Anthropic has revealed that its experimental AI model, Claude Mythos Preview, independently helped uncover two new cryptographic attacks, including a complete key-recovery attack against the HAWK-256 digital signature scheme and a significantly faster attack on a reduced version of AES-128.
The company said the research demonstrates AI’s growing ability to assist with advanced cryptanalysis, but stressed that neither discovery poses a threat to real-world security systems. The attacks target research scenarios rather than production deployments, and users do not need to change their existing encryption or software.
The first breakthrough focuses on HAWK, a post-quantum digital signature algorithm currently being evaluated by the U.S. National Institute of Standards and Technology (NIST). Claude Mythos Preview identified a previously unknown mathematical symmetry within HAWK’s underlying lattice structure, allowing researchers to build a practical end-to-end key-recovery attack against the HAWK-256 challenge parameter. Anthropic said its public implementation can recover a functional signing key in roughly three hours and 42 minutes using a 96-core server.
Although the recovered key can generate valid digital signatures, it is not identical to the original secret seed. Instead, the attack reconstructs an equivalent signing key capable of authenticating messages. Anthropic emphasized that the released attack works only against HAWK-256, a smaller research parameter intended for cryptanalysis, and does not extend to the larger HAWK-512 or HAWK-1024 parameter sets currently being considered by NIST.
The company also updated its security estimates for the larger HAWK variants, noting that while the theoretical attack cost is lower than previously believed, the required computational effort remains far beyond practical reach. The attack also does not affect other lattice-based cryptographic algorithms or represent a complete break of post-quantum cryptography.
Anthropic’s second result targets a reduced version of AES-128, analyzing only seven of the algorithm’s ten encryption rounds. According to the researchers, Claude Mythos Preview discovered a new mathematical optimization called the “Möbius Bridge,” which eliminates a costly guessing step used in an existing meet-in-the-middle attack. The improvement makes the attack approximately 200 to 800 times faster, depending on the measurement method.
Despite the dramatic speedup, the attack remains impractical outside academic research. It requires an unrealistic number of chosen plaintexts encrypted with the same unknown key, making it unsuitable for attacking real-world AES deployments. Anthropic said the findings do not weaken the security of the full ten-round AES-128 algorithm used in production systems.
The company has released technical papers and reproducible research artifacts for both discoveries. While the AI generated much of the mathematical reasoning, humans provided project direction, computing resources, and extensive verification before publication. Anthropic estimated that Claude Mythos Preview spent around 60 hours developing the HAWK attack in a multi-agent environment, with API costs reaching roughly $100,000.
Verification proved to be the most time-consuming part of the project. According to Anthropic, researchers spent several hundred hours reviewing the AI’s work, and two researchers spent nearly a month fully validating the HAWK findings before releasing them publicly.
Anthropic also revealed that the AI initially rejected the idea that AES could be improved, insisting such an advance was impossible. Researchers continued encouraging the model to explore alternative approaches, eventually leading to the discovery of the Möbius Bridge optimization after several days of computation and roughly one billion generated output tokens.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
The announcement comes shortly after the release of CryptanalysisBench, a benchmark created by researchers from ETH Zurich, Anthropic, the University of Haifa, Technische Universität Berlin, and Tel Aviv University to evaluate AI systems on cryptographic research tasks. While the new findings highlight AI’s potential to accelerate security research, Anthropic says they do not require changes to existing cryptographic standards or deployed systems.
