On July 28, 2026, Anthropic published a disclosure that should have been a four-alarm emergency for cybersecurity: Claude Mythos Preview had identified a structural weakness in a NIST post-quantum cryptographic candidate that had survived two years of expert review, and had simultaneously improved the best-known attack on a research variant of AES-128 — all for roughly $100,000 in compute. The coverage that followed swung between existential panic and casual dismissal, both postures equally distant from the actual situation. The central question is not whether post-quantum cryptography is « broken » — it is not. The question is whether the institutions tasked with verifying and responding to this type of discovery can operate at the speed at which AI-assisted cryptanalysis is now capable of producing them.
🔑 Key Takeaways
- Claude Mythos Preview identified a structural weakness in HAWK, a NIST post-quantum cryptographic candidate, in approximately 60 to 100 hours of compute.
- The attack reduces HAWK-256 key recovery complexity from 2^64 to 2^38 operations — a factor of roughly 67 million.
- Full AES-128 (10 rounds) is unaffected: the finding targets a 7-round research variant dating from 2013.
- No deployed systems are compromised: the final NIST standards (ML-KEM, ML-DSA, SLH-DSA) remain entirely intact.
- The real problem is verification: producing the discovery takes tens of machine-hours, but validating it requires hundreds of human-hours, and only about a dozen qualified reviewers exist worldwide for this type of paper.
HAWK: The Candidate That Survived Until It Didn’t
HAWK is a digital signature scheme submitted to NIST’s Post-Quantum Cryptography Standardization project in 2024. Its acronym — HAttice-based signatures With superfast Kicks — encapsulates its architecture: a lattice-based design relying on the Module Lattice Isomorphism Problem (module-LIP) as its security foundation. In May 2026, HAWK reached the third round of NIST’s additional digital signatures track, becoming the only lattice-based candidate among the nine algorithms NIST advanced that month. As of July 28, 2026, it is also a candidate with a documented structural weakness.
The underlying mathematical problem — determining whether two lattice structures are secretly the same shape — is believed to be hard for both classical and quantum computers. That is precisely the property making HAWK attractive as a post-quantum candidate: it rests on a class of problems that would survive a cryptographically relevant quantum computer, one capable of breaking RSA or elliptic-curve cryptography. What Mythos Preview found is not that this problem has become easy. It identified that HAWK’s specific construction has an additional exploitable property its designers had not identified.
Specifically, HAWK’s lattice operates over a power-of-two cyclotomic ring, and that ring has a Galois symmetry: the map sending a root of unity to its negation. Researchers had already established in 2025 that if such a nontrivial automorphism existed in HAWK’s particular cyclotomic field, it could be used to mount a rank-reducing attack on the key-recovery problem. They had demonstrated the mathematical pathway. What they had not found was the automorphism itself. Van Gent and Pulles had documented this in a 2025 paper, noting that no such automorphism was then known to affect HAWK in practice.
Mythos Preview found it. Working inside a research harness built on Claude Code, which gave it access to Python, the Sage mathematical software library, and a corpus of published cryptographic research, the model conducted an automated literature review, generated and tested mathematical hypotheses, and ran computational experiments — largely without human intervention. The result was the identification of the τ-cocycle automorphism that makes the attack real.
The attack works by constructing a τ-cocycle lattice from HAWK’s public key, applying lattice reduction and sieving algorithms, and recovering a functionally equivalent secret signing key. The numbers are stark. For HAWK-256, the challenge parameter provided as a cryptanalytic target, the work factor for full key recovery fell from 2^64 operations to 2^38 — roughly 67 million times faster. On a 96-core server, the released implementation recovers HAWK-256 signing material in approximately three hours and forty-two minutes. For the parameter sets NIST actually defines — HAWK-512 and HAWK-1024 — the attack remains exponential and impractical, with the work factor for HAWK-512 falling from 2^150 to 2^108, and for HAWK-1024 from 2^288 to 2^182. The numbers are still astronomically large. They are no longer what HAWK claimed.
The practical consequence for HAWK is unambiguous: restoring the originally claimed security margins would require approximately doubling key sizes across all parameter sets. That change would eliminate much of what made HAWK competitive — its compactness and efficiency relative to other candidates. Whether NIST revises HAWK’s parameters, adjusts its security claims, or removes it from consideration entirely has not been publicly determined as of this writing. What is clear is that HAWK entered the third round as a promising candidate and left it with a published structural weakness.
Anthropic disclosed the attack to HAWK’s authors in June 2026 and coordinated simultaneous public disclosure to the NIST mailing list alongside the research release. The HAWK team helped verify the result before disclosure. No independent end-to-end reproduction of the HAWK-256 key recovery had been publicly confirmed at the time of writing, though the released code is available for anyone with the appropriate computational resources to attempt verification.
The Möbius Bridge: Why AES Is Not Broken
The second finding in Anthropic’s disclosure received less attention and deserves more scrutiny, because it is precisely the one that generated the most misleading coverage.
Mythos Preview also developed a new attack technique against a weakened variant of AES-128 — specifically, 7-round AES-128. The world-standard AES-128 uses 10 rounds. The 7-round variant has been a research target since 2013, when Dunkelman, Keller, and Shamir published the best previous meet-in-the-middle attack against it. Mythos found a way to make that attack faster.
The specific contribution is a fingerprinting technique the model named the Möbius Bridge. The AES S-box is constructed from an inversion in GF(2^8) followed by an affine map. Mythos identified a fingerprint invariant under that affine action that removes one of the nine key bytes the prior attack had to guess — worth a factor of 256 in enumeration cost. Computing the invariant naively costs more than it saves, so the paper adds a packed power table, a Gray-code walk, and an XOR-separable cache to bring per-entry computation down from approximately 2^19 lookups to approximately 2^8.6.
The runtime improvement is real but narrower than the headline suggests. The attack still requires 2^105 chosen plaintexts, which means under the standard balanced-complexity metric, the total attack cost is dominated by data collection. A rebalanced variant reaches 2^96.3 complexity against the 2013 attack’s 2^99, a 2.7-bit improvement on a target that had not moved since 2013. The « 200 to 800 times faster » framing in some coverage describes the time column of the attack, not the complete balanced complexity. The actual improvement in the full attack is real but modest.
Full 10-round AES-128, deployed in browsers, banking systems, and encrypted storage worldwide, is not affected. The attack required assumptions that do not hold at the full round count, and the paper itself notes that full AES absorbed the finding with margin to spare. This is a research result on a reduced-round variant — not a practical threat to anything running today in production.
The more significant contribution, buried in the same Anthropic disclosure, was actually a result against LEA — a Korean national standard and ISO lightweight block cipher used in constrained devices including mobile phones and IoT hardware. Mythos recovered a 13-round LEA key in under 2^30 plaintexts and under one hour on a desktop workstation, against a previously published best attack requiring 2^98 plaintext pairs and 2^86 computational work. The 13-round attack runs end to end, which is harder to achieve than complexity improvements on paper, even if full 24-round LEA remains unbroken. Six rounds of Serpent-128 also fell. These results are less dramatic in headline terms but represent complete, verifiable attacks on reduced-round variants — exactly the kind of finding that running code can confirm.
The Three Tiers of Cryptographic Failure
The most useful framework for understanding what these results actually mean comes from Marin Ivezic at PostQuantum.com, who categorized cryptographic failures into three tiers before analyzing the Anthropic results.
Tier one is an implementation bug: a coding error, a timing leak, an API misuse. The algorithm’s mathematical design is sound; the software got it wrong. You patch the library and move on. This is what Anthropic’s earlier Project Glasswing found in April 2026, when Mythos discovered vulnerabilities in OpenSSL and wolfSSL cryptographic libraries. Those were tier-one findings. The HAWK and AES results are categorically different.
Tier two is an algorithm design weakness: the mathematical structure the designers chose has more exploitable properties than anyone realized when the parameters were set. The underlying hard problem is not dead, but the specific construction does not deliver the security margin claimed. This is where the HAWK and AES results sit. HAWK’s underlying module-LIP problem is intact. What Mythos found is that HAWK’s specific cyclotomic ring construction has a Galois symmetry that halves the effective SVP oracle dimension — a property of the algebraic structure that the HAWK paper itself confirms follows the mathematics rather than any particular codebase. For AES, the finding is that the S-box’s inversion structure had unexploited implications for meet-in-the-middle attacks that prior work had not identified.
Tier three is a practical full-parameter break: the complete specified scheme defeated at its intended parameters. SIKE was broken this way in 2022, when an attack exploiting SIDH’s auxiliary torsion-point exchange defeated the scheme entirely on a laptop in approximately one hour. A polynomial-time factoring algorithm would be an extreme version: an entire mathematical assumption dying at once.
Nothing this week is a tier-three event. Getting the tier right determines what action, if any, follows. Tier-two findings are exactly what crypto-agility — the ability to swap out cryptographic algorithms without redesigning entire systems — exists to handle, and exactly what most organizations are not well-prepared for.
« Tier-two findings are exactly what crypto-agility exists to handle, and exactly what most organizations are not well-prepared for. »
Marin Ivezic, PostQuantum.com
The Verification Problem Nobody Is Talking About
The most important sentence in the entire disclosure is buried in the AES paper’s conclusion, and it is not about AES.
The paper states that the core mathematical idea took tens of hours of model compute to develop. Human validation — reading the paper, understanding the mathematics, checking the proofs, and reproducing the results — took hundreds of hours across two researchers. That ratio is the number that security planners, CISOs, and standards bodies should be putting on watch lists.
The cryptographic review process assumes that human experts can evaluate new findings at roughly the same pace that researchers produce them. That assumption is now under strain. AI-assisted cryptanalysis can generate tier-two findings at a cost of approximately $100,000 and a week of compute time. The field has roughly a dozen people globally who can competently review a lattice-based cryptanalysis paper. They have day jobs. They are not a production system for keeping up with an AI’s output rate.
Anthropic followed responsible disclosure protocols. The attack was shared with HAWK’s authors before publication, verified with their help, and disclosed simultaneously to the NIST mailing list. The model used was a restricted frontier model available only to vetted Project Glasswing partners. The result was published with runnable code attached, allowing independent verification. These are the conditions under which the finding is manageable: a known actor, a disclosed method, reproducible results, and time to respond before anything is deployed.
None of those conditions are guaranteed to hold the next time. The capability Anthropic demonstrated — auditing a cryptographic design at a depth that surpasses two years of expert human review, for $100,000 in compute — is not inherently exclusive to Anthropic, is not inherently restricted to defensive research, and is not going to get slower. As frontier AI capabilities become more broadly accessible, the assumption that only responsible labs with disclosure policies will be doing this kind of work weakens.
The question this raises is not whether AI will find more weaknesses in cryptographic algorithms. It will, and probably soon. The question is whether the institutions that exist to respond to those findings — NIST’s standardization process, the responsible disclosure norms that coordinate between researchers and vendors, the review capacity of the academic community — can operate at the speed the new capability demands.
Cryptographers have been finding weaknesses in algorithms throughout the field’s history. The NIST PQC Standardization project, which has been running since 2016, was specifically designed to surface weaknesses before any candidate is deployed. HAWK surviving two rounds of expert review before a weakness was found is not a failure of the process — it is the process working, just in a timeline that the new capability has compressed from years to weeks. The problem is that the process was designed for a world where findings arrive in ones and twos against candidates, where verification is a matter of routine academic peer review, and where the gap between discovery and responsible disclosure is manageable. That world is still here. It may not be here for long.
What NIST’s Process Found, and What It Now Faces
NIST’s Post-Quantum Cryptography Standardization project has been running since 2016, when the agency issued a call for algorithms capable of surviving a cryptographically relevant quantum computer. Twenty-three signature schemes and 59 encryption or key-encapsulation schemes were submitted. The first set of standards — ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205) — was finalized in 2024. FN-DSA (FIPS 206), based on the Falcon signature scheme, has been selected for standardization with a draft expected in late 2026 and finalization in 2027.
The nine candidates advanced to the third round of the additional signatures track in May 2026 — including HAWK, FAEST, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, and UOV — entered a two-year evaluation phase. NIST’s own second-round status report had explicitly asked the community to look harder at the module-LIP assumption inside HAWK’s particular cyclotomic fields. The attack arrived precisely where NIST had pointed.
The fact that the finding came from an AI model rather than a human research team is novel. The fact that a weakness was found in a candidate before standardization is not — SIKE was broken entirely in 2022, before it reached any standard. What is new is the cost and speed of discovery relative to the cost and speed of verification. That asymmetry is not a theoretical concern. It is a present operational challenge for any organization that relies on the NIST standardization timeline as its planning horizon for cryptographic migration.
The NSA’s CNSA 2.0 requirements already mandate that national security systems begin migrating to quantum-resistant algorithms. OMB M-23-02 and the White House National Security Memorandum-10 set timelines for federal agency migration. NIST’s final standards are the technical reference those timelines assume. If the pipeline of candidate algorithms feeding into NIST’s standardization process is now being audited faster than the process can evaluate the findings, the migration timelines face more than quantum computing as a risk factor.
The Other Results That Got Less Attention
The follow-up results in Anthropic’s disclosure did not receive the same coverage as HAWK and AES, but some of them are more immediately actionable.
Two Claude models independently found a full 128-bit key-recovery attack on the complete, unmodified SpoC authenticated-encryption design using just two oracle queries. A third model found an error in the published CCA-security proof of the KINDI key-encapsulation scheme and produced a working decryption-reaction attack. Neither SpoC nor KINDI became a deployed standard, so these results do not require any immediate operational response. But they are the clearest evidence in the disclosure that AI-assisted cryptanalysis already reaches beyond optimizing known attacks on reduced-round research targets into finding design flaws in complete constructions that human reviewers had not identified.
That distinction matters for the threat model. A weakness in a 7-round variant of AES is not a threat to anything deployed. A design flaw in an authenticated-encryption scheme that allows full key recovery in two oracle queries, found by a model that did not have access to the implementation source code, is a different category of result — even if the scheme it targets is not yet deployed. The concern is not what AI cryptanalysis can do to algorithms that have been in the field for 20 years. It is what it can do to the next generation of algorithms before they get there.
What Actually Needs to Happen
Three things follow from this week’s results that are worth separating from the noise.
The first is that HAWK’s candidacy is not over, but it is complicated. The attack is exponential and the challenge parameter is practically broken. The larger parameter sets remain hard. Whether NIST revises HAWK’s parameters, reopens its security analysis, or advances it with a known weakness on record is a decision for the standardization process, not for this article. What is clear is that HAWK entered round three with a clean bill of health and left it without one.
The second is that nothing deployed is broken. HAWK has not been standardized or deployed. Full AES-128, full AES-192, and full AES-256 are unaffected by the AES result. LEA at its full 24-round parameterization is unaffected. The NIST final standards — ML-KEM, ML-DSA, and SLH-DSA — are untouched. The immediate operational response to this week’s findings is: no change required.
The third, and the one that deserves more attention than it has received, is the verification problem. Saarinen proposed a specific response in the aftermath of the disclosure: require machine-checkable proofs and scaled-down demonstrations as part of the submission and review process, so that verification cost scales with the volume of claims rather than with the patience of the dozen people qualified to referee them. This would not solve the problem — AI-generated cryptanalysis would still arrive faster than verification can proceed — but it would move the bottleneck from human attention to computational resources, which scale differently.
The cryptographic community has approximately one release cycle to develop norms for this before it needs them. The Anthropic disclosure was handled responsibly by a well-resourced lab with established disclosure relationships. The next one may not be.
Summary Table of Anthropic’s July 28, 2026 Results
| Target | Type | Pre-complexity | Post-complexity | Practical impact |
|---|---|---|---|---|
| HAWK-256 (challenge) | Key recovery | 2^64 | 2^38 | Broken in ~3h42 on 96 cores |
| HAWK-512 (NIST param) | Key recovery | 2^150 | 2^108 | Remains impractical |
| HAWK-1024 (NIST param) | Key recovery | 2^288 | 2^182 | Remains impractical |
| AES-128 (7 rounds) | Meet-in-the-middle | 2^99 (2013) | 2^96.3 | Research target only |
| LEA (13 rounds) | Key recovery | 2^98 plaintexts, 2^86 ops | 2^30 plaintexts, <1h | Reduced variant, executed |
| Serpent-128 (6 rounds) | Full attack | — | — | Reduced variant, executed |
| SpoC (complete) | 128-bit key recovery | — | 2 oracle queries | Not deployed |
| KINDI (CCA proof) | Decryption reaction | — | — | Not deployed |
Conclusion
The July 28, 2026 episode is not a break of internet security. It is a warning signal about the cadence at which the cryptographic ecosystem will now have to operate. NIST designed its standardization process to surface weaknesses before deployment — HAWK is a clean example of that. What this disclosure changes is not the probability that a candidate has a weakness, but the speed at which it can be found relative to the speed at which it can be validated.
The optimistic scenario is one in which the ecosystem absorbs the new cadence: researchers and vendors organizing around compressed review timelines, submissions accompanied by machine-checkable proofs, and disclosure norms that account for the fact that findings now arrive in batches rather than as a trickle. The pessimistic scenario is one of an overwhelmed review process, a multiplication of incomplete or off-protocol disclosures, and a post-quantum migration that has to contend with both advances in quantum computing and the volatility of an algorithm pipeline being audited faster than it can be standardized. The window for tipping the balance toward the optimistic scenario is short. It is probably one release cycle. The cryptographic community has every interest in using it.
Sources
- Anthropic — Discovering cryptographic weaknesses with Claude (July 28, 2026)
- PostQuantum.com — AI Broke a NIST Candidate. Not Your Encryption. (July 28, 2026)
- Tech Times — AI Cracks Post-Quantum Cipher in 60 Hours After Two Years of Human Review Failed (July 28, 2026)
- NIST CSRC — Post-Quantum Cryptography Standardization Project
- The Quantum Insider — NIST Advances Nine Post-Quantum Signature Algorithms to Third Round (May 2026)
- Palo Alto Networks — What Are NIST PQC Standards?
This article is published for informational and educational purposes. It does not constitute investment advice. Do your own research (DYOR) before any decision.
