Claude Mythos vs. HAWK and AES: What It Found

Status as of July 30, 2026: both findings are confirmed by Anthropic's own published papers and demonstration code. Neither affects any software running in production today. HAWK is a NIST candidate that hasn't been deployed anywhere, and the AES result only breaks a deliberately weakened 7-round version of the cipher, not the 10-round AES-128 that actually protects your traffic.

Anthropic published two cryptography papers on July 28 with a headline finding that's genuinely worth sitting with: Claude Mythos Preview found a mathematical weakness in a NIST post-quantum signature candidate that survived two years of expert human review, and separately invented a new attack technique against reduced-round AES that nobody had published in over a decade of people trying. Neither result breaks anything you're running right now. Both results are worth understanding anyway, because the interesting part isn't the crypto, it's what the discovery process looked like, and what it implies about the gap between "AI can find bugs" and "AI can do the kind of research that used to take a research group years."

The two numbers that matter

HAWK-256's expected key-recovery cost dropped from 2^64 operations to 2^38. That's not a typo-sized difference, 2^38 is roughly 274 billion times weaker than 2^64. HAWK is a lattice-based digital signature scheme in the third round of NIST's post-quantum cryptography standardization process, the multi-year public effort to pick signature and encryption algorithms that will still be secure once large quantum computers exist. Mythos found a previously unexploited symmetry in HAWK's lattice structure, called a nontrivial automorphism, that a 2025 academic paper had proven could enable a faster attack if it existed, without anyone establishing that it actually did in HAWK's specific design. Mythos showed it does.

The AES attack got 200-800x faster than the previous best published technique, which itself hadn't meaningfully improved since 2013. This attack only works against a deliberately hobbled 7-round version of AES-128 (the real cipher runs 10 rounds), a version cryptographers study specifically because attacking it teaches you something about how much safety margin the full cipher has left. Mythos invented a new mathematical trick it called a "Möbius Bridge" that eliminates one of the guesses the previous best attack had to make, cutting that part of the work by a factor of 256.

Neither attack runs in anything close to practical time. The AES attack alone would cost hundreds of millions of dollars to actually carry out, even at 800x faster than before. That's the whole point of studying reduced-round variants: you're measuring how much of the cipher's safety margin is left, not building something you'd actually run.

Why this is a different category of finding than a CVE

CoderOasis covers a lot of CVEs, real vulnerabilities in real deployed software, patch status, exploit paths, mitigation steps. This isn't that, and the distinction matters.

Anthropic's own Mythos Preview has previously found and disclosed real implementation bugs, coding mistakes in how developers used cryptographic algorithms, including vulnerabilities in OpenSSL and wolfSSL that got assigned actual CVE numbers. Those are bugs in how the algorithm got written into code. This new work is different in kind: Mythos found mathematical flaws in the algorithms themselves, the kind of weakness that exists in the design on paper, independent of any particular implementation. A perfect, bug-free implementation of HAWK as originally specified is still weaker than its authors believed. That's a research finding about cryptographic design, not a patchable software bug, and there's nothing to apt upgrade your way out of.

We recommend reading CVE-2026-31431: Full Vulnerability Breakdown [VERIFY URL] to continue reading our selection of content. For the kind of finding you actually need to patch against, our deep dive on a real deployed vulnerability draws the contrast this research finding doesn't.

The HAWK attack, in more detail

HAWK's security rests on the hardness of something called the Lattice Isomorphism Problem, a hard-to-solve math problem involving high-dimensional lattices that's believed to resist attacks from both classical and quantum computers. Working with an Anthropic researcher over roughly a week, Mythos found a specific automorphism, a structural symmetry, hiding in the lattice HAWK actually uses. Prior theoretical work had shown that this kind of symmetry, if it existed, would let an attacker enumerate possible keys faster than expected. Nobody had shown one actually existed in HAWK until Mythos found it.

The practical result: the attack is still exponential, not polynomial, meaning it still gets dramatically harder as key size grows, and larger HAWK keys remain impractical to break with this technique. But the specific key sizes HAWK's own submission proposed are now known to offer roughly half the security margin their authors claimed. Fixing this means doubling the key size, which erases much of what made HAWK an attractive, compact post-quantum candidate in the first place.

The discovery process is worth understanding on its own terms. Anthropic used a Claude Code-style harness running multiple worker agents in a sandboxed environment, each with access to Python, Sage, and published cryptography papers. The human researcher involved had a theoretical computer science background but wasn't a lattice cryptography specialist, and mostly provided project-management-level guidance rather than technical direction. The key insight came from two worker agents independently investigating the same idea: one dismissed it as infeasible, the other found a way to make it work, and the two kept exchanging findings until they converged on a working attack. Total time: about 60 hours. Total API cost: roughly $100,000.

This isn't NIST's process failing. The entire point of a multi-year public standardization process is to surface exactly this kind of flaw before a scheme gets deployed anywhere that matters. It's happened before: during the standardization of ML-KEM and ML-DSA, another candidate called SIKE turned out to be completely breakable in about an hour on a single laptop, discovered late in that process too. Anthropic disclosed the HAWK finding responsibly, sharing it with HAWK's authors in June and coordinating public release with NIST's mailing list.

The AES attack, and the part that actually surprised us

The technical mechanism is a refinement of a well-established approach called a meet-in-the-middle attack, which trades computation time for memory by precomputing and storing intermediate results in a lookup table rather than recalculating them from scratch. The previous best published attack on 7-round AES-128 had to enumerate 256 separate values and check each one against that table. Mythos's Möbius Bridge technique constructs a fingerprint that doesn't depend on that guess at all, cutting that part of the workload by exactly a factor of 256, before stacking several more optimizations on top to reach the full 200-800x improvement.

What actually makes this result notable isn't the math, it's how Anthropic got there. When the researcher first pointed Claude at the problem, it refused to meaningfully engage, insisting the problem was already too well-studied for there to be anything left to find. Getting past that took a researcher's blunt, informally-worded prompt about how models tend to think a hard problem is unsolvable so they don't try. That single nudge was enough: Claude rewrote its own experimental setup to search for genuinely novel approaches, which produced a smaller improvement on 6-round AES within hours. Pushed further, over the next three days and with only three more brief prompts from a human, Claude produced several hundred million tokens of autonomous research before landing on the Möbius Bridge idea, then kept refining the attack across roughly a billion total output tokens until it matched what's now published in the paper.

Anthropic's researchers, who describe themselves as not being cryptography experts, then spent several hundred hours validating that the result was actually correct before publishing. That validation gap, weeks of human effort to check work a model produced in days, is arguably the more important number in this whole story than either 2^38 or 800x.

The results that got less attention but might matter more

Two headline findings get the press coverage. Three smaller ones tucked into the same research post are worth knowing about, especially one of them.

LEA (Lightweight Encryption Algorithm), an ISO-standardized cipher built for low-power and resource-constrained devices, runs 24 rounds in full. Mythos developed a practical attack against a 13-round reduced version that recovers a full key using under 2^30 encrypted plaintexts, and runs in under an hour on an ordinary desktop computer. Unlike the HAWK and AES results, this one is fully end-to-end verifiable: pick a random key, run the attack, confirm it recovers the right key, every time. That reproducibility is why Anthropic says they trust this result more than the AES finding, even though it's gotten far less news coverage. It's still limited to the reduced-round version, the full 24-round cipher is untouched, but it's the cleanest demonstration in the whole research post that this isn't a fluke.

Serpent-128, a 32-round cipher, saw a full key-recovery attack against a 6-round reduced version, extending previously published academic work that needed more data and more computation to pull off the same result. And smaller, sub-10x improvements landed against the Salsa20 stream cipher, the Poseidon hash function, and SHA-1, modest by comparison, but the kind of incremental progress that accumulates.

We recommend reading JDK 27 New Features Explained: What Actually Changes to continue reading our selection of content. If post-quantum cryptography timelines affect anything in your stack, our JDK 27 piece covers the hybrid TLS key exchange landing in JEP 527, worth reading alongside this.

What Anthropic itself is worried about

Buried near the end of the research post is the line that matters most for anyone thinking about where this goes next. Anthropic explicitly frames both of these results as expected, HAWK getting stress-tested is the standardization process working as designed, and the AES result extends decades of academic work rather than inventing a new category of attack. Their actual concern is forward-looking: what happens the first time a model finds this kind of flaw in a cryptosystem that's already deployed and load-bearing, not a candidate standard or a deliberately weakened research variant?

That question doesn't have an answer yet, and Anthropic says as much, framing it as something that needs input from academia, government, and industry before it becomes urgent rather than after. They're hosting an academic workshop on the topic in the coming weeks and released a benchmark, built with researchers from ETH Zurich, Tel Aviv University, and TU Berlin, specifically to track how fast this capability is moving across different models over time.

It's also not an isolated data point. In the same window of months, Google's Gemini resolved several previously open Erdős problems, OpenAI's models resolved a genuine open conjecture in discrete geometry, and Anthropic's own Claude Fable 5 reportedly resolved the Jacobian Conjecture. Frontier models doing research-level mathematics is becoming a pattern across multiple labs, not a one-off headline, and cryptanalysis is turning out to be one of the domains where that capability translates most directly into something security teams have to think about.

The actual takeaway, without the hype

If you run production infrastructure, there's nothing to patch this week. HAWK isn't deployed anywhere that matters yet, and the AES result doesn't touch the cipher protecting your TLS connections right now. File this under "worth knowing," not "worth an incident."

The more useful takeaway is about pace, not this specific finding. The gap between "a model can find implementation bugs" and "a model can do research-level cryptanalysis that took human experts years to miss" closed faster than most people watching this space expected. If you're tracking post-quantum migration timelines for your own infrastructure, and if you followed our JDK 27 coverage you already know PQC-related changes are already landing in mainstream language runtimes, this is a useful reminder that the standardization process is still genuinely adversarial and still capable of moving under you before final algorithms are locked in. That's a reason to keep an eye on NIST's PQC announcements over the next year, not a reason to change anything today.

The validation bottleneck is the part worth remembering longest. Anthropic's own researchers took weeks to confirm what a model produced in days. As this capability spreads beyond one lab, the constraint on cryptographic security research stops being "can anyone find the flaw" and starts being "can anyone verify it fast enough to matter." That's a genuinely new problem, and it's not one more compute solves.