- Anthropic reports that an unreleased model, Claude Mythos Preview, cut the security of the HAWK signature scheme from 2^64 to 2^38 units of work, after roughly 60 hours and about $100,000 of API spend.
- The second result attacks AES-128 reduced to 7 of its 10 rounds, running 200 to 800 times faster than the previous best attack. Full AES is not affected.
- Neither finding touches a system you use today. HAWK is a NIST round 3 candidate that nobody has deployed, and the AES work stops well short of the real cipher.
- The companion benchmark, CryptanalysisBench, puts the one headline result in a population: 191 tasks, five frontier models, and a 65% to 86% hit rate on schemes that were already known to be broken.
- The expensive part was not the discovery. Researchers spent several hundred hours checking the model's output, and a chunk of the prompting was spent talking the model out of giving up.
- The economic signal matters more than the mathematical one: a piece of cryptanalysis that survived two years of expert review became a $100,000 line item.
On 28 July 2026 Anthropic published a result that reads, in the headline, like the end of encryption, and in the body, like a careful research note with two asterisks attached. Its Frontier Red Team wrote up two cryptanalytic findings produced by Claude Mythos Preview, a model that is not generally available. One weakens HAWK, a post-quantum digital signature candidate. The other improves an attack on a deliberately weakened version of AES, the symmetric cipher that encrypts most of the traffic on the open web.
Both results are real. Neither one changes anything about the security of a system running in production tonight. Holding those two sentences together at once is the whole story, and it is where most of the coverage fell apart.
What did Claude Mythos actually find?
The HAWK result is the sharper of the two. HAWK is a lattice based signature scheme, one of nine candidates NIST advanced to round 3 of its additional signatures process in May 2026, and the only lattice scheme left in that group. The model located a nontrivial automorphism in the underlying lattice that nobody had previously known how to exploit. Applied to HAWK-256, the parameter set aimed at 2^64 units of attacker work, the new attack brings that down to roughly 2^38.
That is a factor of about 67 million. It is also still exponential, so nobody is forging signatures on a laptop. But 2^38 is inside the range that a well funded attacker with patience can contemplate, and it is a long way below what the designers promised. The scheme had been sitting in public view under expert scrutiny for more than two years before the automorphism surfaced.
The AES result is more constrained and, in a sense, more interesting as a demonstration of process. Full AES-128 runs 10 rounds. Cryptanalysts routinely attack cut down versions to measure how much margin the real cipher has. The model produced a fingerprinting technique that Anthropic named the Möbius Bridge, and applied it to a 7 round variant under a chosen plaintext model that assumes access to 2^105 plaintexts. Against the previous best published attack on that variant, it runs 200 to 800 times faster, and it removes a 2^56 guessing step. Some configurations finish in under an hour on an ordinary desktop.
Anthropic also lists smaller wins that got less attention: a 13 round attack on the LEA cipher needing fewer than 2^30 plaintexts, a full key recovery on 6 round Serpent-128, and modest improvements against Salsa20, Poseidon and SHA-1.
| Target | What was attacked | Reported gain | Effect on live systems |
|---|---|---|---|
| HAWK-256 | Full scheme, lattice automorphism | Security 2^64 down to about 2^38 | None. Not standardised, not deployed. |
| AES-128 | 7 rounds of 10, chosen plaintext | 200x to 800x faster than prior best | None. Full 10 round AES untouched. |
| LEA | 13 rounds, under 2^30 plaintexts | Practical demonstration | Marginal. Reduced round only. |
| Serpent-128 | 6 rounds, full key recovery | Complete break of the variant | None. Serpent uses 32 rounds. |
| SHA-1, Salsa20, Poseidon | Assorted | Limited improvements | None reported. |
Does this break the encryption protecting the web?
No, and the gap is not a close call. The AES attack works on 7 rounds. Every browser, every disk encryption tool and every TLS session you opened today uses 10. Those three extra rounds are precisely the safety margin the design exists to provide, and the whole point of publishing reduced round attacks is to watch that margin shrink slowly over decades.
The threat model is the second wall. A chosen plaintext attack assumes the attacker can feed arbitrary blocks into the cipher and read the output, 2^105 of them in this case. Commenters on the Hacker News thread about the paper were quick to point out that modern modes of operation such as AES-GCM are built to make that scenario meaningless in practice. One reader, posting as adrian_b, argued flatly that chosen plaintext attacks of this shape are no longer realistic against real deployments.
Anthropic says this itself, without hedging, which is worth crediting. The gap is between what the company wrote and how the result travelled. As another commenter noted, the write up opens by naming AES as the most widely used symmetric cipher and only later states that neither result has practical impact today. Both sentences are true. Only one of them made it into most headlines.
If you are trying to work out whether to act on a cryptography headline, the question to ask is not how clever the attack is. It is how many rounds, what the attacker is assumed to control, and whether the algorithm is deployed anywhere. All three answers here point the same way.
Why does the HAWK result matter more than the AES one?
Because HAWK is still choosable. It has not been standardised, it has not shipped, and it sits in a NIST evaluation round that is expected to run about two more years. A weakness found now costs a parameter adjustment or a withdrawal. The same weakness found in 2031, after HAWK is embedded in firmware and certificate chains, costs a migration measured in a decade.
This is the argument for doing this kind of work at all, and it is stronger than the demo value. Post-quantum schemes are young. They have had far less cumulative human attention than AES has absorbed since 2001. If a model can compress two years of unfound cryptanalysis into 60 hours, the right place to point it is exactly at the candidates that are still under review.
Anthropic says it shared the HAWK finding with the scheme's authors in June and coordinated through the NIST mailing list before publishing, which is the disclosure path you would want. It also consulted outside academics and briefed government and industry partners in advance.
There is a second reason the distinction is worth labouring. Reduced round attacks on AES have accumulated slowly for two decades and none of them has ever threatened the deployed cipher, so the field has a well worn habit of reading them calmly. Post-quantum candidates have no such history. Nobody has a settled intuition for how much margin a scheme like HAWK ought to have, which means a single result carries more weight than it would against a mature primitive, in both directions. It can look alarming when it is routine, and it can look routine when it is genuinely serious.
How much human work did this take?
Less than you would guess on the way in, and much more than you would guess on the way out.
The HAWK project was run by a single researcher with a theoretical computer science background who was not a lattice cryptography specialist. The AES work consumed roughly a billion output tokens over three days, and Anthropic reports the human contribution during that stretch amounted to about three substantive prompts. On raw discovery time, this is a small operation.
Verification is where the bill came due. Researchers put in several hundred hours, part of it spent learning enough cryptography to judge whether what they were reading was correct. A model that produces a plausible looking attack every few hours is only useful if somebody can tell the plausible ones from the true ones, and that skill did not get any cheaper.
The prompts themselves are the detail Simon Willison picked out as the best part of the release, and he is right. Anthropic published them with the typos left in. A recurring theme is the researcher pushing the model past its own defeatism, with lines to the effect that the models tend to assume the problem is impossible and therefore do not try. Another nudges it away from low hanging fruit and toward something worth publishing.
Anyone who has run a long agent loop will recognise that failure mode. It is not a cryptography problem, it is a scaffolding problem, and it is the same one that shows up when an agent loop replaces a single carefully written prompt: the model needs a reason to keep going, and a stop condition that is not simply its own opinion of the difficulty.
What does CryptanalysisBench add?
Context, which the single headline result badly needed. Eight days before the blog post, a team from Anthropic, ETH Zurich, Tel Aviv University and the University of Haifa put CryptanalysisBench on arXiv. The author list includes Nicholas Carlini, Florian Tramèr, Orr Dunkelman and Eyal Ronen, names that carry weight in exactly this field.
The benchmark holds 191 tasks across six families of cryptographic primitives, drawn mostly from four NIST standardisation competitions, and splits them into three tiers: primitives with known practical breaks, primitives with no known break evaluated both at full strength and scaled down, and a challenge set of production primitives at the current research frontier.
Five models were run against it: Claude Opus 4.8, Sonnet 5, Mythos 5, GPT 5.5, and the open weights GLM 5.2. They broke between 65% and 86% of tier 1 schemes, the ones already known to fall. At full strength on tier 2 they managed 6 to 12 schemes, and 24 to 61 across the scaled down variants. The paper also records novel output, including a key recovery attack exploiting a design flaw in the SpoC authenticated cipher and an error in KINDI's published security proof. The code sits in a public repository at the ETH SPY Lab benchmark repo.
Put the two documents side by side and the shape changes. The HAWK finding is not a lucky strike from a magic box. It is the top of a distribution where models routinely reproduce known attacks, occasionally find new ones on weakened variants, and rarely but genuinely land something novel on a live candidate. Presenting the rare event without the distribution is what turns a good result into an overclaim, and the benchmark is the honest half of the release. Anyone tracking how agent benchmark scores move with the compute you spend on them will find the tier structure familiar.
Where do cryptographers push back?
On the word "unknown", mostly. In the Hacker News discussion, a commenter posting as Diogenesian made the sharpest version of the objection: the theoretical possibility of an exploitable automorphism in this family was already understood. What the model supplied was a concrete instance. That is a real contribution and a genuinely hard search problem, and it is also a different claim from finding a weakness nobody had conceived of.
Read that way, the result says something more specific and more useful than "AI does cryptography now". It says these models are strong at converting an abstract possibility into a worked counterexample, which is a searching task with a verifiable answer. That is the same shape as the tasks they already do well: enormous candidate spaces, cheap local checks, expensive global insight.
Another commenter, Retr0id, drew the line most people should carry away. The AES headline is the attention getter and the least consequential piece. The HAWK finding is quieter and matters more, exactly because the scheme has not been standardised yet.
What this changes for people building with models
The mathematical result will be absorbed by the cryptography community over the next year. The economic result is the one that lands sooner.
Anthropic has published a price for a class of research that used to have no price at all. Sixty hours and about $100,000 produced an attack that two years of unpaid expert attention did not. That number is small enough to sit inside a security budget and large enough that it will not be spent casually. Every organisation that maintains a cryptographic primitive now has a number to compare against the cost of not looking.
The uncomfortable corollary is that the same number is available to people who will not publish what they find, and who face no disclosure norms at all. Anthropic went to the HAWK authors and to NIST. A different actor with the same budget does neither. The defensive answer is not to hope the capability stays scarce, it is to point it at your own primitives first, which is roughly the argument the same team has been making about what coding agents can be talked into doing when nobody is auditing them.
There is a narrower lesson for anyone running long jobs against a model. Almost every reported failure here was a failure of persistence rather than capability. The model concluded the problem was too hard and stopped. A human overrode that judgement and it kept going. If you are building anything that runs unattended, the thing to design carefully is not the prompt that starts the run, it is the condition under which the run is allowed to declare defeat. We wrote about that trade off when comparing how a tool server changes what an assistant can reach, and it applies with more force the longer the loop runs.
MaShop's own position on this is unglamorous and unchanged: we publish how the platform handles customer data and model access rather than asking anyone to take it on faith, because the interesting question about any AI security claim is always what you can check.
What should you watch next?
Three things, in order of how soon they will tell you something.
First, whether the HAWK team publishes a parameter revision or the scheme is withdrawn from round 3. NIST's next standardisation conference is scheduled for the first half of 2027, and the response will be visible on the public mailing list well before that.
Second, whether independent cryptographers reproduce the Möbius Bridge technique and confirm the 200x to 800x figure. Anthropic's own researchers were not lattice or symmetric cryptanalysis specialists, and the field's normal correction mechanism has not run yet.
Third, whether the CryptanalysisBench numbers move when the next model generation is tested. A benchmark published in July 2026 with a 65% to 86% tier 1 rate is a baseline. If that figure jumps on tier 2 full strength schemes within two releases, the argument about whether this is a search tool or a research collaborator will settle itself without anybody needing to write another blog post about it.
Until then, the accurate summary is narrow and still notable. A model found something true and new about a cryptographic scheme that people had been staring at for two years. It did not break anything you use. Both halves are the story.