Anthropic’s Claude AI Finds Flaws in Post-Quantum Cipher HAWK and Reduced AES

Anthropic’s Claude Mythos Preview model has discovered two new cryptographic attacks: one on the HAWK digital signature scheme, a candidate for post-quantum security, and another on a reduced version of the Advanced Encryption Standard (AES). The findings, disclosed in coordination with NIST and the HAWK authors, highlight AI’s growing ability to break mathematically challenging encryption. Neither attack has practical impact on today’s systems, but they raise questions about the future of algorithmic design.

The HAWK attack reduces the effective keysize by a factor of two, effectively cutting its key strength in half. For the smallest HAWK configuration, the cost of recovering a secret key dropped from 2^64 to 2^38 operations — roughly 67 million times less work. The attack was discovered in about 60 hours of AI work at a cost of roughly $100,000 in API expenses. Claude Mythos Preview, operating semi-autonomously with occasional human guidance, performed an extensive literature review and mathematical reasoning, then implemented an end-to-end verification pipeline.

The AES attack targets a 7-round reduced version of AES and improves the best known attack — unchanged since 2013 — by a factor of 200 to 800 in speed. It also eliminates one key byte that attackers previously had to guess. Anthropic researchers barred Claude from using established cryptanalysis families and demanded a new approach. The model inherited over 200 failed attack variants from earlier runs and was guided by only three substantive messages over three days. Refining the attack into its published version consumed a billion output tokens.

"On AES-128 r5/r6/r7 it found nothing because there's nothing easy to find; this is the most-studied block cipher in existence." — Claude model, as quoted by Anthropic

Claude also broke 13 rounds of the LEA cipher — a Korean national standard and ISO lightweight encryption standard — in under an hour on a desktop, improving over the prior best attack that required 2^98 plaintext pairs. The HAWK attack works by finding a nontrivial automorphism in the lattice used by HAWK, whose security is based on the hardness of the Lattice Isomorphism Problem. Prior work had proven that finding such an automorphism would permit an attack but did not show its existence.

Anthropic built CryptanalysisBench, a benchmark of 191 tasks for evaluating LLMs on cryptographic work, in partnership with ETH Zurich, Tel Aviv University, and the University of Haifa. On the benchmark, Mythos 5 broke 85.7% of tasks with known solutions, while the weakest model scored 65.3%. Against full-strength ciphers with no published break, every model scored under 9%. The HAWK attack is a full key recovery that runs in a few hours — easy to verify — while the AES speedup requires deeper expert scrutiny and possibly Lean proofs.

"Language models are now discovering so many bugs that standard human triage processes struggle to keep up."

Claude Mythos Preview autonomously found and exploited vulnerabilities in almost every piece of software it was directed at, including major cryptographic libraries — though those were due to implementation errors, not mathematical flaws. In internal testing, Claude had previously found 271 vulnerabilities in Firefox. The HAWK finding was shared with its authors in June and disclosed to the NIST mailing list simultaneously with public release. NIST had moved HAWK to the third round of its post-quantum signature competition in May; HAWK is the last lattice-based candidate standing.

The authors of the HAWK paper noted: "The majority of mathematical discoveries in this paper were AI-assisted. Human author contribution mainly consisted of directing, organizing and verifying AI work." The human operator for the HAWK attack had a background in theoretical computer science but was not a lattice-based cryptography expert. The longer-term implications for blockchains — where signature size affects fees — and for post-quantum standards are still unfolding.