Claude Mythos cut HAWK post-quantum signature strength in half in 60 hours

Anthropic reports that Claude Mythos Preview found a mathematical weakness in the post-quantum signature candidate HAWK and improved an attack on reduced-round AES. HAWK is still in NIST's additional digital signatures process for quantum-resistant schemes. AES remains the workhorse symmetric cipher, but the result targets a 7-of-10-round variant, not full AES-128.

On HAWK, the lab says effective key strength roughly halves: for HAWK-256, estimated full key-recovery cost drops from 2⁶⁴ to 2³⁸. On AES, Mythos removes one attacker guess and speeds prior best attacks on the reduced variant by 200 to 800×. Anthropic and Simon Willison both stress that neither result has practical impact on today's systems. HAWK is not a deployed standard, and the AES work does not break the full cipher.

The run took about 60 hours of agentic work and an estimated $100,000 in API cost per headline result. Humans mostly pushed the model not to quit and to chase something worth publishing. Willison's link post highlights the raw, typo-filled prompts. The package also ships CryptanalysisBench with ETH Zurich, Tel Aviv University, and University of Haifa, plus a demo repo.

The model is no longer only hunting library bugs, but cracks in the scheme math

Earlier Mythos demos mostly broke implementations of crypto libraries. Here the lab claims a move into flaws in the algorithms themselves: a lattice symmetry in HAWK (a nontrivial automorphism) that speeds enumeration, and a better path against reduced-round AES under a classic chosen-plaintext model.

For NIST-style standardization that adds a new kind of reviewer. HAWK survived about two years and two rounds of human expert scrutiny. With a harness, Sage/Python tools, and literature access, the model compressed review, experiments, and a verification pipeline into days. Humans and peer review still own the final stamp. What changes is how fast a late-stage candidate can get a red card.

Teams writing PQC standards now need an AI reviewer in the budget

For cryptographers, security research groups, and anyone mid post-quantum migration, the practical point is blunt. A design that looked attractive because of smaller keys can lose exactly that edge after AI review: doubling HAWK key sizes, Anthropic says, would erase much of what made the scheme appealing. Designers and national labs will have to budget agentic runs, not only conference deadlines.

For vendors shipping TLS, signatures, and HSMs, this is not an emergency patch cycle. It is a roadmap signal: AI-assisted cryptanalysis is becoming a cheaper stress test before deployment. If you wait only on the human community, a lab with a large inference budget may find the weakness first.

A publishable attack is not the same as broken online banking

The ceiling is real. The HAWK-256 attack stays exponential, not polynomial, and remains impractical on larger parameters. The AES result lives in an academic regime that starts from absurd chosen-plaintext budgets such as 2¹⁰⁵. Without that framing, "AI broke AES" is marketing fiction.

The second ceiling is process. $100,000 and a week of human project management is not "click to wreck NIST". It is directed research with disclosure to HAWK authors, government partners, and the public mailing list. The capability sits inside a lab with Mythos Preview, not as a free script for every script kiddie.

CryptanalysisBench uptake and the next PQC candidates will show if this was a one-off ace

Watch three signals. First, whether CryptanalysisBench gets used outside Anthropic and whether results reproduce under foreign harnesses. Second, whether similar runs hit other NIST candidates and fuller AES variants, or stay on publishable but non-deployed targets. Third, how fast national labs and the open PQC community make AI review a required layer before the next standardization round.

If the benchmark and follow-up attacks live beyond the vendor blog, this stops being a story about a clever model and becomes a new baseline for trust in cryptographic designs.

Lilith's verdict

Mythos is not playing bank cracker here. It is playing reviewer: for the price of a junior team it can stress a signature design before the human NIST queue finishes ripening it.