theLLMs

Last checked: 2026-07-29

Scope: Global. Sources checked as of 2026-07-29.

Key terms:

>_ large language model (LLM) >_ system prompt >_ JSON mode >_ reasoning model >_ red teaming >_ model card
Hero image for Claude Mythos finds mathematical flaws in post-quantum and symmetric cryptography

Claude Mythos finds mathematical flaws in post-quantum and symmetric cryptography

TL;DR

Anthropic’s Frontier Red Team published two results on July 28, 2026 showing Claude Mythos Preview found mathematical flaws in the HAWK post-quantum digital signature scheme and a reduced-round variant of AES-128. Each attack cost roughly $100,000 in API spend and took about 60 hours. Neither finding breaks anything deployed in production, but they demonstrate that frontier LLMs can now perform non-trivial cryptanalysis — finding flaws in the algorithms themselves rather than in implementation code.

The HAWK attack: cutting key strength in half

HAWK is one of the remaining third-round candidates in NIST’s call for additional digital signature schemes — a post-quantum standardization effort that has been running for nearly a decade. Its security is based on the hardness of the Lattice Isomorphism Problem.

Claude found a previously unexploited symmetry in HAWK’s underlying lattice: a nontrivial automorphism. Prior cryptography research had proved that efficiently finding such an automorphism would enable an attack, but it was unknown whether one actually existed in HAWK’s lattice. Claude discovered that it does.

The practical impact: the attack reduces HAWK’s effective key size by a factor of two. For the small parameter set (HAWK-256), the estimated cost of a full key-recovery attack drops from 2^64 to 2^38 operations. This is still an exponential-time attack — not polynomial — so HAWK is not broken in the worst case. But the weakening is material, and doubling HAWK’s key size to compensate would eliminate many of the efficiency advantages that make it an attractive post-quantum candidate in the first place.

The AES-128 attack: 200–800× faster on a reduced variant

Claude’s second result targets a seven-round variant of AES-128, not the full 10-round cipher. AES encrypts data by repeatedly applying the same round function; AES-128 uses 10 rounds. The reduced-round variant is studied academically to gain insights into attack techniques that could, in principle, generalize to the full cipher — but the current attack has no practical impact on deployed systems.

The improvement comes from a new fingerprinting algorithm Claude called a “Möbius Bridge.” The attack builds on a long line of meet-in-the-middle research that trades time for space by pre-computing lookup tables. Claude’s fingerprint is invariant to a guess that prior work had to enumerate 256 different values for, directly reducing the work required by a factor of 256. After accounting for the increased computation needed to apply the transform, the net result is an attack 200–800× faster than the previous best, depending on how runtime is measured.

The attack operates under a chosen-plaintext threat model — the most common assumption for studying block ciphers — and requires 2^105 chosen plaintexts. This makes it completely impractical in reality, but it does quantify the attack cost against AES under the standard research assumptions.

The multi-agent discovery process

Both results were developed mostly autonomously, with Claude working inside agentic harnesses built on top of Claude Code.

For HAWK, one Anthropic researcher worked semi-autonomously with Claude in a multi-agent setup. The agents ran in a sandboxed environment with access to Python, SageMath, and published cryptographic literature. The human operator had a background in theoretical computer science but was not a lattice cryptography expert. Claude handled the literature review, mathematical reasoning, computational experiments, and the construction of an end-to-end verification pipeline.

Interesting multi-agent dynamics emerged: the key HAWK idea was discovered by two agents collaborating, with the first initially rejecting the idea as infeasible before the second found a way to fully exploit it. The pair kept exchanging messages and eventually both agreed they had an effective attack.

For the AES attack, a different researcher built a scaffold that allowed Claude to operate fully autonomously. Claude initially claimed the problem was unsolvable, wrote messages like “AES-128 r5/r6/r7 is just genuinely hard,” and only engaged after explicit prompting. Three days of autonomous work and one billion output tokens later, Claude produced the Möbius Bridge insight.

Each result cost roughly $100,000 in API costs.

CryptanalysisBench

Anthropic partnered with researchers at ETH Zurich, Tel Aviv University, and the University of Haifa to release CryptanalysisBench — a benchmark that packages together many cryptographic ciphers and makes it easy for researchers to evaluate LLM capabilities on cryptanalysis. The team plans to continue experiments with it to track how frontier model capabilities evolve over time.

Alongside the two main research papers (one on HAWK, one on AES, including Claude’s chain of thought for the AES discovery), Anthropic also released preliminary results on additional ciphers: a practical attack on 13 rounds of LEA (a lightweight block cipher), a full key-recovery attack on 6-round Serpent-128, and improvements on Salsa20, Poseidon, and SHA-1.

Why this matters

The immediate implication for NIST’s post-quantum standardization is that HAWK’s proposed key sizes need re-evaluation. The broader implication is structural: AI models can now stress-test cryptographic schemes faster than human expert panels. This is cryptography research working as intended — stress-testing algorithms to build trust and make systems more secure — but it signals a shift in who does the stress-testing.

Methodology

  • Data checked: 2026-07-29
  • Sources consulted: Anthropic Frontier Red Team blog post (July 28, 2026), full research papers on HAWK and AES published alongside the blog post, CyberScoop coverage, The Hacker News report
  • Assumptions: All technical claims are sourced from Anthropic’s published research. Cost figures and timing are from the blog post. The NIST PQC timeline reflects publicly available information as of July 2026.
  • Limitations: This article covers the findings as published by Anthropic on July 28, 2026. Independent reproduction of the HAWK and AES results would require the technical papers and demonstration code released alongside them. CryptanalysisBench details are from the accompanying paper.
  • Jurisdiction: Global

Source list

Trust Stack

  • Last substantive check: 2026-07-29
  • Corrections policy: Contact via Contact page
  • Affiliation: theLLMs has no vendor affiliation or sponsorship

Change log

  • 2026-07-29: first published