On July 28, 2026, Anthropic’s Frontier Red Team unveiled a research paper detailing cryptographic weaknesses uncovered in two critical security algorithms: HAWK and a modified version of AES. The findings, derived from an internal preview of Mythos not yet available to the public, reveal significant but manageable vulnerabilities—far from the catastrophic scenarios some headlines suggest.
Hawk’s quantum-resistant falcon takes a dive
HAWK, a digital signature scheme designed to withstand quantum computing threats, was among the leading candidates for the U.S. National Institute of Standards and Technology’s (NIST) post-quantum cryptography standardization project. The algorithm had successfully passed two rounds of rigorous human expert evaluations over two years. However, its security was recently compromised by Anthropic’s Mythos Preview system.
The breakthrough hinged on a geometric symmetry identified within HAWK’s underlying lattice isomorphism problem. By leveraging this symmetry, researchers reduced the problem of finding a private key to a short vector search in a lattice with halved dimensions. For instance, in the HAWK-256 variant, the computational complexity plummeted from 2⁶⁴ to 2³⁸ operations, enabling key extraction in just 3 hours and 42 minutes on a standard 96-core server.
This drastic reduction in security effectiveness nullified HAWK’s practical advantages, particularly its computational efficiency. To restore acceptable protection levels, developers would have had to double key and signature sizes, undermining the algorithm’s lightweight design. Consequently, HAWK’s creators officially withdrew it from NIST’s selection process on July 29, rendering the algorithm obsolete in its current form.
Decoding the AES enigma: a theoretical crack in the academic labyrinth
The second discovery involves a deliberately weakened variant of AES-128, restricted to 7 rounds instead of the standard 10. While AES remains a globally trusted encryption standard—powering secure communications from banking transactions to TLS protocols—this modified version served as a theoretical sandbox for testing cryptographic resilience.
Anthropic’s Mythos Preview identified a novel invariant fingerprint technique dubbed the «Möbius Bridge,» incorporated into a meet-in-the-middle attack. This innovation eliminated a prior exhaustive search phase requiring 256 iterations, accelerating the attack’s execution by a factor of 200 to 800 compared to 2013 benchmark studies.
Crucially, this vulnerability remains confined to academic realms. The additional three transformation rounds in the official AES standard render the attack impractical, even against the weakened variant. According to France’s National Agency for the Security of Information Systems (ANSSI), symmetric keys should ideally be 192 bits or larger for post-quantum security, with minimal performance trade-offs—e.g., AES-192 imposes negligible overhead compared to AES-128.
Reflections on AI’s cryptographic prowess and human validation bottlenecks
While these discoveries do not threaten existing systems, they underscore a critical shift in cybersecurity dynamics: AI-driven tools like Mythos are uncovering vulnerabilities at an unprecedented pace, outpacing human verification processes. Anthropic’s research, for instance, required approximately 60 hours of autonomous computation (estimated at $100,000 via commercial API access) to crack HAWK, followed by a month-long formal review by two researchers to validate the results.
Mythos initially resisted executing tasks on the weakened AES variant, asserting that no improvements could be made to such a well-established algorithm. After refining its execution framework, the model generated roughly a billion tokens over several days to devise a new attack method—again at an estimated cost of $100,000. These findings highlight the growing role of AI in cryptanalysis while emphasizing the irreplaceable value of human oversight in validating complex mathematical proofs and code.
The broader implication? The bottleneck in cybersecurity is no longer the discovery of flaws but the human capacity to rigorously validate AI-generated breakthroughs. As Anthropic prepares to publish further findings, the industry must adapt to this new reality, balancing AI’s computational advantages with the necessity of human scrutiny.
Where do we go from here?
The HAWK withdrawal and AES insights serve as a reminder that cryptographic standards are not static. While today’s systems remain secure, the relentless evolution of AI demands proactive adaptation. Organizations should heed ANSSI’s recommendations, transitioning to longer key lengths where feasible, and fostering collaboration between AI-driven research and human expertise to stay ahead of emerging threats.
