attack: Eliminated one enumeration guess, a 2^56 reduction, making it roughly 200 to 800 times faster than the prior best
Effort: About 1 week of human-guided conception plus roughly 1 billion output tokens over about 3 days of autonomous work, near $100,000 in API cost
Still true after the finding: The attack still needs about 2^105 chosen plaintexts, an entirely impractical number
Real-world exposure: None. Full 10-round AES-128, the version used in real systems, is untouched

Anthropic's own framing: neither result has a practical impact on today's computer systems, and no production software will have to change.

Why this still matters, precisely because nothing broke

The interesting part of this story is not that a lock was picked. It is what compressed timescale it took to find a real, previously unknown weakness in a system that had already passed through rounds of expert scrutiny. HAWK had two years and two formal review rounds behind it. The automorphism Mythos found had gone unnoticed through all of that. Reduced-round AES cryptanalysis is a research area with decades of accumulated technique behind it, and Mythos still found a genuinely new fingerprinting method inside that space in about three days of largely autonomous work.

Cryptanalysis has long been treated as one of the harder domains to automate, because a wrong or unverifiable claim is worse than no claim at all, and the field's whole culture is built around adversarial, painstaking human review. What this result demonstrates is not that AI replaces that review; both findings were still confirmed and interpreted by human cryptographers, and the HAWK team's same-day withdrawal is exactly that verification loop functioning correctly. What changes is where the search for weaknesses starts. Work that might once have taken a research group years of exploratory effort, chasing structural quirks or refining known attack families, can now be compressed into days of model-driven search under expert direction, with the resulting claims still subject to the same scrutiny they always were.

That distinction, acceleration of the search versus replacement of the verification, is the one easiest to lose in a headline. "AI cracked encryption" reads as a break. What actually happened is closer to: a model found a smaller, well-defined mathematical weakness inside a research candidate and inside an intentionally weakened research variant, in both cases far faster than a human team likely would have, and in both cases the finding was reviewed, confirmed, and acted on rather than simply announced. Tasks like this, open-ended technical search across a large mathematical structure, tend to reward having access to whichever model actually performs best on that specific kind of reasoning rather than defaulting to one provider out of habit; that is part of why tools like Metir AI, which let you route hard analytical work to the strongest available model rather than being locked into a single one, have found an audience among people doing this kind of deep technical work.

The takeaway

Two things are true at once here. First, Claude Mythos Preview produced real, verifiable, novel cryptographic research: a previously unknown lattice symmetry that halved HAWK's effective key strength, and a new fingerprinting technique that meaningfully sped up attacks on reduced-round AES. Second, neither result reaches anything deployed in the world today. HAWK was a candidate, now withdrawn. The AES target was a deliberately weakened research variant, and the attack still needs a volume of data no real system will ever expose. The story is not that encryption broke on July 29, 2026. It is that the process of finding where cryptography's margins actually are just got measurably faster, and the field's response, immediate confirmation and immediate withdrawal, is a reasonable model for how that speed should be handled going forward.

Work across the strongest models for hard analytical problems

Deep technical work like cryptanalysis rewards using whichever model is actually best suited to the task at hand, not whichever one you happen to have open. Metir AI puts the leading models from every major lab in one workspace, so you can reach for the strongest tool for a hard problem instead of being boxed into one provider. Try Metir AI free.

Sources:

Image credits

Header image: NIST's Advanced Measurement Laboratory building on the National Institute of Standards and Technology campus in Gaithersburg, Maryland, the agency running the post-quantum standardization process HAWK was withdrawn from. Photo by Gail Porter / NIST, public domain, via Wikimedia Commons. In-body image: the NIST Historic District research buildings on the same Gaithersburg campus, viewed from outside the perimeter fence. Photo by Jerrye & Roy Klotz, M.D., CC BY-SA 4.0, via Wikimedia Commons.