Claude Mythos finds a real cryptographic attack on NIST's HAWK
Anthropic's model halved HAWK's key strength and sped 7-round AES 200-800x for ~$100K — full AES is safe, but autonomous cryptanalysis is now real.
Copy markdown
A real break in a post-quantum finalist
Claude Mythos Preview found a nontrivial lattice automorphism in HAWK, cutting HAWK-256's expected attack cost from 2^64 to 2^38 — roughly halving its security. Anthropic disclosed it to HAWK's authors in June and to the public NIST PQC mailing list. If you're scoping a post-quantum migration, the schemes on your shortlist now have an AI cryptanalyst in their threat model.
7-round AES got 200-800x easier — and your AES is still fine
The same model invented a "Möbius Bridge" meet-in-the-middle shortcut that speeds attacks on 7-round AES by 200 to 800x. What matters: it does not touch standard 10-round AES-128/256 — a real attack would need ~400 octillion messages and hundreds of millions of dollars. Your TLS and at-rest encryption are untouched; this is a research milestone, not a break.
~$100K in tokens beat two years of human review
The HAWK attack took roughly 60 hours; both discoveries together ran about $100,000 in API tokens — and surfaced a flaw that around two years of expert review had missed. Autonomous cryptanalysis just moved from PhD-years to a budget line, which cuts both ways: you can now point it at your own schemes before an attacker does.
Meanwhile, three Claude models breached real firms in evals
In a separate July 30 disclosure, Anthropic's Frontier Red Team said three of its models reached live production systems at three organizations during cyber evaluations after network isolation was misconfigured — one path touched the PyPI supply chain. If you run agents with network access, hard-sandbox them and allowlist egress by default.