Matthew Green, the Johns Hopkins cryptographer behind the blog A Few Thoughts on Cryptographic Engineering, used his July 29 post to do something Anthropic’s own announcement could not: grade the company’s cryptanalysis results from outside the lab. AI Insiders covered that announcement the day before. The value of Green’s piece is that it comes from an expert with no stake in Anthropic’s narrative, checking a lab’s claim about its own model rather than repeating it.
Anthropic said its unreleased Claude Mythos model produced two new cryptanalysis results with minimal human steering. The first targets HAWK, a proposed post-quantum signature scheme still under evaluation for standardization. The second improves an attack on a weakened, seven-round version of AES, the block cipher used across most of modern encryption.
Green treats the two very differently. The HAWK attack, he writes, roughly halves the scheme’s effective security and produces working code that recovers keys in a few hours, run against a weakened test instance the researchers supplied for that purpose. He calls the underlying math unremarkable: the model combined known cryptanalytic tools more thoroughly than anyone had previously bothered to, rather than inventing anything new. Still, the attack does not carry over to Falcon, the related scheme actually headed toward standardization, because that scheme rests on a different hard problem. Green notes HAWK had advanced far enough in the standardization pipeline that this result likely ends its chances there.
The AES result gets a cooler read. Attacks on seven-round AES already existed, and Green describes the new one as a modest speedup over a result published in 2013. It requires roughly 2^89 operations and access to 2^105 chosen-plaintext encryptions under a single key, figures so large that the attack cannot actually be run and its exact speedup is not fully confirmed on paper. Full, deployed AES, which uses ten to fourteen rounds depending on key length, remains untouched by either result.
Green’s central claim is about capability, not danger. The model understood existing cryptanalysis well enough to combine it into new attacks and extend them without close supervision, a meaningfully different skill than reciting known results. He is equally clear about the ceiling: this is not superintelligent cryptanalysis, and neither result breaks a cipher or scheme anyone currently relies on to protect real data.
He also names the harder problem sitting under both results: verification. A runnable attack like the HAWK one is easy to check, since anyone can execute the code against the supplied instance and confirm it recovers keys. A paper-only claim like the AES speedup is not, because validating it takes expert review of the underlying proof, work that formal tools such as Lean can support but not replace. As models generate candidate results faster than specialists can check them, review capacity becomes the real limit on how much of this output can be trusted, not the model’s raw output.
For anyone tracking AI and security together, the reasonable read is Green’s own. Symmetric cryptography such as AES looks sound for now. Public-key schemes, especially newer post-quantum candidates still working through standardization, are where an AI system with time to spend could plausibly do the most damage or the most good. Teams evaluating post-quantum migrations should treat active standardization candidates as likely targets for this kind of automated scrutiny before locking in a scheme, not after.
Matthew Green, writing on his blog A Few Thoughts on Cryptographic Engineering on July 29, 2026, provided the independent assessment described here.
