Anthropic said Claude Mythos Preview helped derive a real key-recovery attack against the HAWK-256 post-quantum signature scheme, cutting its estimated attack cost from roughly 2 to the 64th power operations down to 2 to the 38th
Mythos separately found a technique it called a Mobius Bridge that speeds up a known attack on 7-round AES-128 by 200 to 800 times
HAWK had already survived two full years of expert human cryptanalytic review before Mythos found the weak spot
Anthropic says neither result touches production systems, each result cost roughly six figures in API usage, and staff spent several hundred hours independently verifying the AES work before publishing it
What Mythos Actually Found, in Plain Terms
Two results came out of Anthropic's research this week, and they are different enough in kind that it is worth separating them before getting into either one. The first involves HAWK, a signature scheme designed to resist attacks from a future quantum computer, the kind of scheme standards bodies have been reviewing carefully precisely because getting post-quantum cryptography wrong now means a weakness sitting quietly in systems for years before anyone notices. Claude Mythos Preview, an internal research variant Anthropic has been using specifically for security and cryptanalysis work, identified a mathematical symmetry in HAWK's underlying lattice structure that had not shown up in two years of dedicated human expert review. That symmetry let researchers build an improved key-recovery attack, one that actually reconstructs the private signing key rather than just theoretically weakening the scheme on paper. The practical effect is a drop in the smallest HAWK-256 parameter set's effective strength from an estimated 2 to the 64th power operations down to 2 to the 38th, a reduction large enough to matter for anyone who was counting on the original strength estimate.
It helps to be specific about what "post-quantum" actually means here, because the term gets used loosely. Most of the encryption protecting data in transit today relies on math problems, like factoring large numbers, that a sufficiently powerful quantum computer is expected to eventually solve fast enough to break. Post-quantum schemes like HAWK are built on different mathematical foundations, ones believed to stay hard even for a quantum computer, and standards bodies have spent years running exactly the kind of adversarial review this result came out of specifically to catch weaknesses before any of these schemes get baked into real infrastructure at scale. That review process working as intended, catching a real flaw during evaluation rather than after deployment, is the actual context this result belongs in.
The second result is narrower in scope but genuinely clever in method. AES, the encryption standard sitting underneath an enormous share of the world's actual data protection, remains secure at its full 10-round design, this result does not change that. What Mythos worked on is a reduced 7-round version of AES-128, the kind of deliberately weakened variant researchers use specifically to probe attack techniques without threatening real systems. Building on existing meet-in-the-middle attack methods, Mythos invented a new fingerprinting technique, which Anthropic is calling a Mobius Bridge, that eliminates a guessing step in the attack that previously required checking 256 separate values. Removing that step made the resulting attack 200 to 800 times faster than the best previously known technique against that same reduced-round target.
Why the HAWK Result Is the One Worth Sitting With
The AES result is a clean methodological advance against a target built for exactly that kind of probing, interesting to the people who study attack techniques, not alarming to anyone running production encryption. The HAWK result carries different weight, because HAWK is not a deliberately weakened test target, it is a real candidate post-quantum signature scheme that had already gone through two full rounds of dedicated expert cryptanalytic review over two years without this particular weakness surfacing. That is the detail that should register before anything else here. Cryptographic review is not a casual process, it involves specialists deliberately trying to break a scheme from every angle they can think of, over an extended period, specifically so flaws like this one get caught before a scheme is trusted at scale. A weakness that survived that process and then got found by an AI system doing the same kind of structural analysis is a genuinely different kind of result than a faster brute-force technique against an already-known-weak target.
It is worth being precise about what this does and does not mean for anyone using post-quantum cryptography today. Anthropic's own statement is direct on this point, neither result affects any production system currently in use. HAWK is still an active area of standardization, not something deployed under you right now protecting your data, and the specific parameter set affected is the smallest one, not the strength level anyone serious about post-quantum protection would actually deploy at scale. This is a research finding about a scheme still being evaluated, surfaced during evaluation, which is exactly when you want a finding like this to happen. The alternative, this same weakness sitting undiscovered until after wide deployment, is the actual bad outcome this kind of review process exists to prevent, and this result is evidence the process caught something real before that happened.
The Cost of Getting an AI to Find This, and Why Verification Took Longer Than the Discovery
The numbers Anthropic disclosed around cost and verification are almost as notable as the cryptography itself, because they say something concrete about where AI-assisted research actually stands right now, past the point of vague claims about capability. Each of the two results cost roughly six figures in API usage to produce, by Anthropic's own account, real compute spent on a genuinely open-ended research question rather than a benchmark with a known answer. That is not a trivial sum for a single research finding, and it is also small enough relative to what a team of specialized human cryptanalysts working the same problem for two years would cost, which is part of why this is being read as a capability signal rather than a curiosity.
It is also worth noting what that spend actually bought. This was not one clean query that happened to return a working attack, by every account it involved an extended, iterative research process, generating candidate structural observations, testing them, discarding the ones that did not lead anywhere, and following the ones that did. That is closer to how a human research team actually works through an open problem than to how most people picture a single AI prompt producing an answer, and it is a more useful mental model for what this kind of AI-assisted research spend is actually paying for.
The verification detail matters just as much as the cost. Anthropic said staff spent several hundred hours independently confirming the AES result was genuinely correct before publishing it, which is a meaningfully longer human effort than the discovery step itself likely took. That ordering, machine finds a candidate result quickly, humans spend far longer confirming it holds up, is probably the most honest current description of where AI-assisted research sits across fields more demanding than cryptography too. The interesting part is not that an AI system replaced expert judgment, it did not, the interesting part is that it produced a candidate finding specific and structured enough that expert judgment could be pointed directly at verifying it, instead of searching blindly for what to look at in the first place. I wrote earlier about Anthropic's Project Glasswing bet on Claude Mythos for cybersecurity when it was first announced as a research direction, and this result reads like the first concrete evidence of that bet producing something a specialist actually had to spend real hours checking rather than dismissing outright.
What This Signals Beyond the Two Specific Ciphers
Set the specific numbers aside for a moment and the bigger signal is about where structural pattern-finding in cryptanalysis is heading. Both results came from the same underlying skill, spotting a mathematical structure or symmetry that a scheme's design did not account for, then turning that structural observation into an actual working attack technique rather than just a theoretical note. That is close to the core work cryptanalysts do by hand, and it is exactly the kind of pattern-matching-plus-construction task that benefits from an AI system that can hold an enormous amount of structural detail in view at once and test variations quickly. None of that makes cryptanalysis a solved problem, the several-hundred-hour human verification step on just one of these two results is proof enough that expert judgment is still doing indispensable work, but it does suggest that the search space cryptanalysts can now cover with AI assistance has meaningfully widened. I look at this the same way I look at Claude Security's move into public beta vulnerability scanning, a different application of similar structural pattern-finding, but the same underlying trend, AI systems increasingly doing the first pass of finding where to look, with humans doing the harder, slower work of confirming what was found is actually real.
Bottom Line
Claude Mythos Preview surfaced a genuine, previously unfound weakness in HAWK-256 that two years of expert human review had missed, and separately built a faster attack technique against reduced-round AES-128 using a new method Anthropic is calling a Mobius Bridge. Neither result touches any system you use today, HAWK is still under evaluation and the AES target was deliberately weakened for research purposes, but the HAWK finding in particular is a concrete data point that AI-assisted cryptanalysis can now catch structural weaknesses specialist human review already looked for and missed. The cost and verification numbers Anthropic disclosed, roughly six figures in compute per result and several hundred hours of human checking on top of it, are the most useful part of this story if you want a realistic read on where this capability actually sits right now, genuinely useful at finding candidates worth investigating, still entirely dependent on expert humans to confirm those candidates hold up before anyone trusts them.
Top comments (0)