Anthropic’s latest research demonstrates AI’s growing role in advanced cryptanalysis, but it does not break the encryption protecting today’s internet.
Anthropic has unveiled one of the most significant AI-assisted cryptography research results to date, announcing that its experimental Claude Mythos Preview model independently discovered new attacks against two well-known cryptographic constructions: HAWK-256, an experimental post-quantum digital signature parameter, and seven-round AES-128, a reduced-round version of the Advanced Encryption Standard (AES). While the announcement has generated headlines suggesting that AI has “broken post-quantum encryption” or even “cracked AES,” those claims overstate what actually happened.
Neither production AES nor any standardized post-quantum cryptographic algorithm has been broken. Instead, Claude Mythos Preview produced mathematically valid improvements to existing cryptanalytic techniques against carefully selected research targets. The findings are significant because they expand the current understanding of these algorithms and demonstrate that frontier AI systems can contribute original insights to one of computer science’s most mathematically demanding fields. They do not place encrypted banking sessions, HTTPS connections, VPNs, secure messaging platforms, or other production systems at immediate risk.
This comes amid the U.S.’s push to transition to post-quantum cryptography.
Two Different Cryptographic Targets, Two Different Research Goals
The research focuses on two entirely different areas of modern cryptography.
The first involves HAWK, a lattice-based digital signature scheme currently participating in the U.S. National Institute of Standards and Technology’s (NIST) additional post-quantum cryptography standardization process. Unlike traditional public-key cryptography, which depends on mathematical problems such as integer factorization or discrete logarithms, HAWK is built on lattice mathematics that is believed to remain secure even against future quantum computers.
The second result concerns seven-round AES-128, a reduced-round version of the Advanced Encryption Standard. Researchers routinely study reduced-round variants to evaluate how much security margin remains before attacks approach the full cipher. Such research is a standard part of modern cryptanalysis and should not be interpreted as evidence that production AES implementations have become vulnerable.
Although these two projects address entirely different cryptographic problems, together they illustrate how AI is beginning to assist researchers in discovering new mathematical relationships that can improve existing attacks.
Understanding HAWK and Its Role in Post-Quantum Cryptography
To appreciate why the HAWK result matters, it is important to distinguish digital signatures from encryption.
Encryption protects the confidentiality of information, ensuring that only authorized parties can read data. Digital signatures serve a different purpose. They verify the authenticity and integrity of messages, allowing recipients to confirm that information genuinely originated from the claimed sender and has not been modified in transit.
As governments and technology companies prepare for the eventual arrival of large-scale quantum computers, researchers have spent years designing replacement algorithms capable of resisting quantum attacks. HAWK is one of several lattice-based digital signature schemes currently being evaluated for that future.
NIST’s post-quantum cryptography program has subjected candidate algorithms to years of public analysis by cryptographers worldwide. Although standards such as ML-KEM and ML-DSA have already been selected, additional signature algorithms continue to undergo evaluation. HAWK advanced to the third round of NIST’s additional digital signature competition, placing it among a small number of schemes considered sufficiently promising to warrant continued analysis.
This status should not be interpreted as proof that HAWK was guaranteed to become a standard. Instead, it reflects that the algorithm had already survived extensive scrutiny before Anthropic’s latest findings were published.
Why HAWK-256 Is Not the Same as Production HAWK
One of the most misunderstood aspects of Anthropic’s announcement concerns HAWK-256 itself.
The company did not recover private keys for HAWK-512 or HAWK-1024, which are the parameter sets designed to achieve NIST security levels. Instead, the attack targets HAWK-256, a deliberately smaller challenge parameter created specifically to facilitate cryptanalytic research.
Publishing reduced parameter sets is common practice in cryptography. If researchers only studied full-strength implementations, evaluating new attacks would often require unrealistic amounts of computing power, making meaningful progress extremely difficult. Smaller challenge parameters allow the community to test new ideas without implying that production-strength configurations are similarly vulnerable.
Consequently, successfully attacking HAWK-256 demonstrates progress in cryptanalysis rather than an immediate weakness in real-world post-quantum deployments.
The Mathematics Behind the HAWK Attack
At the core of the attack lies a mathematical problem known as the search module Lattice Isomorphism Problem (smLIP).
In simplified terms, the public key represents one mathematical lattice while the private key defines another closely related lattice. Recovering the signing key requires identifying the hidden transformation that connects those two structures. Under appropriately chosen parameters, this problem is believed to be computationally infeasible, making it a suitable foundation for post-quantum digital signatures.
Earlier work by cryptographers Daniël van Gent and Ludo Pulles had already identified a possible direction for improving attacks against HAWK. Their research showed that discovering certain previously unknown lattice symmetries, known as automorphisms, could dramatically simplify the key recovery problem. However, the specific symmetry required to exploit that observation had never been found, leaving the idea largely theoretical.
According to Anthropic, Claude Mythos Preview identified exactly that missing mathematical relationship.
How an Overlooked Symmetry Changed the Attack
An automorphism is a transformation that rearranges a mathematical object while preserving its underlying structure.
A useful analogy is rotating a perfectly symmetrical snowflake. Although its orientation changes, its overall shape remains identical. Lattices can possess similar hidden symmetries. Discovering one allows researchers to transform a difficult mathematical problem into a smaller, more manageable one without losing the information necessary to recover the secret key.
Claude’s newly identified symmetry enabled researchers to reduce the complexity of the original search problem substantially. Using this discovery, the attack constructs what the researchers describe as a τ-cocycle lattice derived from the public key. The transformed lattice is then processed using established lattice reduction algorithms followed by sieving techniques that search for unusually short vectors.
Short vectors play a central role in lattice cryptography because they often reveal hidden algebraic relationships embedded within the cryptographic construction. Once enough of these relationships are recovered, researchers can reconstruct a secret basis capable of generating valid digital signatures for the original public key.
Importantly, the attack does not recover the original secret seed. Instead, it produces a mathematically equivalent private key capable of generating signatures accepted by the official verification algorithm. Functionally, the recovered key behaves exactly like the original despite being represented differently.
Performance Improvements and Security Impact
Anthropic’s implementation successfully performs complete key recovery against HAWK-256, validating the recovered signing material by generating signatures accepted by NIST’s reference implementation. The company estimates that the attack completes in approximately three hours and forty-two minutes on a 96-core server, a considerable improvement over previous expectation. Perhaps more notably, Anthropic estimates that the expected work factor for HAWK-256 decreases from approximately 2⁶⁴ operations to 2³⁸ operations under the new attack.
Although similar reductions were calculated for HAWK-512 and HAWK-1024, both larger parameter sets remain computationally impractical to attack. The attack remains exponential, not polynomial, meaning it does not invalidate the underlying hardness assumptions supporting lattice-based cryptography. In practical terms, the research weakens one candidate algorithm’s security estimates but does not demonstrate a general break of lattice cryptography or post-quantum digital signatures.
Claude Mythos Didn’t Work Alone
Perhaps the most remarkable aspect of the project is not the mathematics itself, but how the research was conducted. According to Anthropic, Claude Mythos Preview operated within a multi-agent research environment for roughly 60 hours, exploring mathematical ideas with only occasional high-level guidance from a human researcher who was not a lattice cryptography specialist.
The computational cost of the experiment reached approximately $100,000, reflecting the enormous amount of reasoning performed by the model during its search for new attack strategies. However, generating the attack proved easier than verifying it.
Anthropic says researchers spent weeks independently reviewing proofs, validating implementations, reproducing experimental results, and confirming that every mathematical claim was correct before publication. In cryptography, rigorous verification is essential because even a small error can invalidate an entire attack.
To support independent review, Anthropic released technical papers, reproducibility artifacts, and source code alongside the announcement, allowing the broader research community to inspect, reproduce, and evaluate the findings.
A Significant Milestone, Not a Cryptographic Crisis
The HAWK attack represents an important milestone for both cryptography and artificial intelligence. Rather than simply summarizing existing research or assisting with software development, Claude Mythos Preview appears to have contributed a genuinely novel mathematical insight that survived extensive human verification. At the same time, the results should not be interpreted as evidence that post-quantum cryptography has failed.
The attack targets a reduced research parameter rather than production-strength deployments, remains exponential in complexity, and leaves standardized post-quantum cryptographic systems unaffected. Its broader significance lies in demonstrating that frontier AI systems are becoming increasingly capable of participating in advanced mathematical research, a development that could reshape how future cryptographic algorithms are evaluated long before they are deployed at scale.
Claude’s Second Discovery: A Faster Attack Against Reduced-Round AES
While the HAWK research attracted significant attention from the post-quantum cryptography community, Anthropic’s second announcement involved one of the world’s most widely deployed encryption algorithms: the Advanced Encryption Standard (AES).
AES protects a vast portion of today’s digital infrastructure. It secures HTTPS traffic, VPN connections, encrypted cloud storage, password managers, wireless networks, financial transactions, enterprise systems, and countless other applications. Unsurprisingly, any headline suggesting that AI has “cracked AES” immediately raises concerns. However, that is not what Anthropic demonstrated.
Instead, Claude Mythos Preview discovered a way to significantly accelerate an existing cryptanalytic attack against seven-round AES-128, a reduced-round research variant that intentionally omits three of the ten rounds present in the standardized algorithm. Reduced-round cryptanalysis has long been a cornerstone of academic cryptographic research because it helps researchers understand how much security margin remains between known attacks and the complete cipher. These studies are designed to evaluate the strength of an algorithm rather than demonstrate practical compromises against real-world deployments.
Why Researchers Study Reduced-Round AES
AES-128 performs encryption through ten rounds of carefully designed mathematical operations. Each round combines byte substitutions, row shifts, column mixing, and key addition to create an avalanche effect, ensuring that even a single-bit change in the plaintext or key produces an unpredictable ciphertext.
Breaking all ten rounds remains computationally infeasible with current knowledge. Rather than attacking the complete algorithm directly, cryptographers often remove several rounds and attempt to develop new attack techniques. If researchers can eventually attack eight rounds instead of seven, or nine instead of eight, they gain a better understanding of the algorithm’s remaining security margin.
This gradual progression has been standard practice since AES was standardized more than two decades ago. Every improvement helps validate the cipher’s resilience while also highlighting areas where future research should focus.
Improving an Existing Meet-in-the-Middle Attack
Claude Mythos Preview did not invent an entirely new attack against AES. Instead, it improved an existing meet-in-the-middle cryptanalytic technique.
Meet-in-the-middle attacks work by approaching a cipher from both directions simultaneously. One set of computations starts from the plaintext while another begins from the ciphertext. If both computations eventually produce the same intermediate state, researchers can recover information about the secret key much more efficiently than performing an exhaustive brute-force search.
Although this strategy reduces computational complexity under specific circumstances, it generally requires enormous amounts of memory and extremely restrictive assumptions that make it unsuitable for attacking production systems.
The previous best attack against seven-round AES included a particularly expensive stage requiring researchers to evaluate 256 possible intermediate values before continuing the search. This repeated guessing process represented one of the attack’s largest computational bottlenecks.
According to Anthropic, Claude Mythos Preview identified a mathematical invariant, which the researchers named the Möbius Bridge, that remains unchanged across those intermediate values. Because the invariant does not depend on which of the 256 possibilities is selected, the attack can eliminate that entire guessing phase. Removing this bottleneck dramatically reduces the computational effort required for the attack.
What Does a 200- to 800-Fold Speedup Actually Mean?
Anthropic estimates that eliminating the 256-way enumeration accelerates the existing seven-round AES attack by approximately 200 to 800 times, depending on how runtime is measured. At first glance, those numbers appear alarming. However, speed improvements only matter when the original attack was already approaching practical feasibility. That is not the case here. Even after the optimization, the attack still requires computational resources that remain far beyond realistic capabilities. More importantly, the attack assumes an adversary can obtain approximately 2¹⁰⁵ chosen plaintexts encrypted under the same unknown key.
A chosen-plaintext attack assumes the attacker can deliberately select plaintext messages and obtain their encrypted outputs. Requiring more than 2¹⁰⁵ such encryptions immediately places the attack outside any realistic deployment scenario. No production environment can reasonably satisfy those conditions, making the attack academically valuable but operationally impractical. Consequently, the findings do not reduce the practical security of AES as deployed today.
Verification Was Just as Important as Discovery
Anthropic also notes an important limitation of its implementation. The released software does not execute a complete end-to-end recovery of a seven-round AES-128 key. Instead, researchers independently validated each mathematical component of the attack using implementations written in C, Python, and Rust before projecting the overall computational complexity. To demonstrate complete key recovery, the team used a significantly smaller AES-like cipher containing a 24-bit key, where exhaustive validation is computationally feasible.
This distinction is important because cryptographic research frequently validates individual building blocks separately before extrapolating their behavior to much larger constructions. While the theoretical improvements are well supported, the released implementation should not be interpreted as software capable of recovering real AES-128 keys.
Claude Initially Refused the Task
One of the most intriguing aspects of the project was how the research began. According to Anthropic, Claude Mythos Preview initially argued that searching for improvements against AES would likely be unsuccessful. The model reasoned that decades of cryptographic research had already explored the problem extensively and that discovering a fundamentally better attack appeared highly unlikely.
Rather than accepting that conclusion, researchers instructed the model to continue investigating. Over the following days, Claude generated hundreds of millions of tokens exploring mathematical hypotheses, testing alternative approaches, abandoning unsuccessful ideas, and refining increasingly promising lines of reasoning.
After approximately three days of largely autonomous exploration, the model identified the mathematical relationship that ultimately became the Möbius Bridge. Anthropic estimates that the complete research effort eventually produced roughly one billion output tokens, making it one of the largest publicly disclosed AI-assisted mathematical research projects to date.
Human Verification Remained the Bottleneck
Although the model generated the underlying ideas, humans remained responsible for determining whether those ideas were actually correct. Anthropic estimates that API usage alone cost approximately $100,000, but the financial cost represented only a small portion of the overall effort.
Researchers spent several hundred hours reviewing proofs, testing implementations, reproducing experiments, validating assumptions, and ensuring that every mathematical claim could withstand independent scrutiny. According to the company, two researchers required nearly a month before they were sufficiently confident to publish the findings.
That extensive verification process reflects a fundamental characteristic of cryptographic research. Novel ideas may emerge quickly, but confidence in those ideas requires exhaustive validation because even minor mathematical errors can invalidate an entire attack.
What This Means for AI-Assisted Cryptography
Taken together, the HAWK and AES results represent far more than isolated cryptographic improvements. They demonstrate that frontier AI models are beginning to participate in genuine mathematical research rather than simply summarizing existing knowledge.
Claude Mythos Preview explored enormous search spaces, generated new mathematical conjectures, refined promising approaches, and ultimately produced results that survived extensive human verification. While experienced cryptographers still directed the research and rigorously validated every claim, the model appears to have contributed original insights rather than merely reproducing previously published work.
The Bigger Picture
Anthropic’s announcement arrived shortly after the release of CryptanalysisBench, a benchmark developed in collaboration with researchers from ETH Zurich, the University of Haifa, Technische Universität Berlin, and Tel Aviv University to measure AI performance on realistic cryptographic challenges.
The benchmark contains 191 cryptanalysis tasks spanning classical and modern techniques. Anthropic reported that several frontier models successfully solved most of the easier problems while also breaking a limited number of full-strength schemes included in more advanced evaluation tiers.
Although benchmark performance does not directly translate into practical attacks against deployed cryptographic systems, it provides growing evidence that modern AI models can reason about advanced mathematical structures instead of simply recalling known information.
For standards organizations such as NIST, this development could ultimately strengthen future cryptographic algorithms. Public cryptanalysis has always been an essential part of the standardization process because discovering weaknesses before deployment leads to more resilient designs.
No Immediate Risk to Production Encryption
Despite the attention surrounding Anthropic’s announcement, the practical implications remain limited. The HAWK attack targets a reduced challenge parameter rather than the larger parameter sets intended for deployment. The AES research applies only to a reduced seven-round version of the cipher under highly unrealistic attack assumptions. Neither result compromises the encryption protecting HTTPS, online banking, encrypted messaging platforms, password managers, VPNs, cloud storage, or other production systems.
Instead, the significance of the work lies elsewhere. For the first time, a frontier AI system appears to have made meaningful, independently verifiable contributions to cutting-edge cryptographic research. That achievement does not signal the end of modern encryption, but it does suggest that artificial intelligence may soon become a routine collaborator in the discovery, evaluation, and strengthening of future cryptographic algorithms.
Rather than representing a cryptographic crisis, Anthropic’s research highlights the emergence of a powerful new research tool. As AI systems continue to improve, they are likely to accelerate both the discovery of cryptographic weaknesses and the development of stronger defenses, ultimately benefiting the long-term security of the digital ecosystem.
