Discovering cryptographic weaknesses with Claude
Claude Mythos Preview autonomously discovered an improved attack on the HAWK post-quantum signature scheme and a faster attack on round-reduced AES, neither of which affects deployed systems.
It shows frontier models can now find genuinely novel mathematical weaknesses in well-studied cryptographic algorithms, not just bugs in how those algorithms are implemented in code.
Two readings, equal authority
How to choose: The paper’s words is verbatim — use it when you need to quote, or to judge how they write. Plain language is a paraphrase written for comprehension — use it when you want the idea fast. Neither is a summary of the other; they are two doors into the same room.
“Using Claude Mythos Preview, researchers at Anthropic have discovered improved ways to attack cryptographic algorithms (the mathematical methods used to keep online data private). The first attack significantly weakens HAWK, a digital signature scheme that was built for a post-quantum world. The second identifies a new way to attack round-reduced AES, the most widely used symmetric cipher. These are substantial research advances, but they do not currently affect any production systems. This post describes both findings in more detail and discusses the implications for cryptography in an age of powerful AI models.”
Anthropic used its Claude Mythos Preview model to find two new cryptographic attacks: one that halves the effective key strength of the post-quantum signature scheme HAWK, and one that makes attacks on a reduced-round version of AES 200-800x faster. Neither attack threatens real deployed systems today, but both show that AI models can now discover genuine mathematical flaws in cryptographic algorithms rather than just implementation bugs.
What this paper defines
Every definition below is the paper’s own sentence, with its locator. The plain gloss is a reading aid and is marked as one.
Digital signature scheme
“your browser checks that it is communicating with an authentic website using an algorithm called a digital signature scheme”Introduction
In plain terms: The algorithm that lets your browser confirm a website is who it claims to be.
Symmetric cipher
“the traffic between you and the website is encrypted using symmetric ciphers —codes that allow secure data transmission between parties who share an identical key.”Introduction
In plain terms: An encryption method where both sides use the same secret key to scramble and unscramble data.
Lattice Isomorphism Problem
“HAWK’s security is based on the hardness of a mathematical problem called the Lattice Isomorphism Problem.”An improved key recovery attack on HAWK
In plain terms: The hard math problem that HAWK's security guarantee rests on.
Nontrivial automorphism
“Mythos’s attack works by finding a specific, previously unexploited symmetry called a nontrivial automorphism in the lattice used by HAWK.”An improved key recovery attack on HAWK
In plain terms: A hidden symmetry in HAWK's underlying lattice structure that Claude found and exploited.
Meet-in-the-middle attack
“these attacks work by trading off time for space”An improved attack on reduced-round AES
In plain terms: An attack strategy that trades extra storage (a big lookup table) for a much faster runtime.
Möbius Bridge
“Mythos improved on the previously strongest meet-in-the-middle attack by developing a more sophisticated fingerprinting algorithm that it called a Möbius Bridge .”An improved attack on reduced-round AES
In plain terms: The new fingerprinting technique Claude invented that makes the AES attack's lookup table far more effective.
Chosen plaintext threat model
“The attack operates under a chosen plaintext threat model , which is the most common assumption used for studying ciphers like AES. Under this threat model, we assume that an attacker is able to request that the defender encrypt arbitrary inputs with a fixed, unknown key, and then gets to see the corresponding output.”An improved attack on reduced-round AES
In plain terms: An assumption about attacker power: the attacker can get the target to encrypt any inputs it chooses and see the results, but doesn't know the secret key.
Scaffold
“A scaffold is a set of prompts and code that help the model achieve its goal. We build on top of Claude Code, construct an environment where it can safely run various experiments, and log its results.”Footnotes
In plain terms: The surrounding prompts, code, and sandboxed environment built around Claude to let it run experiments on its own.
What they actually did
Each step is a synthesis. Open any step to see the paper’s own sentence it was derived from, with its locator — so nothing here floats free of the source.
- For the HAWK attack, Claude Mythos Preview worked semi-autonomously in an agentic harness with occasional human guidance.
Trace this step to the paper
“To find the attack, Claude Mythos Preview worked semi-autonomously in an agentic harness, with occasional human guidance and nontechnical direction.”Discovery process (HAWK section)
- The HAWK experiment used a Claude Code-like harness with multiple worker agents collaborating in a sandboxed environment with access to Python, Sage, and published cryptography literature.
Trace this step to the paper
“For this experiment, we used a Claude Code-like harness that supports multiple worker agents collaborating together in a sandboxed environment, with access to computational tools like Python and Sage as well as access to published cryptographic works.”Discovery process (HAWK section)
- Mythos conducted a literature review and mathematical/computational reasoning to find the HAWK attack, then built its own end-to-end verification pipeline to confirm correctness.
Trace this step to the paper
“Mythos found the attack after an extensive literature review to understand the state of the art, and substantial mathematical reasoning and computational experiments. After finding the attack, Mythos implemented an end-to-end verification pipeline to convince itself—and the human operator—of the attack’s correctness.”Discovery process (HAWK section)
- For AES, a separate researcher built a scaffold letting Claude pose hypotheses, run experiments, and design an attack improving on the best known cryptanalysis of AES.
Trace this step to the paper
“A researcher at Anthropic built a scaffold that enabled Claude to pose hypotheses, run experiments to experimentally validate or refute these hypotheses, and then asked Claude to design an attack that improves on the best cryptanalysis of AES.”Discovery (AES section)
- When Claude judged the AES problem unsolvable, researchers sent a short prompting message rather than doing the technical work themselves, after which Claude rewrote its own harness to search for more novel ideas.
Trace this step to the paper
“on AES-128 r5/r6/r7 it found nothing because there's nothing easy to find; this is the most-studied block cipher in existence.”Discovery (AES section)
- Claude then worked autonomously for three days, producing several hundred million tokens, receiving only three further substantive prompts from researchers.
Trace this step to the paper
“Over the course of the next three days, Claude autonomously produced several hundred million tokens while working on the problem; we gave it just three substantive prompts:”Discovery (AES section)
- Three days in, Mythos discovered the Möbius Bridge idea and refined it further after outputting roughly one billion tokens in total.
Trace this step to the paper
“Three days later, Mythos discovered the Möbius Bridge idea that results in an improved attack. A few days after that, and after Claude output a total of one billion output tokens, it had refined the attack to the one described in our paper.”Discovery (AES section)
- Anthropic researchers then spent several hundred hours learning enough cryptography to validate Claude's AES claim and to write up the accompanying research paper.
Trace this step to the paper
“Researchers at Anthropic then spent several hundred hours learning enough cryptography research to validate the model’s claim, and to prepare the research paper itself, which we are releasing along with this blog post.”Discovery (AES section)
- Throughout, Anthropic followed responsible disclosure procedures, consulting academics and sharing advance copies with government and industry partners, including coordinated disclosure to HAWK's authors and NIST.
Trace this step to the paper
“Throughout the research process, we followed responsible disclosure procedures, and consulted with academics to confirm the validity of our findings. We also shared advance copies with US government and industry partners, and held discussions on the implications of this research.”Introduction
- Anthropic partnered with academics at three universities to build CryptanalysisBench, a benchmark for evaluating LLM cryptanalysis capability going forward.
Trace this step to the paper
“we partnered with academics at ETH Zurich, Tel Aviv University, and TU Berlin to build CryptanalysisBench , a benchmark that packages together many cryptographic ciphers and makes it easy for others to evaluate the capabilities of LLMs on this important topic.”Introduction
Exactly what was run, and how
| Model | Developer | Temp | Effort / reasoning | Deployment | Other settings |
|---|---|---|---|---|---|
| Claude Mythos Preview | Anthropic | not reported | not reported | API | Ran inside a Claude Code-like agentic harness supporting multiple worker agents in a sandboxed environment, with tool access to Python and Sage and to published cryptography literature; no temperature, sampling, or system-prompt values are reported. |
Source for Claude Mythos Preview settings
“Each of the results cost roughly $100,000 in API cost to develop.”Introduction
What they reported — and what they left out
The post names the model (Claude Mythos Preview) and describes its harness and tools (a Claude Code-like multi-agent sandboxed environment with Python/Sage access, roughly $100,000 in API cost per result) but never reports temperature, sampling parameters, context window size, or a formal reasoning-effort setting.
The numbers they report
Mythos improved the best-known attack on HAWK, effectively cutting its key strength in half, after only about 60 hours of work.
60 hours of work; effective keysize reduced by a factor of 2
See it in the paper
“Mythos was able to improve the best-known attack on it in just 60 hours of work—effectively cutting its key strength in half.”Introduction
The expected cost of a full key recovery attack on HAWK-256 dropped sharply once Mythos's attack was applied.
from 2^64 to 2^38
See it in the paper
“the expected cost of a full key recovery attack against the small HAWK-256 size was thought to be 2 64 but was demonstrated by Mythos to be 2 38 .”Impact (HAWK section)
Mythos's AES attack eliminated a guess an attacker needed to make, speeding up the previous best attacks substantially.
200-800x faster
See it in the paper
“eliminated one of the guesses an attacker needs to make, improving the speed of the previous best attacks by 200-800×.”Summary
The Möbius Bridge fingerprint directly cut the required work for the AES attack by a large constant factor.
factor of 256
See it in the paper
“Mythos developed a fingerprint that is invariant to this guess, which directly reduces the amount of work required by a factor of 256.”An improved attack on reduced-round AES
Each of the two headline results cost roughly the same amount in API spend to produce.
~$100,000 in API cost per result
See it in the paper
“Each of the results cost roughly $100,000 in API cost to develop.”Introduction
The AES attack took much longer for humans to verify than for Mythos to discover.
~1 week to discover vs. ~1 month to verify
See it in the paper
“But whereas it took just one week for Mythos to autonomously discover the improved attack on AES, it took two researchers nearly a month to gain confidence that the method it discovered is correct.”Further work
Mythos also found a practical attack recovering a 13-round LEA cipher key quickly on ordinary hardware.
under 2^30 encrypted plaintexts; under an hour on a modern desktop
See it in the paper
“Mythos Preview developed a practical attack that can recover a 13-round LEA key in under 2 30 encrypted plaintexts, and that runs in under an hour on a modern desktop computer.”Further work
Mythos identified a practical full key-recovery attack on 6 rounds of the 32-round Serpent-128 cipher, improving on prior published requirements.
prior work required >2^70 plaintext pairs and 2^90 decryptions
See it in the paper
“Mythos Preview has also identified another practical full key-recovery attack on 6-rounds of the Serpent-128 cipher (a 32-round cipher—again limiting the impact of this attack), extending the current published work which requires more than 2 70 plaintext pairs and 2 90 decryptions.”Further work
Additional, smaller improvements were found against Salsa20, Poseidon, and SHA-1.
<10x gains
See it in the paper
“We have found additional, fairly limited improvements (that offer <10× gains) on attacks against the Salsa20 stream cipher, the Poseidon hash function, and the SHA-1 hash function.”Further work
Claude produced an extremely large volume of autonomous output while developing the AES attack.
one billion output tokens (total, over the discovery process)
See it in the paper
“after Claude output a total of one billion output tokens, it had refined the attack to the one described in our paper.”Discovery (AES section)
What they assert, beside what they showed
Left is the claim in the paper’s own words. Right is the data offered for it. Where the two do not fully meet, a gold band names the distance.
Neither of the two headline results has a practical impact on today's deployed computer systems.
“To be clear, neither of these results has a practical impact on today’s computer systems; no production software will have to change as a result.”
“HAWK is only a candidate signature scheme and so is not deployed; 2 our second attack is on a reduced version of AES and does not break the full cipher.”
IntroductionThe HAWK attack is specific to HAWK and does not impact other NIST post-quantum signature candidates or lattice-based cryptography in general.
“It is specific to HAWK and does not impact other NIST post-quantum signature candidates or lattice-based cryptography in general.”
“We believe the attack discovered by Mythos Preview does not impact the other NIST post-quantum cryptographic schemes or other schemes that use related methods.”
FootnotesMythos Preview achieved these results mostly autonomously and mostly without human intervention.
“Mythos Preview achieved these results mostly autonomously and mostly without human intervention.”
“Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack, and another researcher built a scaffold 4 that allowed Claude to fully autonomously discover the AES attack.”
IntroductionClaude initially refused to engage with the AES problem, believing it was impossible to improve on existing cryptanalysis.
“Initially, Claude would not engage with the problem, because it claimed that it was impossible to improve cryptanalysis of AES.”
“on AES-128 r5/r6/r7 it found nothing because there's nothing easy to find; this is the most-studied block cipher in existence.”
Discovery (AES section)The results are cryptography research working as intended: stress-testing algorithms to build trust and make systems more secure.
“This is cryptography research working as intended: stress-testing algorithms to build trust and ultimately make systems more secure.”
“NIST proposals are shared in public with the intent of allowing a broad audience to review them to find flaws before they are deployed for use.”
Impact (HAWK section)Claude is able to perform cryptographic research at the level of top experts.
“Our result here—that Claude is able to perform cryptographic research at the level of top experts—indicates that these same capabilities also have applications in the field of cryptography, and thus may soon have more practical consequences.”
“Despite HAWK having survived two rounds of expert human review over a period of two years, Mythos was able to improve the best-known attack on it in just 60 hours of work—effectively cutting its key strength in half.”
IntroductionHow they frame it, and what they want next
Their framing
The authors frame both results as encouraging but non-alarming: genuine research advances that currently pose no risk to deployed systems, and evidence that AI can strengthen the adversarial review process cryptography already relies on rather than undermine it. They repeatedly foreground responsible disclosure, human verification effort, and coordination with NIST, government, and industry, and close by looking ahead to AI's growing role in both attacking and eventually designing cryptographic schemes.
Register: Numeric results (speedups, key-size reductions, token counts) are stated with confident precision, while broader claims about safety, generality, and non-impact are consistently hedged with phrases like "we believe" and "we estimate," and the authors repeatedly flag that the human researchers validating the results are not themselves cryptography experts.
Where they hedge
“though it is important to note the researchers are not experts in cryptography”An improved attack on reduced-round AES
“We estimate that the full attack discovery process cost approximately $100,000 in API cost.”Discovery process (HAWK section)
“We believe the attack discovered by Mythos Preview does not impact the other NIST post-quantum cryptographic schemes or other schemes that use related methods.”Footnotes
What they say it means
- AI may become a powerful tool for reviewing and eventually helping design new cryptographic standards.
the paper’s words
“We believe that reviewing specifications like HAWK with AI will be a powerful tool in the development of novel cryptographic standards. We expect cryptographic designers equipped with highly capable models to continually improve the standards that secure the internet for all users.”Impact (HAWK section)
- As models generate more autonomous research output, human researchers may become the bottleneck for validating results rather than for producing them.
the paper’s words
“As language models increasingly produce novel research outputs autonomously, human researchers may become bottlenecked on studying and validating these results for technical validity, novelty, and utility.”Conclusions
- Many widely used but under-scrutinized ciphers may have latent weaknesses that LLMs will soon be able to uncover.
the paper’s words
“Many ciphers protecting modern systems have received less scrutiny than they deserve—they might still have important weaknesses lying dormant that LLMs will soon be able to discover.”Conclusions
What they call for next
- Anthropic will host an academic workshop on the role of language models in security and cryptography research.
the paper’s words
“In the coming weeks, we will host an academic workshop to engage with researchers across academia to discuss the role of language models in security and cryptography research.”Conclusions
- Deciding how researchers should react to a model finding vulnerabilities with immediate real-world impact needs input from academia, government, and industry.
the paper’s words
“We believe answering this question will require input from academia, government, and industry.”Conclusions
- Readers are directed to the full technical papers on HAWK and AES, plus the AES chain-of-thought document.
the paper’s words
“Read the full paper on AES , and the associated chain of thought .”Links to full research papers
Limitations they state
“The human operator had a background in theoretical computer science but was not an expert in lattice-based cryptography.”Discovery process (HAWK section)
“though it is important to note the researchers are not experts in cryptography”An improved attack on reduced-round AES
“But we are reaching the limits of our own knowledge, and the vast majority of our time over the past few months has been in verifying the correctness of Claude’s results.”Further work
“Even then, the attack would cost hundreds of millions of dollars to implement and does not impact other similar cipher schemes.”Footnotes
Moves worth stealing
Publishes the actual, typo-laden prompts researchers used to unstick the model, rather than a polished paraphrase, as a transparency move about the human steering involved.
“in what follows, we publish the real prompts our researcher used, including typos and grammatical errors”
Pushes caveats and scope-limiting detail into numbered footnotes rather than interrupting the main narrative.
“A scaffold is a set of prompts and code that help the model achieve its goal. We build on top of Claude Code, construct an environment where it can safely run various experiments, and log its results.”
Reframes a capability result that could read as alarming (AI breaking cryptography) as proof the existing adversarial-review system is working, rather than as a threat narrative.
“This is cryptography research working as intended: stress-testing algorithms to build trust and ultimately make systems more secure.”
Closes by situating the result alongside competitors' recent AI-for-math achievements, framing it as part of an industry-wide trend rather than an isolated in-house win.
“researchers from Google have used Gemini to resolve several open Erdős problems , researchers from OpenAI have used GPT to resolve the unit distance conjecture”
Where else this leads
Same territory
- Introducing GeneBench-Pro OpenAI
ai-agents
Published alongside it
The nearest publications in time, across all three labs.
- Visual prompt engineering for video models Google DeepMind
2026-07-28 - Scientific computing in the age of agentic AI OpenAI
2026-07-28 - How enabling two settings tripled our scores on the ARC-AGI-3 benchmark OpenAI
2026-07-29 - Ten advances in mathematics and theoretical computer science OpenAI
2026-08-01
What this page was built from
This is a full company blog post (graded 'full' in the manifest), including footnotes and related-content teasers; the actual hyperlink targets for the HAWK/AES papers and CryptanalysisBench are not present in this scraped plain text, only their anchor text.