Claude Mythos Shows AI Can Outpace Human Cryptography Research

Anthropic’s Claude Mythos found new flaws in HAWK’s post-quantum scheme and sped up an AES attack 800x — work human experts missed for years.

Anthropic has published two cryptographic research results produced by Claude Mythos Preview working mostly autonomously: an improved attack on HAWK, a post-quantum digital signature scheme currently under NIST review, and an attack up to 200 to 800 times faster on a reduced-round version of AES. Neither result breaks any system in production today, but together they demonstrate that frontier AI can now perform original cryptographic research at a level that two years of human expert review failed to achieve.

“When we launched Claude Mythos Preview, we showed it was able to autonomously find and exploit vulnerabilities in almost every piece of software we pointed it at. This included several major cryptographic libraries — shared collections of code that are used to encrypt data,” Anthropic wrote in its announcement. Those earlier vulnerabilities came from incorrect implementation of cryptographic algorithms — errors in how programmers used the algorithms in code. This time, Anthropic said, “we have found that Claude is able to find mathematical flaws in the algorithms themselves.”

A Faster Attack on a Post-Quantum Signature Scheme

The HAWK result is the more immediately significant of the two. HAWK is one of the remaining third-round candidates in NIST’s post-quantum cryptography standardization process, which has been running for nearly a decade. Mythos identified a previously unexploited symmetry in HAWK’s underlying mathematical structure — a nontrivial automorphism — that enables a faster enumeration attack and effectively cuts the scheme’s key strength in half. For the smallest HAWK-256 key size, the expected attack cost drops from 2^64 operations to 2^38. Doubling HAWK’s key size would restore the original security level, but doing so would eliminate most of the practical advantages that made the scheme an attractive post-quantum candidate in the first place.

The discovery took 60 hours, coordinated by a single Anthropic researcher who was not an expert in lattice-based cryptography. “To find the attack, Claude Mythos Preview worked semi-autonomously in an agentic harness, with occasional human guidance and nontechnical direction. Mythos found the attack after an extensive literature review to understand the state of the art, and substantial mathematical reasoning and computational experiments,” Anthropic said. “After finding the attack, Mythos implemented an end-to-end verification pipeline to convince itself — and the human operator — of the attack’s correctness.”

The multi-agent workflow produced a notable dynamic: two worker agents investigated the same idea in parallel. One rejected it as infeasible; the other found a way to exploit it fully. The two kept exchanging messages until both agreed they had found something real. Total API cost for the discovery was approximately $100,000.

An 800x Faster Attack on Reduced-Round AES

The second result took longer to produce and, notably, far longer for humans to validate than for Mythos to discover. Working for three days and generating several hundred million output tokens, Mythos produced what Anthropic calls a “Möbius Bridge” — a fingerprinting technique that eliminates one of the guesses an attacker needs to make in a meet-in-the-middle attack on 7-round AES, then compensates for the added computational cost with several optimization techniques. The attack does not touch the full 10-round AES-128 used in production systems.

The discovery process was almost entirely autonomous. The researcher’s interventions amounted to just three substantive prompts across three days — one of which simply instructed the model to keep searching for genuinely novel ideas rather than settling for incremental gains. “Compared to the one week that Mythos spent conceiving the idea, the vast majority of human researchers’ time was spent validating the correctness of its claims (though it is important to note the researchers are not experts in cryptography),” Anthropic’s technical paper states. Two researchers spent close to a month gaining enough confidence in the result to write it up.

Additional Findings and Responsible Disclosure

Beyond the two headline results, Mythos also developed a practical attack recovering a 13-round LEA key using fewer than 2^30 encrypted plaintexts, running in under an hour on a modern desktop — a dramatic improvement over the prior best-known attack, which required 2^98 plaintext pairs and 2^86 work. Preliminary results also touched 6-round Serpent-128, with more limited improvements against Salsa20, the Poseidon hash function, and SHA-1.

Anthropic followed responsible disclosure practices throughout, sharing the HAWK finding with the scheme’s authors in June 2026 before coordinating public disclosure to the NIST mailing list alongside the release of its technical paper.

What It Means for Cryptography Research

Anthropic frames the broader implication plainly: in the span of one year, language models went from being unable to perform cryptanalysis of basic ciphers to finding flaws in designs that had escaped years of expert human review. The security community is already struggling to keep pace with the sheer volume of software bugs AI models can find, and Anthropic predicts the same bottleneck is coming for academic cryptography research, where human researchers may increasingly spend months validating results a model produced in a matter of days.

“Our result here — that Claude is able to perform cryptographic research at the level of top experts — indicates that these same capabilities also have applications in the field of cryptography, and thus may soon have more practical consequences,” Anthropic concluded. “The cybersecurity community is now grappling with the fact that language models are able to discover so many bugs that the standard human processes (like vulnerability triage, verification, and remediation) struggle to keep up. We predict that the same will soon be true in academic cryptography research.”