Claude Mythos Cuts HAWK Key Strength and Speeds AES Attacks

What Changed

Cryptographic review is starting to include frontier AI systems as active researchers, not only assistants for code search. Anthropic said Claude Mythos Preview found two research-level weaknesses: one against HAWK, a post-quantum digital-signature candidate, and another against a reduced-round version of AES.

"New Anthropic research: Discovering cryptographic weaknesses with Claude. Claude Mythos Preview has helped our researchers find weaknesses in cryptographic algorithms - the mathematical methods that are used to keep data private." - Anthropic

The linked research post gives the numbers that make the tweet material. For HAWK, Anthropic says Mythos improved the best-known attack after about 60 hours of work, effectively cutting key strength in half. In one example, the expected cost for full key recovery against HAWK-256 moved from 2^64 to 2^38. For AES, the target was not full AES-128 but a 7-round research variant. Mythos developed a fingerprinting method it named "Mobius Bridge," improving prior attacks by roughly 200-800x depending on runtime assumptions.

Anthropic is careful about impact. Neither result requires production software changes today. HAWK is still a NIST candidate rather than a deployed standard, and the AES result concerns a deliberately weakened version studied by cryptographers. That limit is part of why the work matters: standards processes are designed to surface weaknesses before deployment, and AI may now become part of that adversarial review loop.

The Anthropic account regularly posts Claude research, safety work, and cyber-capability findings. This tweet fits the pattern, but the linked paper is more concrete than typical model capability claims because it names algorithms, attack costs, disclosure steps, and validation work with outside academics and government or industry contacts.

Watch whether NIST reviewers and academic cryptographers begin treating AI-generated attack candidates as routine inputs, and whether labs develop clearer disclosure rules for the harder case: an AI-discovered weakness in a cryptosystem already protecting real users. Source: Anthropic tweet.