HAWK has gone through two rounds of expert review over two years, but a Claude Mythos Preview they were enough 60 hours to improve the best known attack against that digital signature scheme, effectively halving the strength of the keys. Anthropic published the result along with a second, obtained with the same model against a scaled-down version of AESthe most widespread symmetric cipher in the world.
Neither affects production systems: HAWK is a standard candidate and is not used by anyone, while the attack on AES concerns a seven-round variant of the planned ten, not the complete cipher. Anthropic’s previous work on security had stopped at cryptographic libraries, that is, at the errors made by programmers in implementing algorithms within the code. In this case, however, the key point is very different, since the defects exploited reside in the mathematics of the algorithms themselves. Each of the two discoveries cost approx $100,000 of API consumption.
A symmetry never exploited in the HAWK lattice
HAWK is one of the candidates left in the third round of the call that the NIST opened in 2022 for additional digital signatures ccapable of resisting even a quantum computerthe piece that should replace classic patterns such as RSA and ECDSA when such a machine will become a reality. Its security rests on the difficulty of a mathematical problem called Latex Isomorphism Problem. Mythos identified in the lattice used by HAWK a symmetry never exploited before, a non-trivial automorphism: that a symmetry of that type allowed an attack had already been demonstrated in the literature, but no one had established whether it was really accessible in that lattice.
The resulting attack remains exponential in time, making HAWK much faster to attack. On the smallest size, HAWK-256, the expected cost of a complete key recovery was estimated at 2^64 operations and Mythos brought it to 2^38. For larger keys the attack remains impracticable, but to maintain the same level of security the size of the keys should be doubled, and doubling it erases a good part of the reasons that made HAWK an interesting candidate. The result is specific to this scheme and does not affect other post-quantum candidates or lattice cryptography in general.
The model worked in semi-autonomy within an agentic scaffolding similar to Claude Codewith multiple agents working collaboratively in an isolated environment, access to computational tools such as Python and Sage, and published cryptographic works. The researcher who followed him had a background in theoretical computer science but was not an expert in lattice cryptography, and his contribution limited to work management: how to keep track of ideas, which libraries to use for computational verification. The decisive intuition came from a couple of agents, and with a curious dynamic: the first had discarded the idea as impractical, the second found a way to exploit it to the fullest, and after an exchange of messages both agreed that they had an effective attack in hand.
On the reduced AES the model worked almost alone
The second result concerns AES-128, which encrypts by repeatedly applying the same round function ten times; the attack works on a modified version that does seven rounds per round. Studying reduced-round ciphers is current practice in academic research, because techniques developed on simplified cases can generalize to the entire cipher and because they help estimate the real safety level. The threat model is that of the chosen plaintext: it is assumed that the attacker can have the defender encrypt arbitrary inputs with a fixed and unknown key and see the result, as many times as he wants. The previous works on which the attack is based assume the encryption of 2^105 selected texts, which makes it completely impractical and useful only for quantifying the theoretical cost.
Mythos has joined a long chain of articles looking for the best seven-round AES attack with the meet-in-the-middle techniquewhich trades time for space by storing intermediate calculations and then reusing them. By eliminating one of the guessing attempts that the attacker must make, he brought the speed from 200 to 800 times beyond the previous best result. How he got there is almost more interesting than the result: at first he refused to tackle the problem, deeming it impossible to improve existing analysis methods, and only after some prodding did he work on the puzzle for about a week until he built the attack, producing a billion tokens in output and christened the technique “Möbius Bridge”.
The attack on HAWK was confirmed by the authors of the scheme, the one on AES was examined by independent cryptographers, and two human researchers worked for almost a month to verify that the method was correct. Anthropic says it followed responsible disclosure procedures: The attack on HAWK was shared with the authors in June and made public on the NIST mailing list at the same time as the announcement, while advance copies went to the US government and industry partners. Together with the results, CryptanalysisBench was published, a collection of ciphers built with ETH Zurich, Tel Aviv University and Haifa University to measure the cryptanalysis capabilities of language models.
Subsequent attacks and the previous SIKE
After the first two results Anthropic has expanded its search and started finding more, which it plans to document soon: A practical attack on LEA reduced to 13 rounds that recovers the keys in less than an hour on a normal desktop computer, plus attacks on Serpent-128, Salsa20, Poseidon and SHA-1.
A late discovery in a standardization process is nothing new. During the NIST standardization of ML-KEM and ML-DSA several competing proposals turned out to be insecure, and one of them, SIKE, was completely broken in an hour on a laptop: the specifications are published precisely for a wide audience to review before they end up in production. Anthropic points out that in one year, language models went from being unable to perform cryptanalysis of even the most basic ciphers to finding flaws in cryptographic designs that escaped years of review by human experts.
