In 2026, an artificial intelligence model discovered in a few hours of cryptographic work what human experts had failed to find in two years of review. Anthropic published details of two major flaws detected by Claude Mythos Preview: one against the post-quantum algorithm HAWK and a new attack technique against reduced-round AES. These results, while theoretical, mark a turning point in cryptanalysis and raise urgent questions about the human capacity to verify AI discoveries.
🔑 Key Takeaways
- Claude Mythos Preview found an attack against HAWK-256, reducing its security from 2^64 to 2^38 operations
- The Möbius Bridge technique accelerates attacks on AES-7 rounds by 200 to 800 times
- Human verification of one AI attack required nearly a month for two cryptographers
- No attack targets production systems today
- The model also broke LEA (13/24 rounds) and Serpent-128 (6/32 rounds)
What Mythos Found
Anthropic published two distinct findings in 2026. The first was an improved attack against HAWK, a post-quantum digital signature scheme that was among the third-round candidates in the National Institute of Standards and Technology’s ongoing effort to standardize algorithms resistant to quantum computers. HAWK’s security rests on the difficulty of a mathematical problem called the Lattice Isomorphism Problem. Mythos found a previously unexploited symmetry — a nontrivial automorphism — in the lattice underlying HAWK. Prior academic work had established that finding such an automorphism would permit an attack, but had not determined whether one actually existed in HAWK’s specific construction.
The practical consequence: the effective keysize of HAWK was halved. The smallest variant, HAWK-256, which had an expected computational cost of 2^64 operations to recover a signing key, could now be broken in approximately 2^38 operations. The attack remains exponential — it does not scale polynomially — but it is fast enough to be concerning for a scheme that was being evaluated for deployment in national security systems.
HAWK: A Compromised Post-Quantum Candidate
The fix, doubling key sizes to restore the original security margin, would eliminate most of HAWK’s competitive advantage as a post-quantum candidate. HAWK’s authors were informed in June 2026, and coordinated disclosure accompanied the public release. This discovery perfectly illustrates how an AI model can explore mathematical spaces that no human expert has managed to cover exhaustively.
| Parameter | Before Mythos | After Mythos |
|---|---|---|
| HAWK-256 cracking cost | 2^64 operations | 2^38 operations |
| Effective security | 128 bits | 76 bits |
| Discovery time | Not found in 2 years | 60 hours |
| Resources used | N/A | 1 researcher, ~60h compute |
The Möbius Bridge Technique Against AES
The second finding was more technically surprising. Mythos developed a new cryptanalytic technique that it called Möbius Bridge — an algorithmic fingerprinting method that eliminates one of the computational guesses an attacker must make when mounting a meet-in-the-middle attack on a reduced-round version of the Advanced Encryption Standard. AES-128 applies ten rounds of a carefully designed round function. The academic exercise of attacking reduced-round variants is a standard way of stress-testing the full cipher.
« The AI is not randomly generating and testing hypotheses. It is making strategic decisions about which lines of attack are worth pursuing, abandoning paths that are mathematically unproductive, and building internal justifications for its emerging strategies. »
Anthropic Report, 2026
Mythos targeted a version with seven rounds, which had been studied before. By removing one of the attacker’s required leaps of intuition, Möbius Bridge improved the speed of the best previous attacks by 200 to 800 times, depending on the measurement methodology. AES-128 applies ten rounds of the carefully designed round function. Attacking reduced-round variants is a standard way of stress-testing the full cipher. The meet-in-the-middle attack is a powerful cryptanalytic technique that divides the breaking process into two parts, significantly reducing complexity. The 200 to 800 times improvement represents a substantial acceleration that, while not threatening full AES, demonstrates deep understanding of the cipher’s internal mechanisms.
No Threat to Current Systems
Neither result affects any system deployed today. HAWK is a candidate in a standardization process, not a deployed protocol. Seven-round AES is not used in any production system. Full ten-round AES remains unbroken. But the intellectual trajectory is what concerns cryptographers: in less than a year, frontier AI models went from failing to find weaknesses in simple ciphers to discovering mathematical properties that human experts had reviewed for years without finding.
The Discovery Process and Agent Disagreement
Both discoveries required substantial computational resources. The HAWK attack took approximately 60 hours of semi-autonomous work by a single Anthropic researcher using Mythos in an agentic harness — a scaffolding system derived from Claude Code that allows multiple AI agents to work in parallel within an isolated environment. The researcher was not a specialist in lattice-based cryptography; his role was project management rather than technical direction. The breakthrough ideas came from the model, informed by an extensive literature review and computational experimentation.
A notable detail of the HAWK discovery was the role of agent disagreement. Two agents working in parallel were tasked with exploring the same mathematical territory. The first agent dismissed a particular line of inquiry as impractical. The second agent found a way to make it work. The productive attack emerged from the dialogue between them, not from either agent alone. This pattern — where contradictory AI agents producing a better result than either individually — has been observed in other domains but is particularly significant in cryptanalysis, where a single wrong assumption can send a researcher down an unproductive path for months.
« The first agent dismissed this line of inquiry as impractical. The second agent found a way to make it work. The productive attack emerged from the dialogue between them. »
Anthropic Document, 2026
The AES Discovery: Three Major Iterations
The AES result was different in character. Mythos initially refused to engage with the problem, declaring in early sessions that improving known attacks on AES was essentially impossible — a reasonable prior given that AES has been scrutinized more intensively than almost any other encryption algorithm in history. The human researcher had to explicitly instruct the model to stop treating its own hesitation as a binding constraint and to attempt novel approaches. Claude then rewrote its own research harness to explore attack strategies that it had not previously considered.
Three substantial iterations followed. The model produced several hundred million output tokens over three days before finding Möbius Bridge, and approximately one billion tokens total before the attack was ready for publication. Each of the two results cost roughly $100,000 in API compute to develop. This cost, while significant, is rapidly becoming accessible to well-funded organizations, whether nation-states or large corporations.
The Verification Bottleneck
The most immediate consequence of these results is not about algorithms. It is about people. When Mythos found the AES attack in approximately one week of quasi-autonomous work, two human cryptographers required nearly a month to convince themselves of its validity. The verification process demanded several hundred hours of work and involved the researchers having to develop enough expertise in the specific attack methodology to assess whether the mathematical steps were sound. They were, ultimately, convinced.
| Attack | AI Discovery Time | Human Verification Time | Ratio |
|---|---|---|---|
| HAWK automorphism | 60 hours | ~400 hours | 1:7 |
| Möbius Bridge AES-7 | ~170 hours | ~480 hours | 1:3 |
| LEA broken (13 rounds) | <1 hour | ~80 hours | 1:80 |
This asymmetry is not a temporary artifact of a particular model’s limitations. It is a structural feature of the situation. The pool of cryptographers capable of independently verifying a novel attack on a mathematical cryptographic scheme is very small. The pool of cryptographers who can do it quickly is smaller still. Meanwhile, the compute and scaffolding required to allow an AI model to generate candidate attacks is becoming cheaper and more accessible.
Other Algorithms Attacked
Anthropic has already extended the work. Using the same methodology, Mythos has also produced results against several other cryptographic algorithms. It recovered a key for LEA — a lightweight block cipher standardized by ISO for use in constrained environments — in under an hour on a desktop computer, breaking 13 rounds of a 24-round cipher. It broke 6 rounds of Serpent-128, which has 32 rounds, with more modest improvements of under 10x on Salsa20, Poseidon, and SHA-1. These results are individually less dramatic than the HAWK or AES findings, but their existence illustrates the pace at which AI-assisted cryptanalysis is advancing.
AISI Evaluation: Cyber Capability Profile
The cryptographic findings are not isolated. They emerged from a model whose broader cybersecurity capabilities have been independently evaluated by the AI Security Institute, the UK’s primary agency for assessing frontier AI risk. AISI’s results, published in April 2026, show a model that represents a meaningful step change from its predecessors.
On capture-the-flag challenges — standardized security competitions where participants find and exploit vulnerabilities in isolated systems — Mythos Preview achieved a 73% success rate on expert-level tasks that no previous model had been able to complete. This was not marginal improvement. Two years earlier, the best available models struggled with beginner-level CTFs. The progression to expert-level performance happened across a handful of model generations in less than 24 months.
« On expert-level capture-the-flag challenges, Mythos achieved a 73% success rate. Two years earlier, the best models struggled with beginner level. »
AI Security Institute, April 2026
The Last Ones: Network Attack Simulation
AISI also tested Mythos on a simulation called The Last Ones: a 32-step corporate network attack that the institute estimates would take a human expert approximately 20 hours to complete from initial reconnaissance to full network takeover. Mythos completed the entire chain in 3 out of 10 attempts. Across all runs, it averaged 22 steps completed. The next-best model, Claude Opus 4.6, averaged 16 steps. Performance continued to improve with increased token budgets up to the 100 million token limit of the evaluation — meaning the model had not reached a ceiling.
These results come with important caveats. AISI’s ranges lack active defenders, real-time security monitoring, and the response procedures that would be present in a real corporate environment. They do not measure what Mythos would do against hardened production systems with active security teams. But they establish a clear directional finding: autonomous vulnerability discovery and exploitation at a level that would take skilled humans days of work is now within reach for a model that can be given network access and directed to find and exploit weaknesses.
Implications for Cryptography and Blockchains
The NIST post-quantum cryptography standardization process was designed to identify and eliminate weaknesses before algorithms are deployed. The timeline for that process — multiple rounds of expert review spanning years — assumes that human specialists are the primary mechanism of adversarial review. AI changes the cost structure of that review in ways that the current process was not designed to accommodate.
The HAWK result illustrates this precisely. Two years of expert human review had not found the automorphism that Mythos identified in 60 hours. The prior academic literature had established that if such an automorphism existed, an attack would follow. What it had not established was whether the automorphism was actually present in HAWK’s construction. That question required someone to either find the symmetry or prove it did not exist — a task that required specific mathematical reasoning about a particular lattice, combined with extensive computational experimentation.
No Immediate Threat to Cryptocurrencies
For the cryptocurrency ecosystem specifically, the immediate implications are limited. ECDSA, the signature scheme used by Bitcoin and most blockchains, is not affected by the HAWK result — HAWK is a candidate algorithm, not a deployed one, and the attack on HAWK does not apply to ECDSA. Full-round AES remains unbroken, and AES-256 is the standard for most encryption in financial infrastructure. There is no current threat to the cryptographic foundations of any blockchain protocol.
The longer-term concern is subtler. The post-quantum migration for blockchain systems is already underway — several protocols have begun the process of integrating quantum-resistant signature schemes, aware that a sufficiently powerful quantum computer would break ECDSA. If AI-assisted cryptanalysis accelerates the discovery of weaknesses in post-quantum candidates before they are standardized and deployed, the result could be a cleaner set of algorithms making it into production. If it accelerates the discovery of weaknesses after deployment has begun, the transition could be more turbulent.
The Responsible Disclosure Question
Anthropic followed coordinated disclosure procedures for both findings. The HAWK attack was shared with the algorithm’s authors in June and with US government and industry partners before public release. The company has also built a cryptographic commitment scheme into its research workflow: before public disclosure, Anthropic generates a SHA-3 hash of any exploit payload and publishes that fingerprint. SHA-3 is a one-way function, meaning the hash proves that Anthropic possessed a working exploit at a specific earlier date without revealing the exploit itself.
« SHA-3 is a one-way function: the hash proves Anthropic possessed a working exploit at a specific earlier date without revealing the exploit itself. Once a vendor patches a vulnerability, Anthropic can then publish the full details and prove continuity of possession. »
Anthropic, Disclosure Policy
The harder question is the one Anthropic has explicitly flagged for broader discussion: what happens the day a frontier model finds a vulnerability in a system that is actually in production, where the disclosure timeline is not measured in weeks but in hours, and where the potential for real-world harm is immediate? The company has argued that this question requires input from academia, government, and industry, and has called for an industry-wide conversation about norms and procedures. That conversation has not yet happened in any structured form.
There is also the question of what happens when the same capabilities are available to actors who do not share Anthropic’s commitment to coordinated disclosure. The techniques required to build an AI-assisted cryptanalysis pipeline are not uniquely available to Anthropic. If a frontier model with comparable capabilities were deployed by a nation-state adversary, a criminal organization, or any other actor with different norms around vulnerability disclosure, the absence of established international protocols for AI-assisted cryptanalytic discoveries would become a significant gap in the global security architecture.
Conclusion: Toward a New Equilibrium
What Anthropic published in 2026 is not a single result. It is a demonstration that the cryptanalytic capability of frontier AI models has crossed a threshold. The exact threshold — whether it is the ability to find weaknesses that human experts missed, or simply the ability to find them faster and cheaper — matters less than the directional finding: AI models are now producing cryptographic research that is novel, valid, and not trivially reproducible by the human experts who are being asked to verify it.
The field of cryptography has always been adversarial. Ciphers are proposed with the expectation that smart people will try to break them, and the security of a system is established by the extent to which it survives that adversarial process. AI adds a new participant in that process — one that never gets tired, can explore thousands of attack strategies in parallel, and can produce novel mathematical results at a cost that is falling rapidly. The verification bottleneck that Anthropic’s researchers encountered is, for now, the primary limiting factor on the harm that could come from this capability. Human cryptographers remain the authority on whether a mathematical attack is sound. But that authority is being tested in ways it was not designed to handle, and the gap between AI-generated cryptanalysis and human verification capacity is widening.
The question for the next several years is not whether AI will continue to find cryptographic weaknesses. It will. The question is whether the institutions that govern how those weaknesses are disclosed, patched, and compensated will evolve quickly enough to prevent the acceleration of AI-assisted cryptanalysis from becoming a net drag on the security of global communications infrastructure.
Sources
- Anthropic – Discovering cryptographic weaknesses with Claude (2026)
- AI Security Institute – Our evaluation of Claude Mythos Preview’s cyber capabilities (April 2026)
- FireCompass – Demystifying Claude Mythos Preview (2026)
- CoinAcademy – Anthropic Claude Mythos Preview trouve des attaques cryptographiques (July 2026)
- IACR Cryptology ePrint – Current trends in AI-Aided Cryptography (May 2026)
- Arxiv – Securing Cryptography in the Age of Quantum Computing (2026)
This article is published for informational and educational purposes only. It does not constitute investment advice in any way. Do your own research (DYOR) before making any decisions.
