Two years of human cryptographers stared at a post-quantum signature scheme called HAWK and concluded it was solid. Then Anthropic pointed an AI model at it, gave it a multi-agent research environment and about 60 hours, and it found a mathematical shortcut nobody had noticed. Not a bug in an implementation — a structural symmetry in the math itself that shaves down the algorithm’s actual security margin. If that sentence makes you slightly uneasy, you’re reading it correctly.
What Claude Mythos actually found in HAWK
HAWK is one of the candidate schemes being evaluated for a post-quantum world — the algorithms meant to keep signatures secure once quantum computers can break the math we currently rely on (RSA, elliptic curve). It’s not yet standardized or deployed anywhere that matters, which is the whole point of evaluating candidates before that happens.
According to Anthropic’s own research writeup, Claude Mythos Preview identified a previously unknown mathematical symmetry inside HAWK and built a new attack around it, working with limited human guidance in a multi-agent setup over roughly 60 hours. The result: HAWK’s effective security margin — the buffer between “theoretically breakable” and “practically breakable” — shrank. Two years of expert human review had missed the same symmetry entirely.
A quick tangent: why “post-quantum” is suddenly everyone’s problem
Here’s the part that makes HAWK’s evaluation matter beyond academic interest. A large enough quantum computer would break the encryption protecting most of today’s internet traffic — but nobody has built one yet, so why is the industry racing to replace algorithms that still work fine? Because of a strategy security researchers call “harvest now, decrypt later”: an adversary can record encrypted traffic today and simply sit on it until a quantum computer capable of breaking it exists, however many years away that is. Anything encrypted today with a breakable algorithm is retroactively exposed the moment that computer switches on. That’s why NIST and its peers have spent years running open competitions — like the one HAWK is a candidate in — to find replacements before the deadline arrives, not after.
The AES shortcut — 200 to 800 times faster
The second finding is arguably the more interesting one for anyone who’s used the phrase “AES is unbreakable” without a footnote. Claude Mythos found a way to attack a deliberately weakened, reduced-round research version of AES — not the full-strength AES protecting your bank login — and eliminated one of the guesses an attacker would otherwise need to make. That single elimination sped up the best previously known attacks against that weakened version by a factor of 200 to 800.
The distinction matters and Anthropic is explicit about it: this is a research variant with fewer rounds than production AES, built specifically so academics have something crackable to practice on. Full AES runs 10, 12, or 14 rounds of scrambling depending on key size; researchers deliberately study 5, 6, or 7-round versions because attacking the full cipher directly has never worked in over two decades of trying, and reduced-round versions are how the field measures how much of a “security margin” the full version still has left. Nobody’s banking session got faster to break. But the technique — an AI finding a genuinely novel mathematical shortcut in an area humans have hammered on for decades — is the actual story, not the specific cipher.
Why this doesn’t mean your data is at risk today
Anthropic’s writeup goes out of its way to say neither result requires any changes to production software. HAWK was never deployed at scale — it’s a candidate under evaluation, and this is exactly the stress-testing candidates are supposed to survive or fail before anyone builds a bank vault around them. The AES work applies to a weakened teaching version of the cipher, not the version protecting anything you use. If you were bracing for a headline about your passwords, you can relax; that’s not what happened here.
What did happen is a demonstration that a general-purpose AI model, given time and a research environment rather than a narrow, purpose-built tool, can independently reproduce — and in one case exceed — the kind of insight that took credentialed cryptographers years to arrive at, or missed outright.
The uncomfortable part: AI crossing into expert research
Security researchers who cover this space have framed it as evidence AI has crossed a line from “doing tasks” to “doing genuine expert-level research.” That’s a bigger claim than “the chatbot is good at coding now,” and it cuts in two directions at once. The optimistic read: AI can now help defenders stress-test cryptographic standards faster than committees of humans working alone, catching weaknesses before deployment rather than after a breach. The uneasy read: the same capability that finds a flaw for a research paper could, in someone else’s hands and without Anthropic’s disclosure norms, find a flaw worth keeping quiet and using instead.
Microsoft made a similar bet on AI for the defensive side of that coin this month — our coverage of Project Perception covers its own agents built specifically to detect AI-driven attacks in real time, which is the same logic applied to a different layer of the stack.
What happens next for post-quantum cryptography
Practically, this doesn’t kill HAWK as a candidate — reduced security margins get factored into parameter choices, not automatic disqualification, and the standards process exists precisely to catch this kind of finding before deployment rather than after. What it does change is the toolkit reviewers use. Expect standards bodies evaluating post-quantum candidates to start running AI-assisted cryptanalysis as a standard step alongside human peer review, the same way code gets both a human reviewer and automated static analysis today.
It’s also a preview of a pattern that’s likely to repeat well beyond cryptography. If a model can spend 60 hours finding what two years of specialists missed in one narrow mathematical domain, the interesting question for 2027 isn’t whether it happens again — it’s which field gets the next surprise. We’ve already written about what researchers found hiding inside Claude’s own internals earlier this year; this is the same theme from a different angle — these systems keep turning up capabilities nobody explicitly built in, discovered after the fact rather than announced in advance.
For now, the honest summary is narrower than the headlines: no production system is weaker today than it was last week. But the two-year gap between “human experts studied this” and “AI found what they missed in 60 hours” is the number worth sitting with.
Leave a Reply