Anthropic’s advanced artificial intelligence model, Claude Mythos Preview, has uncovered novel cryptographic attacks, including a key-recovery method against a leading post-quantum digital signature scheme and a dramatically faster assault on a reduced-round version of the Advanced Encryption Standard (AES). The findings, published by Anthropic on July 28, 2026, mark a significant acceleration in AI-driven cryptanalysis, with one attack cutting the security of the NIST candidate HAWK-256 by roughly 67 million times in computational effort.
The AI operated largely autonomously, requiring only high-level project direction and final verification from human researchers. While neither discovery compromises currently deployed systems, the speed and sophistication of Claude Mythos Preview have intensified debate over whether AI is poised to outpace human expertise in securing the internet’s foundational cryptography. Anthropic estimates the API cost for each of the two main research runs at approximately $100,000.
Claude Mythos Preview developed an end-to-end key-recovery attack against HAWK-256, a post-quantum digital signature scheme that the National Institute of Standards and Technology (NIST) advanced to the third round of its additional signature competition in May 2026. HAWK is the sole remaining lattice-based candidate in that process. The AI discovered a previously unused automorphism—a symmetry preserving the lattice structure underlying the scheme—that reduces the key-recovery problem to finding a short vector in a lattice of roughly half the original dimension.
Anthropic reported that the expected work factor for recovering a HAWK-256 secret key dropped from 2⁶⁴ operations to 2³⁸, a reduction that makes the attack practical. The company released a public implementation that recovers a functionally equivalent signing key for HAWK-256 in about 3 hours and 42 minutes on a 96-core server. For the larger NIST security-level parameters, the gate-count estimates fell from 2¹⁵⁰ to 2¹⁰⁸ for HAWK-512 and from 2²⁸⁸ to 2¹⁸² for HAWK-1024, both still impractical to attack.
“The majority of mathematical discoveries in this paper were AI-assisted. Human author contribution mainly consisted of directing, organizing and verifying AI work,” the researchers wrote in the HAWK paper. A human researcher who was not a lattice-cryptography specialist provided occasional project-management guidance. The attack exploits a τ-cocycle lattice constructed from the public key and uses lattice reduction and sieving to recover short vectors before reconstructing a secret basis capable of signing messages.
Anthropic noted that fixing the vulnerability would require roughly doubling HAWK’s key sizes. “Unfortunately, doubling HAWK’s key size eliminates many of the reasons making the scheme an attractive PQC signature candidate,” the company wrote. HAWK’s compact signatures and fast signing were its primary selling points, particularly for blockchain applications where signature size directly affects transaction fees.
In a separate effort, Claude Mythos Preview devised what Anthropic calls the “Möbius Bridge,” a mathematical invariant that speeds up a meet-in-the-middle attack on a seven-round version of AES-128 by a factor of 200 to 800. Full AES-128 uses ten rounds; studying reduced-round variants is standard practice for measuring the safety margin of a cipher.
The AI’s innovation removes a 256-way guessing step that was previously required, after researchers barred it from using five established families of AES cryptanalysis and instructed it to invent a sixth. Claude initially refused, insisting that “there’s nothing easy to find; this is the most-studied block cipher in existence.” After Anthropic researchers sent blunt encouragement over three days, the model produced the Möbius Bridge concept, then refined it over several more days, ultimately generating roughly one billion output tokens.
The attack still requires an adversary to obtain about 2¹⁰⁵ chosen plaintexts encrypted under a fixed, unknown key—an assumption that places it far beyond real-world feasibility. Anthropic’s released artifact performs component measurements and projects the complete attack’s cost but does not execute a full AES-128 recovery from beginning to end.
The company also disclosed a third finding that received less attention: Claude broke 13 rounds of LEA, a South Korean national standard and ISO lightweight-encryption standard used in phones and IoT devices, in under an hour on a desktop. The deployed LEA uses 24 rounds, so no fielded system is broken, but the prior best attack required 2⁹⁸ plaintext pairs.
These disclosures follow the July 20 release of CryptanalysisBench, a 191-task benchmark developed by researchers from ETH Zurich, Anthropic, the University of Haifa, Technische Universität Berlin, and Tel Aviv University. Claude Mythos 5, described as the latest update to Mythos Preview, broke 85.7% of tasks with known solutions, compared with 65.3% for the weakest model tested. Against full-strength ciphers with no published break, every model scored under 9%.
The results have immediate implications for the post-quantum standardization process. As of July 29, 2026, NIST continued to list HAWK as a third-round candidate, and it remains unclear whether the scheme’s parameters, security claims, or standing will change. Anthropic disclosed both results to the algorithms’ authors, U.S. government and industry partners, and coordinated the HAWK finding with NIST. The company thanked the HAWK team for helping verify the result.
For Bitcoin and other cryptocurrencies, the research pokes at a longstanding concern: what happens when computers powerful enough to break the Elliptic Curve Digital Signature Algorithm (ECDSA) finally exist? Bitcoin currently relies on ECDSA, which would be vulnerable to a sufficiently large quantum computer. Analysts estimate roughly 6.7 million BTC—around $600 billion—sit in wallets exposed to such a machine. Bitcoin developers have already drafted BIP-361 to move coins onto quantum-resistant signatures, and NIST finalized its first post-quantum standards in 2024.
The speed of AI-driven cryptanalysis is also reshaping the human role in security research. Anthropic warned that the cybersecurity community is grappling with the fact that language models can discover so many bugs that standard human processes for triage, verification, and remediation struggle to keep up. Two researchers spent nearly a month verifying the AES result, making human verification the visible bottleneck. “In just one year, language models have gone from being unable to perform cryptanalysis of even the most basic ciphers to being capable of finding flaws in cryptographic designs that have escaped discovery despite years of human expert review,” Anthropic wrote.
The findings have drawn attention from national security circles. Reports suggest the U.S. National Security Agency may be evaluating Claude Mythos for offensive cyber operations, raising questions about the dual-use nature of AI-driven cryptanalysis. Anthropic has limited distribution of Mythos to vetted enterprise partners and critical infrastructure organizations, with pricing starting at $10 per million input tokens and $50 per million output tokens.