IC Technology & Cyber — 2026-07-29

Anthropic Mythos AI Discovers Cryptographic Weaknesses in NIST Post-Quantum Candidate Hawk and Reduced-Round AES

BLUFFrontier AI models now operate as credible adversarial reviewers in post-quantum standardization, compressing attack-discovery timelines that previously required years of specialist effort into days.

Anthropic reported that its Claude Mythos Preview model produced two new cryptanalytic results, detailed in a company blog post and accompanying technical papers 1. Working with a human researcher over roughly 60 hours, Mythos found a previously unexploited lattice symmetry in HAWK-256, a NIST round-three post-quantum signature candidate that had survived two rounds of expert human review over two years, reducing key-recovery cost from roughly 2^64 to 2^38 operations, cutting the scheme's effective key strength in half and requiring key sizes to double to restore the original security level 12. Working largely autonomously, Mythos separately devised a technique called "Mobius Bridge" that made the strongest known meet-in-the-middle attack on seven-round AES-128 between 200 and 800 times faster, under a chosen-plaintext model requiring roughly 2^105 queries, though validating the result's correctness then took Anthropic researchers nearly a month, longer than the discovery itself 13. Anthropic said it disclosed the HAWK finding to the scheme's designers in June and coordinated public release with the NIST mailing list, and stated neither result affects deployed systems 12. The Hacker News reported Anthropic's published HAWK-256 attack code runs in about three hours 42 minutes on a 96-core server 4.

Analysis
Anthropic's Frontier Red Team authored, timed, and framed both findings as a Mythos Preview capability demonstration, and neither HAWK's designers nor independent cryptographers have yet published corroborating review of the technical claims. The doubled key sizes needed to restore HAWK's intended security erase the efficiency edge that distinguished it from competing lattice-based candidates still under NIST's third-round review, forcing evaluators to weigh a demonstrated automorphism-based attack path against two prior years of expert scrutiny. The AES result carries no deployment risk given its infeasible query requirement but establishes a capability baseline against a cipher that has absorbed decades of dedicated cryptanalysis. Reporting rests on a single primary source, Anthropic's own materials, with outlets amplifying the company's figures without independent technical verification.
4 sources
  1. Discovering cryptographic weaknesses with Claude - Anthropic
  2. Here's what Anthropic found when it turned Mythos loose on encryption algorithms - CyberScoop
  3. Mythos takes its first shot at post-quantum cryptography - CSO Online
  4. Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack - The Hacker News

View in full brief →

UNCLASSIFIED // OPEN SOURCE