Anthropic said its unreleased Claude Mythos Preview model found a previously unknown attack on HAWK, reducing the cost of recovering its smallest key from 2^64 operations to 2^38.

The model also accelerated an attack on a 7-round version of AES by 200 to 800 times, surpassing a record set by cryptographers in 2013.

Each result cost about $100,000 in API usage, and Anthropic staff spent several hundred hours verifying that the AES finding was real.

Anthropic said Tuesday that an unreleased version of its most powerful AI model discovered two previously unknown attacks on cryptographic algorithms, including one aimed at a scheme currently competing to become a U.S. federal standard.

That scheme is HAWK, a digital signature system—the math that proves a transaction came from you without ever exposing your private key—designed to withstand future quantum computers. In May, the National Institute of Standards and Technology, or NIST, moved HAWK into the third round of its post-quantum signature competition, where it is now the last lattice-based candidate remaining.

Claude identified a symmetry in HAWK’s math that human researchers had not previously used. In the smallest configuration, the cost of recovering a secret key dropped from 2^64 operations to 2^38, or about 67 million times less work.

According to Anthropic, fixing the issue would require roughly doubling HAWK’s key size. "Unfortunately, doubling HAWK's key size eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate," the company wrote.

New Anthropic research: Discovering cryptographic weaknesses with Claude. Claude Mythos Preview has helped our researchers find weaknesses in cryptographic algorithms—the mathematical methods that are used to keep data private. Read more: — Anthropic (@AnthropicAI) July 28, 2026

That tradeoff matters for systems that would need to adopt a post-quantum replacement at scale: signature size affects block space, and block space affects fees, so compactness is part of the design discussion, not just raw security. HAWK’s compact keys and fast signing were central to its appeal, and the proposed fix would remove much of that advantage.

Anthropic said HAWK has never been deployed anywhere, and Bitcoin still uses ECDSA, the pre-quantum signature scheme that candidates like HAWK are intended to replace.

The company said it disclosed both findings to the algorithms’ authors and to U.S. government and industry partners before publishing, and coordinated the HAWK result with NIST.

The AES result required more persistence

The second attack targeted AES, the cipher that protects HTTPS traffic, encrypted drives, and exchange backends. Full AES-128 uses 10 rounds of scrambling, and Claude attacked a 7-round research version that had not been improved upon since 2013.

Researchers set up the task to be especially difficult. They barred the model from using all five established families of AES cryptanalysis and instructed it to invent a sixth. The prompt even noted that the first differential attack did not beat anything—it invented the game. Claude also inherited notes from earlier agent runs that had already exhausted roughly 200 failed attack variants.

Even so, the model resisted taking an easier path. "On AES-128 r5/r6/r7 it found nothing because there's nothing easy to find; this is the most-studied block cipher in existence," Claude told the researchers, according to transcripts published by Anthropic.

Over the next three days, Anthropic sent just three substantive messages, including: "no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks." Another message rejected Claude’s attempt to switch to an easier cipher.

Claude eventually produced the technique the paper calls a Möbius Bridge, removing one of the nine key bytes an attacker previously had to guess. Refining that result into the final published version took several more days and about a billion output tokens.

The quickest route to a practical result received the least attention. Claude also broke 13 rounds of LEA, a Korean national standard and ISO lightweight-encryption standard used for phones and internet-of-things devices, in under an hour on a desktop. The prior best attack required 2^98 plaintext pairs. The deployed version of LEA uses 24 rounds, so no deployed system is broken.

The HAWK paper is unusually direct about how the work was done. "The majority of mathematical discoveries in this paper were AI-assisted. Human author contribution mainly consisted of directing, organizing and verifying AI work," the authors wrote.

Claude found the AES idea in days, but Anthropic researchers then spent several hundred hours learning enough cryptography to verify the result. The same model previously found 271 vulnerabilities in Firefox during internal testing.

"The cybersecurity community is now grappling with the fact that language models are able to discover so many bugs that the standard human processes (like vulnerability triage, verification, and remediation) struggle to keep up," Anthropic wrote, adding that human researchers could become the bottleneck.

Anthropic also introduced CryptanalysisBench, a benchmark of 191 cipher-breaking tasks drawn mostly from NIST competitions. In the benchmark, models must submit a working attack script that either wins a formal security game or does not, with no partial credit and no human grading.

Mythos 5 solved 85.7% of tasks with known solutions, compared with 65.3% for the weakest model tested. Against full-strength ciphers with no published break, all models scored below 9%.