For years, AI-driven security analysis focused on finding software implementation bugs buffer overflows, side-channel leaks, or missing input validation in libraries like OpenSSL. But the paradigm has shifted.
Anthropic revealed that its Claude Mythos Preview model autonomously discovered fundamental mathematical flaws in core cryptographic algorithms. Over the course of a week-long automated research run costing roughly $100,000 in API tokens, Mythos halved the effective key strength of HAWK (a NIST Post-Quantum Cryptography signature candidate) and accelerated known attacks on 7-round AES-128 by 200x to 800x.
To prove their findings, Anthropic open-sourced the underlying code artifacts in the anthropics/cryptography-research-demo GitHub repository.
These findings do not break current production systems. However, they signal a dramatic shift: frontier AI models can now accomplish in 60 hours what years of expert human cryptanalysis missed. Here is the technical breakdown of the attacks, the multi-agent harness that drove them, and what this means for the future of post-quantum security.
What to Remember
- HAWK PQC Weakened: Mythos discovered a hidden lattice symmetry (τ-cocycle lattice) in HAWK, cutting its key strength in half and dropping the HAWK-256 recovery work factor from 2⁶⁴ to 2³⁸.
- The Möbius Bridge on AES: Mythos eliminated a 256-way guessing step in 7-round AES-128 meet-in-the-middle attacks using an invariant fingerprint, speeding up the attack by up to 800x.
- Verification is the New Bottleneck: While Mythos took 60 hours to discover the HAWK attack, human researchers required nearly a month to manually verify the mathematical proofs.
- Open Artifacts Available: Anthropic released functional C/Rust/Python proof-of-concept code on GitHub, allowing researchers to run end-to-end HAWK-256 key recoveries locally.
Breaking HAWK: Halving the Strength of a Post-Quantum Candidate
HAWK is a lattice-based digital signature scheme submitted to NIST’s standardization call for additional post-quantum signatures. Its security relies on the hardness of the Search Module Lattice Isomorphism Problem (smLIP).
Despite passing two rigorous rounds of human expert review over two years, Mythos required just 60 hours of multi-agent work to discover an unexploited mathematical symmetry within HAWK’s lattice.
[Public Key Input]
│
▼
Construct τ-Cocycle Lattice (Discovered by Mythos)
│
▼
Lattice Reduction & Sieving (Recovers Short Vectors)
│
▼
Reconstruct Equivalent Secret Basis (592-byte Key)
│
▼
Sign Arbitrary Messages (Validated via NIST Reference Implementation)The Technical Mechanism
- The Hidden Symmetry: Theoretical work by van Gent and Pulles previously showed that if a nontrivial automorphism existed in HAWK’s lattice, key recovery could be reduced to finding a short vector in roughly half the original dimension. Mythos identified the specific, previously unmapped automorphism.
- τ-cocycle Lattice Construction: The Mythos payload builds a τ-cocycle lattice from the target public key.
- Sieving & Basis Recovery: Using lattice reduction techniques, it extracts short vectors to construct a 592-byte functionally equivalent signing key bypassing the need to recover the original 96-byte secret seed.
Real-World Impact on HAWK
- HAWK-256: Key recovery work factor dropped from $2^64$ to $2^38$. The code in Anthropic’s GitHub repository recovers a HAWK-256 key in 3 hours and 42 minutes on a 96-core server.
- HAWK-512 & HAWK-1024: Gate-count security claims fell from $2^150 \rightarrow 2^108$ and $2^288 \rightarrow 2^182$ respectively.
While HAWK-512 remains computationally impractical to break, doubling its key size to restore original security claims destroys HAWK’s primary advantage: its lightweight signature and key footprints.
The Möbius Bridge: Accelerating 7-Round AES-128 by 800x
The Advanced Encryption Standard (AES-128) uses 10 rounds of substitution-permutation operations. Cryptographers regularly study “reduced-round” variants (such as 7 rounds) under chosen-plaintext models ($2^105$ plaintexts) to measure safety margins.
Previous attacks used meet-in-the-middle (MitM) techniques, trading memory for speed by precomputing intermediate lookup tables. However, one stage of prior attacks required blindly enumerating and testing 256 candidate values before querying the table.
Prior Meet-in-the-Middle: [State] ──► Enumerate 256 Guesses ──► Query Table
Mythos Möbius Bridge: [State] ──► Möbius Invariant Transform ──► Direct Lookup (256x Speedup)How Mythos Fixed the Guessing Step
Mythos constructed a custom mathematical fingerprinting algorithm dubbed the Möbius Bridge.
Because the Möbius Bridge transform remains invariant across all 256 possible guesses, the attack eliminates the enumeration step entirely. Combined with secondary runtime optimizations discovered by the model, Mythos achieved an overall 200x to 800x speedup over previously published academic work.
Pushing Through Model “Refusals”
Interestingly, Mythos initially refused to work on AES, outputting logs stating:
“AES-128 r5/r6/r7 found nothing because there’s nothing easy to find; this is the most-studied block cipher in existence.”
Human researchers had to explicitly prompt the agent harness to stop seeking low-hanging fruit and pursue novel mathematical transforms. Over 3 days and 1 billion output tokens, Mythos derived the Möbius Bridge, validated it mathematically, and wrote Python/Rust code verifying its correctness.
The Multi-Agent Harness & GitHub Proof of Concept
To achieve these breakthroughs, Anthropic used a multi-agent harness similar to Claude Code. Worker agents operated in sandboxed environments with access to Python, SageMath, and published cryptanalysis papers.
Key Observations from the Agent Workflow:
- Peer Review & Self-Correction: During the HAWK research, Worker A rejected an approach as mathematically infeasible. Worker B re-examined Worker A’s logs, identified a bypass, and convinced Worker A to co-develop the full attack.
- The Verification Bottleneck: While Mythos derived the AES Möbius Bridge in a few days, human computer scientists required nearly a month of manual verification to confirm the mathematical proofs.
Exploring the GitHub Repository
Security teams and researchers can inspect the artifacts directly on GitHub at anthropics/cryptography-research-demo:
git clone https://github.com/anthropics/cryptography-research-demo.git
cd cryptography-research-demo/HAWK
# Build the HAWK-256 key recovery C harness
make
# Run the key recovery test against sample public keys
./hawk_attack --pubkey samples/hawk256_pk.binNote: The public repository strictly limits key recovery execution to HAWK-256 challenge parameters and reduced AES variants to prevent misuse against live standards.
Lessons Learned for Security Leaders
- Lesson 1: Post-Quantum Candidates Need AI Stress-Testing. NIST’s standardization process relies on human peer review. As Mythos demonstrated on HAWK, candidate algorithms must undergo multi-agent AI cryptanalysis before being standardized into FIPS publications.
- Lesson 2: Verification is the New Bottleneck. In both software vulnerability discovery and academic cryptanalysis, LLMs now generate breakthroughs faster than human teams can audit them.
- Lesson 3: Algorithmic Longevity is Decreasing. Reduced-round attacks on LEA (13-round recovery in less than 1 hour) and Serpent-128 indicate that ciphers with thin security margins will be degraded rapidly by frontier models.
Conclusion
The Mythos cryptanalysis results represent a watershed moment. AI is no longer just finding missing bounds-checks in C code; it is deriving novel mathematical theorems and lattice reduction strategies.
As models like Claude Mythos become standard tools for cryptographers, the security community will benefit from faster vulnerability discovery, better parameter tuning, and stronger post-quantum standards.
To further enhance your Post Quantum readiness in your cloud environment and start implementing PQC migration, contact me on LinkedIn Profile or [email protected].
Frequently Asked Questions (FAQ)
Did Claude Mythos break production AES-128 encryption?
No. Mythos attacked a 7-round reduced variant of AES-128 (which uses 10 rounds) under a chosen-plaintext model. Full AES-128 remains completely secure and unbroken.
How did Claude Mythos weaken the HAWK digital signature scheme?
Mythos discovered a previously unknown lattice symmetry (a τ-cocycle automorphism) in HAWK, cutting its key strength in half and reducing the HAWK-256 key recovery work factor from 2^64 to 2^38.
What is the Möbius Bridge in the AES attack?
The Möbius Bridge is a mathematical fingerprinting transform derived by Mythos. It remains invariant across 256 guessed values in meet-in-the-middle attacks, eliminating an entire enumeration step and speeding up the attack by up to 800x.
What is CryptanalysisBench?
CryptanalysisBench is a 191-task benchmark co-created by Anthropic, ETH Zurich, and Tel Aviv University to evaluate how effectively frontier LLMs can perform autonomous cryptanalysis on classical and modern ciphers.
Where can I find the code artifacts for these attacks?
Anthropic open-sourced the C, Python, and Rust verification harnesses on GitHub under the repository 'anthropics/cryptography-research-demo'.
Resources
- Anthropic Cryptography Research Demo Repository: anthropics/cryptography-research-demo
- HAWK NIST Specification: Post-Quantum Digital Signature Candidate Documentation.
- CryptanalysisBench Benchmark: Evaluating LLMs on classical and modern ciphers.
- NIST PQC Program: Official updates on post-quantum standardization.
