Claude Mythos Found Real Cryptographic Weaknesses — And AES Is Not One of Them

On July 28, 2026, Anthropic published two cryptanalysis results discovered by Claude Mythos Preview: an improved key recovery attack against HAWK, a lattice signature scheme that was a third-round candidate in NIST's post-quantum signature process, and a faster meet-in-the-middle attack against a reduced 7-round version of AES. The HAWK attack is real and was executed end-to-end: Anthropic recovered actual HAWK-256 secret keys in a few hours on a single server. The AES result touches 7 of the cipher's 10 rounds and Anthropic calls it "completely impractical." In Anthropic's own words: "neither of these results has a practical impact on today's computer systems; no production software will have to change as a result."

Your encryption is not broken. Nothing you use today needs patching, rotating, or replacing. If you read a headline this week claiming that an AI cracked AES, that headline is wrong, and the source it is misreading says so explicitly in its third paragraph.

The genuinely important number in this publication is not a complexity bound. It is a duration: one week for the model to find the AES result, and nearly a month for two human researchers to convince themselves it was correct.

TL;DR — the five things that matter

• HAWK is the real result. Anthropic's paper gives an unconditional, deterministic polynomial-time reduction from HAWK-n key recovery to an exact Shortest Vector Problem oracle in dimension n/2 + 1. In the AGPS20 gate-count model it lowers HAWK-512 from 2150 to 2108 and HAWK-1024 from 2288 to 2182. Real HAWK-256 keys were recovered and verified against the official HAWK implementation.
• AES is not broken and was never close. The attack works on 7 of AES's 10 rounds, in the single-key setting, using 2105 chosen plaintexts. Anthropic states plainly that it is "completely impractical." Full AES-128 remains standing: the best known single-key attacks beat brute force by roughly two bits.
• HAWK has since withdrawn from the NIST process. NIST's Round 3 page now carries the notice: "The submission team has withdrawn HAWK from the additional digital signatures standardization process." Anthropic's paper, published July 28, still described HAWK as "currently a third-round candidate."
• Verification, not discovery, is now the bottleneck. Anthropic: "Whereas it took just one week for Mythos to autonomously discover the improved attack on AES, it took two researchers nearly a month to gain confidence that the method it discovered is correct."
• Cost: roughly $100,000 per result in API spend, by Anthropic's own estimate — not per attempt.

What Anthropic actually published

Anthropic released a research post plus two technical papers, both self-hosted as PDFs rather than posted to arXiv or the IACR ePrint archive. The HAWK paper, "HAWK-n Key Recovery Reduces to SVP in Dimension n/2+1," is authored by Zygimantas Straznickas and Stephen A. Weis. The AES paper, "Cryptanalysis of 7-Round AES via the Algebraic Structure of its S-box," is authored by Milad Nasr and Nicholas Carlini. A third document publishes the model's raw chain of thought on the AES problem.

Alongside these, Anthropic partnered with academics at ETH Zurich, Tel Aviv University, and TU Berlin on CryptanalysisBench, a 191-task benchmark across six families of cryptographic primitives, submitted to arXiv on July 20, 2026. That paper is the one piece of this release that sits in the normal scientific pipeline.

The HAWK result: a real key recovery, actually executed

HAWK is a lattice-based digital signature scheme built on the Lattice Isomorphism Problem. Anthropic's attack exploits a nontrivial automorphism of the key lattice supplied by a Galois involution, recoverable as a shortest vector of a public lattice. The practical consequence is that recovering a HAWK key no longer requires solving a hard problem in the full dimension — it reduces to roughly half.

Answer capsule: Anthropic's HAWK attack is not theoretical. Researchers ran it end-to-end and recovered real HAWK-256 secret keys in a few hours on a single 96-core server. Every attempt succeeded, and each recovered key was checked with a sign-and-verify round trip using the official HAWK submission package. This is the strongest form of evidence in cryptanalysis: a working key recovery, not an estimate.

The numbers, from the paper's own abstract and tables: the HAWK specification reported key recovery costs of 2150 gates for HAWK-512 and 2288 gates for HAWK-1024. The attack lowers these to 2108 and 2182 respectively. For the smallest parameter set, Anthropic's research post states that the expected cost against HAWK-256 "was thought to be 2^64 but was demonstrated by Mythos to be 2^38." Anthropic describes the overall effect as reducing the effective key size by a factor of two.

Two limits are stated clearly in the paper and worth repeating, because they are the difference between a scheme-specific result and a systemic one. The construction does not transfer to Falcon. And per the announcement Stephen Weis posted to the NIST pqc-forum mailing list, the result does not impact ML-DSA or other lattice schemes. Certain conductors also evade the attack entirely.

The AES result: 7 rounds out of 10, and Anthropic calls it impractical

Answer capsule: The AES attack applies to a reduced 7-round variant, not the 10-round AES-128 that protects real traffic. It operates in the single-key, chosen-plaintext model and needs 2105 chosen plaintexts — more data than any real system would ever produce under one key. Anthropic's own assessment: "This attack is therefore completely impractical." No deployed system is affected in any way.

The technical contribution is genuine. The baseline is a 2013 result by Derbez, Fouque, and Jean requiring 2105 chosen plaintexts, 299 time, and 290 storage. Anthropic's "Möbius bridge" exploits the invert-then-affine-transform structure of the AES S-box to eliminate one of the nine guessed key bytes, yielding a factor-of-256 reduction in key guesses. After accounting for the cost of computing the transform, the runtime at 2105 data drops to between 289.3 and 291.4. That range is where the research post's "between 200 and 800 times faster" figure comes from.

Note what this does not touch. The paper itself states that since AES was designed nearly thirty years ago, the full cipher has remained robust, with the best single-key attacks — biclique cryptanalysis from 2011 — beating brute force by only about two bits. Anthropic's work does not move that number. It improves an attack on a deliberately weakened teaching version of the cipher.

There is one more caveat that deserves more attention than it will get. The full attack was never run. The paper is explicit: executing it end-to-end "would be computationally intractable," requiring roughly 2105 queries and 289 time and memory. Anthropic instead validated the technique on a small-scale cipher variant and on full AES-128 through a harness using a planted key. That is standard and accepted practice in cryptanalysis — but it means the AES result rests on analysis, while the HAWK result rests on recovered keys. They are not the same grade of evidence, and Anthropic does not conflate them.

The vocabulary is the story

Answer capsule: Anthropic's language is calibrated with unusual care. It writes "improved attack" for HAWK, uses "break" only for the reduced 7-round AES variant, calls that same result "completely impractical," and reserves "practical attack" for a separate 13-round LEA result. Any coverage that transplants the word "break" from the 7-round variant onto AES itself has changed the meaning of the finding.

Three words carry the entire weight of this release, and they are not interchangeable:

• "Improved attack" — used for HAWK. Accurate: an existing attack surface got substantially cheaper.
• "Break" — used once, narrowly: "Mythos found a way to break one such weaker version," referring to the 7-round reduced cipher, immediately after Anthropic explains it deliberately studies weakened variants.
• "Practical" — applied to a different result entirely. Anthropic reports that Mythos Preview "developed a practical attack that can recover a 13-round LEA key in under 230 encrypted plaintexts, and that runs in under an hour on a modern desktop computer." Anthropic notes this work is more recent and less complete.

The LEA finding is arguably the most operationally interesting item in the post and it has received the least attention, precisely because it does not have a famous acronym attached to it.

HAWK has since withdrawn from the NIST process

Answer capsule: NIST's Round 3 page for additional post-quantum signatures now states: "The submission team has withdrawn HAWK from the additional digital signatures standardization process." Anthropic's paper, published July 28, described HAWK as "currently a third-round candidate." NIST publishes no date and no reason for the withdrawal, and we found no statement from the HAWK submission team.

This is the detail that changes the scope of the story, and it cuts both ways.

NIST announced its Round 3 candidates on May 14, 2026, and HAWK was among them as the sole lattice-based scheme. It is still listed on that page, now with a withdrawal notice attached. So the attack did not target an already-discarded candidate — HAWK was a live contender for standardization when the work was done.

What we cannot tell you is whether the attack caused the withdrawal. NIST states no reason. We are not going to infer one. What is on the public record is a remark from Anthropic, quoted by a participant in the pqc-forum discussion, that doubling HAWK's key size "eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate." In the same thread, Bas Westerbaan observed that once parameters are raised, HAWK-1024's combined public key and signature size becomes comparable to ML-DSA-44, which weakens its main selling point.

The practical takeaway for anyone planning a post-quantum migration: HAWK was never standardized, so nobody should have been deploying it. The schemes NIST has actually standardized are unaffected by this work.

The real story: discovery outran verification

Answer capsule: Anthropic quantified something the field has only discussed abstractly. Mythos took about one week to autonomously discover the AES attack; two human researchers then needed nearly a month to gain confidence it was correct. On HAWK, finding, developing, and verifying took roughly 60 hours in total. Discovery has become cheap and fast. Verification has not.

The sentence worth keeping from the entire publication is this one: "Whereas it took just one week for Mythos to autonomously discover the improved attack on AES, it took two researchers nearly a month to gain confidence that the method it discovered is correct."

Anthropic adds that researchers "spent several hundred hours learning enough cryptography research to validate the model's claim," and that during a three-day stretch the model "autonomously produced several hundred million tokens while working on the problem." The HAWK paper's acknowledgements section is equally direct: "The majority of mathematical discoveries in this paper were AI-assisted. Human author contribution mainly consisted of directing, organizing and verifying AI work."

Anthropic's own conclusion generalizes it: "As language models increasingly produce novel research outputs autonomously, human researchers may become bottlenecked on studying and validating these results for technical validity, novelty, and utility."

We have watched this exact pattern form before. When Anthropic published the first Project Glasswing throughput numbers, the finding was not that Mythos discovers vulnerabilities — it was that maintainers could not patch them fast enough, with open-source teams asking Anthropic to slow down. Cryptanalysis is the same shape, one level up the abstraction ladder: the scarce resource is no longer the insight, it is the human attention required to certify the insight.

The cost figure sharpens the point. At roughly $100,000 per result in API spend, a well-funded lab can buy novel cryptanalysis at a price that is trivial next to a security budget. It cannot buy the month of expert attention needed to trust the output.

Who actually checked this work

Answer capsule: Verification so far is mostly internal, plus early independent signals. Anthropic says it followed responsible disclosure and "consulted with academics," without naming them. Stephen Weis credited the HAWK team with verification assistance. On the NIST pqc-forum, Daniel Apon posted "Nice. It checks out independently for me." Neither paper has been peer reviewed.

This matters for how much weight the results should carry today. Both papers are preprints hosted on Anthropic's own domain. They have not gone through peer review, and they are not on arXiv or IACR ePrint where the cryptographic community normally scrutinizes such claims. That is not an accusation — Anthropic published full papers, released reproducible code, and posted to the NIST mailing list, which is considerably more transparent than the norm for AI-generated research claims.

The early community response is real but thin. Daniel Apon's independent check is one data point, posted within hours. In the same thread, Apon called for community standards for adjudicating AI-generated cryptanalytic claims, invoking Scott Aaronson's "Ten Signs a Claimed Mathematical Breakthrough is Wrong," while crediting Anthropic for shipping a clear written paper, expert review before release, and reproducible open-source code. Hengyi Luo separately reported related work in which GPT-5.6 attacked HAWK by a different route, which suggests the underlying weakness is findable by more than one model.

The instrument nobody else can run

Answer capsule: Anthropic published the papers, the reasoning traces, and reproducible attack code. What it has not published is access to the model that produced them. Claude Mythos Preview has been gated since April 2026 behind Project Glasswing partner agreements. The results are checkable; the discovery process is not repeatable by outside researchers.

There is an important distinction to hold here, and it is easy to get wrong in both directions.

The results are reproducible in the way that matters most to cryptography. The HAWK release is described as a single-command pipeline with per-stage checkpoints that verifies its own output. Anyone with a server can run it and see keys fall out. Anthropic even published the model's chain of thought on the AES problem. By the standards of industrial research, this is a generous release.

The instrument is a different question. Mythos Preview is not available through the public Claude API, and Anthropic's July 28 post does not discuss access at all. As we covered when Anthropic first locked Mythos behind Project Glasswing and when it extended access to ENISA, the model reaches a small set of vetted partners. You can check whether Anthropic's answer is right. You cannot independently ask the same question of the same instrument and see what else it says.

That asymmetry is not misconduct, and we are not suggesting it is. Anthropic's stated reason for restricting Mythos has always been that a model this capable at offensive security is dangerous to release broadly, an argument that has drawn direct competitive pushback from OpenAI. But it does leave cryptography in an unfamiliar position: a class of results is now entering the literature from a source the literature cannot query. Peer review was designed to check claims, not to check claims produced by a black box available to one organization.

What would change our assessment

We will revise this analysis if any of the following happens:

• Peer review or ePrint publication. If either paper is submitted to IACR ePrint or a refereed venue and survives scrutiny, the results move from credible preprint to established fact.
• A named external cryptographer publishes a full reproduction. Daniel Apon's "it checks out independently for me" is encouraging, not conclusive. A detailed independent write-up would settle it.
• A stated reason for the HAWK withdrawal. If the submission team or NIST connects the withdrawal to this attack, the story becomes the first standardization candidate removed following AI-discovered cryptanalysis.
• The technique extends past 7 rounds. Anthropic's result stops at 7 of 10. If the Möbius bridge idea reaches 8 or 9 rounds, the conversation about AES changes — though even then, deployed AES would remain far out of reach.

What will not change: nothing here requires you to do anything. If you want a concrete action item, it is the boring correct one — track which post-quantum signature schemes NIST actually standardizes, and do not deploy candidates before they finish the process.

Frequently asked questions

Sources and references

• Anthropic — Discovering cryptographic weaknesses (research post, July 28, 2026)
• HAWK-n Key Recovery Reduces to SVP in Dimension n/2+1 — Zygimantas Straznickas, Stephen A. Weis (Anthropic)
• Cryptanalysis of 7-Round AES via the Algebraic Structure of its S-box — Milad Nasr, Nicholas Carlini (Anthropic)
• AES Möbius Bridge — model chain of thought (Anthropic)
• CryptanalysisBench: Can LLMs do Cryptanalysis? — arXiv, July 20, 2026
• NIST — Round 3 Additional Signatures (HAWK withdrawal notice)
• NIST — Post-Quantum Cryptography: Digital Signature Schemes
• NIST pqc-forum — HAWK-n key recovery discussion thread

Analysis by ThePlanetTools.ai. We did not test Claude Mythos Preview, which is not publicly available; this article is based on Anthropic's published research post, its two technical papers, the CryptanalysisBench preprint, NIST's published candidate status pages, and the public NIST pqc-forum discussion.