TL;DR

Claude Mythos found mathematical weaknesses in HAWK (halving key strength) and reduced-round AES (200-800x faster attack). Both discovered mostly autonomously. No production systems affected. Each cost ~$100K.

Claude Mythos found mathematical weaknesses in HAWK (halving key strength) and reduced-round AES (200-800x faster attack). Both discovered mostly autonomously. No production systems affected. Each cost ~$100K.

Anthropic announced on Monday that Claude Mythos Preview has discovered mathematical weaknesses in two cryptographic algorithms. The first substantially weakens HAWK, a post-quantum digital signature scheme under review by NIST, by cutting its effective key strength in half. The second improves the best-known attack on seven-round AES, the most widely used symmetric cipher, by 200-800x. Neither result affects production systems. HAWK is not deployed, and the AES attack targets a reduced variant, not the full cipher.

The distinction from Anthropic’s earlier cybersecurity work is critical. Claude had previously found vulnerabilities in cryptographic libraries, meaning bugs in how programmers implemented algorithms. These new results are flaws in the mathematics of the algorithms themselves, discovered after years of expert human review failed to find them. HAWK survived two rounds of NIST review over two years. Mythos found the weakness in 60 hours of semi-autonomous work, with one researcher providing project management direction rather than technical guidance. The AES result was discovered almost entirely autonomously after Claude initially refused to try, claiming improvement was impossible. A researcher sent three encouraging prompts over three days. Claude produced one billion output tokens and invented a technique it named the “Möbius Bridge.”

Each discovery cost approximately $100,000 in API compute. Anthropic followed responsible disclosure, sharing the HAWK attack with its authors and coordinating with NIST, the US government, and industry partners before publication. The company also partnered with ETH Zurich, Tel Aviv University, and University of Haifa to release CryptanalysisBench, a benchmark for evaluating AI cryptanalytic capabilities. Claude Mythos found 10,000 critical software vulnerabilities in one month, and moving from implementation bugs to algorithmic flaws represents a qualitative leap in what AI can do to security infrastructure.

Anthropic acknowledged follow-up results: a practical attack on 13-round LEA that recovers keys in under an hour on a desktop, and attacks on Serpent-128, Salsa20, Poseidon, and SHA-1. “In just one year, language models have gone from being unable to perform cryptanalysis of even the most basic ciphers to being capable of finding flaws in cryptographic designs that have escaped discovery despite years of human expert review,” the company wrote. The White House launched Gold Eagle to coordinate AI-powered cyber defence, but there is no equivalent programme for cryptographic review. The question Anthropic raised at the end of its post is the one that matters: what happens when a model finds a flaw in a cipher that is already protecting production systems?

Get the most important tech news in your inbox each week.