Anthropic has announced that the Claude Mythos Preview model has identified two new cryptanalytic attacks. The first concerned HAWK, a candidate for a post-quantum digital signature standard. The model discovered a previously unutilised mathematical symmetry which reduced the estimated cost of recovering a HAWK-256 key from 2^64 to 2^38 operations. This is still a test variant, but the result has called into question the economic rationale for strengthening HAWK’s larger parameters. On 29 July, the algorithm’s developers withdrew it from the third round of the NIST process.
The second discovery speeds up the best-known attack on AES-128—limited to seven rounds—by a factor of between 200 and 800. The full AES-128 uses ten rounds and has not been broken. The attack also requires amounts of data and computing power that are beyond practical reach. There is therefore no direct threat to banking, cloud services or messaging apps.
What is significant is the change in the way research is conducted. According to Anthropic, each project cost around $100,000 in model access fees, and it took the researchers hundreds of hours to verify the AES result. AI may therefore lower the barrier to entry for advanced cryptanalysis, but it shifts the costs to verification, auditing and the responsible disclosure of results.
For companies, this means a need for greater caution when selecting new standards and for incorporating AI-assisted testing into security processes. At the same time, the discovery does not affect approved NIST standards such as ML-KEM and ML-DSA. The Institute continues to recommend beginning the migration to post-quantum cryptography, as replacing algorithms in products and infrastructure will take years.
