Full Report
Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128. The HAWK attack exploits a previously unused symmetry in the lattice behind the signature scheme. Anthropic's released implementation gives an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server
Analysis Summary
# Research: Discovering Cryptographic Weaknesses via Large Language Models
## Metadata
- **Authors:** Research team at Anthropic (Specific authors not listed in summary)
- **Institution:** Anthropic
- **Publication:** Anthropic Research Blog / Technical Reports
- **Date:** July 28, 2026
## Abstract
Anthropic researchers utilized a preview version of their "Claude Mythos" model to identify and implement new cryptographic attacks against two major targets: the post-quantum signature scheme HAWK and the Advanced Encryption Standard (AES-128). The AI identified a previously overlooked symmetry in the lattice structure of HAWK-256, enabling an end-to-end key recovery attack in under four hours. Additionally, the model refined a known "meet-in-the-middle" attack on 7-round AES-128, achieving a 200- to 800-fold speedup. While these results do not compromise current production systems, they demonstrate a significant leap in the capability of AI agents to perform complex, multi-step cryptanalysis.
## Research Objective
The research sought to determine if advanced LLMs could move beyond simple code auditing to conduct deep, autonomous cryptanalytic research—specifically finding new mathematical flaws in encryption algorithms and optimizing complex attacks.
## Methodology
### Approach
- **Multi-Agent Environment:** Claude Mythos Preview operated within a multi-agent framework over approximately 60 hours.
- **Human-in-the-loop:** Human researchers provided high-level project management and verification but did not provide specific domain expertise in lattice cryptography.
- **Iterative Discovery:** The model was tasked with analyzing the mathematical foundations of the target schemes and generating executable exploit code.
### Dataset/Environment
- **HAWK-256:** A challenge parameter set for the HAWK signature scheme (a NIST Post-Quantum Cryptography candidate).
- **AES-128:** A 7-round reduced version of the 10-round AES standard.
- **96-core Server:** Used for the final execution of the AI-generated lattice reduction and sieving algorithms.
### Tools & Technologies
- **Claude Mythos Preview:** A specialized AI model optimized for reasoning and technical discovery.
- **Lattice reduction/sieving libraries:** Used to implement the AI's theoretical findings.
## Key Findings
### Primary Results
1. **HAWK-256 Key Recovery:** Successfully derived an end-to-end attack that recovers a functionally equivalent secret key from a public key in ~3 hours and 42 minutes.
2. **AES-128 Optimization:** Achieved a 200x to 800x speedup on a 7-round AES-128 attack by eliminating a 256-way guessing step.
3. **Complexity Reduction:** Reduced the estimated security work factor for HAWK-256 from $2^{64}$ to $2^{38}$.
### Supporting Evidence
- **Empirical Validation:** The recovered HAWK keys were used to sign messages that successfully passed the NIST reference implementation's verification.
- **Computational Efficiency:** The HAWK attack gate-count estimates for higher security levels (HAWK-512/1024) were also lowered ($2^{150}$ to $2^{108}$ for HAWK-512).
### Novel Contributions
- **$\tau$-cocycle Lattice Discovery:** The AI identified a specific automorphism (symmetry) in the HAWK lattice that previous human researchers (van Gent and Pulles) had theorized but not fully realized into an attack.
## Technical Details
The HAWK attack treats key recovery as a "search module Lattice Isomorphism Problem" (smLIP). By exploiting the newly discovered symmetry, the AI constructed a $\tau$-cocycle lattice. This construction allows the attacker to find a short vector in a lattice of roughly half the original dimension, significantly lowering the difficulty of lattice reduction. The attack does not recover the original seed but generates "functionally equivalent" signing material.
## Practical Implications
### For Security Practitioners
- **PQC Readiness:** While HAWK-512 remains theoretically secure, the rapid reduction in its security margin suggests that NIST candidates may require parameter adjustments before final standardization.
### For Defenders
- **No Immediate Action Required:** There is no immediate threat to production AES-128 (which uses 10 rounds) or NIST-standardized PQC yet.
- **AI-Driven Vulnerability Research:** Defenders should prepare for a future where AI can find 0-day cryptographic flaws faster than traditional peer review.
### For Researchers
- **Shift in Cryptanalysis:** Future cryptographic schemes must be "AI-hardened," assuming attackers will use LLMs to find symmetries or optimizations that human researchers might miss.
## Limitations
- **Reduced Round AES:** The AES attack only applies to 7 rounds, not the full 10-round implementation.
- **Exponential Complexity:** The HAWK attack is still exponential; it is not a polynomial-time "break" of lattice cryptography.
- **Cost:** The API cost for the discovery process was approximately $100,000, suggesting these capabilities are currently restricted to well-funded actors.
## Comparison to Prior Work
Previous research by van Gent and Pulles (2025) identified the possibility of using automorphisms against HAWK but concluded it did not yet affect the scheme. This work bridges that gap by identifying the specific, unused symmetry required to make the attack practical.
## Future Work
- **Higher Parameters:** Investigating if the speedup can be scaled to make HAWK-512 attacks feasible on supercomputers.
- **Generalization:** Determining if similar AI-driven techniques can identify weaknesses in other lattice-based PQC schemes like Dilithium or Kyber (ML-KEM/ML-DSA).
## References
- Anthropic: *Discovering Cryptographic Weaknesses* (2026)
- Van Gent & Pulles: *Lattice Isomorphism Problem and HAWK* [eprint.iacr.org/2025/928]
- NIST PQC Forum: *Announcement regarding HAWK Gate-counts* (July 2026)