Claude Mythos found HAWK and reduced-round AES weaknesses in 60 hours for ~$100K, producing the CryptanalysisBench benchmark.
Anthropic's Claude Mythos Preview discovered mathematical flaws in both HAWK, a post-quantum signature scheme, and a weaker version of AES in 60 hours of continuous operation. The experiment cost roughly $100,000 in API fees and produced results that human experts had reviewed for over two years without finding, according to Anthropic's research blog published July 28, 2026.
Key facts
- 60 hours of continuous Claude Mythos operation
- ~$100,000 estimated API cost
- 191 tasks in CryptanalysisBench benchmark
- 5 frontier models tested on the benchmark
- Novel SpoC AEAD and KINDI attacks discovered
Anthropic researchers used Claude Mythos Preview to find cryptographic weaknesses in HAWK, a post-quantum signature scheme that human cryptanalysts had reviewed for more than two years, and a reduced-round variant of AES. The model operated autonomously for 60 hours at an estimated API cost of ~$100,000 According to Anthropic's research blog. Neither finding has practical impact on production systems today, Anthropic stated.
The most revealing part of the experiment was the prompting strategy. The researchers shared their actual prompts, complete with spelling errors, showing they repeatedly pushed the model past its default reluctance to attempt "impossible" problems. Prompts included: "the models tend to think it is impossible to solve so they don't try they need a good amount of prompting" and "again we are not looking for low hanging fruit, we want proper research to find genuinly hard findings." [The Decoder reports] the main human interventions were simply encouraging the model not to give up.
CryptanalysisBench: A New Evaluation Framework
The work produced CryptanalysisBench, described in the arXiv preprint CryptanalysisBench: Can LLMs do Cryptanalysis? (arXiv:2607.18538). The benchmark includes 191 tasks across six families of cryptographic primitives, sourced primarily from four NIST standardization competitions. It has three tiers: schemes with known practical breaks, full-strength schemes with no known breaks plus scaled-down variants, and a challenge set of production primitives at the frontier.
Five frontier models—Claude Opus 4.8, Sonnet 5, Mythos 5, GPT 5.5, and open-weights GLM 5.2—broke 65%-86% of Tier 1 schemes. For Tier 2, models broke 6-12 schemes at full strength and 24-61 across scaled-down variants. Critically, models produced novel cryptanalysis including a key-recovery attack exploiting a design flaw in SpoC AEAD and an error in KINDI's published CCA-security proof, both previously unknown to the best of the researchers' knowledge.
Prompt Engineering as Scientific Method
The experiment's most interesting finding isn't the cryptographic results—it's that prompt engineering, often dismissed as unscientific, proved essential to achieving research-grade output. The model needed explicit permission to attempt "impossible" problems and repeated encouragement to pursue publishable results rather than low-hanging fruit. This mirrors how human PhD advisors train junior researchers: overcome the belief that hard problems are unsolvable.
This pattern has implications beyond cryptography. As LLMs increasingly function as autonomous research agents, the quality of the "supervisor" prompt may matter more than model architecture. Anthropic's researchers essentially built a prompt-based research management system, not just a cryptanalysis tool.
What to watch
Watch for whether other labs replicate these results using open-weight models like GLM 5.2, and whether NIST incorporates CryptanalysisBench into its post-quantum standardization process. The key metric: can open models match Mythos's novel attack discovery rate at comparable compute budgets?
Source: simonwillison.net
Originally published on gentic.news
Top comments (0)