Anthropic says an internal model called Claude Mythos Preview produced two new cryptographic attacks: a faster break on HAWK, a candidate post-quantum signature scheme under review by the National Institute of Standards and Technology, and a speed improvement on an attack against a deliberately weakened version of AES, the world’s most widely used encryption cipher. Neither result touches a system running in production today. HAWK is still a candidate awaiting NIST approval, and the AES attack targets a seven-round version of the cipher rather than the full ten-round AES-128 that protects real internet traffic.
That distinction matters because academic researchers routinely strip rounds out of ciphers on purpose, using the weakened version to probe how a security margin holds up and to build attack techniques that might eventually scale further. A result against seven-round AES says nothing about whether full AES-128 can be broken. It says something about how close researchers, now working alongside a model, are getting to the edges of a cipher that has been studied harder than almost any other in the field.
On HAWK, Mythos worked semi-autonomously with one Anthropic researcher for about 60 hours and roughly $100,000 in API spending. It found a previously unexploited mathematical symmetry in the lattice structure HAWK relies on, and used it to build a faster search for a private key. Anthropic says the effect is that HAWK’s proposed key sizes now need to double to hold their intended security level. On the smallest proposed size, HAWK-256, the operations needed for a full key recovery fell from an estimated 2^64 to 2^38. HAWK had already passed two review rounds spanning two years of expert scrutiny before Mythos found the gap, and NIST contests have produced late-stage surprises before: an earlier post-quantum candidate called SIKE was fully broken on a laptop in about an hour.
On AES, a second Anthropic researcher built an autonomous research scaffold, and Mythos designed a new fingerprinting method it called the Möbius Bridge to improve an existing meet-in-the-middle technique against seven rounds of AES-128. The idea eliminated a step in the prior best attack that required guessing among 256 possible values, then Mythos layered on further optimizations. Anthropic says the combined result runs 200 to 800 times faster than the previous best published attack, depending on how runtime is measured. The company reports the discovery cost roughly $100,000 in API usage and took Mythos about a week to conceive, though confirming the math was correct took Anthropic researchers close to a month.
Anthropic evaluated its own model on cryptanalysis work its own researchers scoped, ran, and validated. Academics from ETH Zurich, from Tel Aviv University, and from the University of Haifa helped build a companion benchmark, CryptanalysisBench, so outside groups can test other models on the same problems. No outside lab has independently replicated either attack yet.
Cryptanalysis sits in a small class of problems where a model’s output settles its own argument: a proposed attack either recovers the key faster than before or it does not, and anyone with the paper can rerun the math to check. That is a sharper test than asking a model for a business recommendation or a policy read, where “correct” is a judgment call. But cheap verification in principle is not the same as cheap verification in practice. Confirming the AES result took Anthropic researchers weeks even though the underlying claim was, in theory, checkable by anyone. The same gap should show up in other domains with a hard pass or fail test, like formal software verification or exploit development, where a model can search fast but a qualified human still has to sign off before anyone trusts the result.
Security teams running products built on NIST’s post-quantum candidates, or maintaining older ciphers with known reduced-round weaknesses, should treat model-assisted cryptanalysis as a new line item in pre-deployment testing budgets, not evidence that AES-128 itself needs replacing.
Anthropic detailed these findings in a research post on its site published in July 2026.
