AI-Driven Stress Tests of Cryptographic Systems Find Flaws

Artificial Intelligence & Machine Learning
,
Encryption & Key Management
,
Governance & Risk Management

Cryptographers Welcome LLM-Driven Results, Including to Test Quantum-Safe Crypto

Mathew J. Schwartz (euroinfosec) •
July 29, 2026    

See Also: OnDemand | Security Operations in the Age of AI

Using American artificial intelligence giant Anthropic’s Claude, the researchers found a way to more efficiently attack HAWK, which is a post-quantum digital signature candidate – not a standard – currently under review by the U.S. National Institute of Standards and Technology. They also demonstrated a technique to break a weak version of the Advanced Encryption Standard, up to 800 times faster than ever before.

“Before you panic, it’s not going to render everything useless overnight. What it does show is how they can be useful in examining new candidates, or even old ones,” said Alan Woodward, a professor of computer science at England’s University of Surrey, commenting on the LLM-driven findings.

Anthropic emphasized that while its LLM-driven stress tests of two cryptographic algorithms using cryptanalysis – the study of finding weaknesses in cryptographic schemes – produced interesting results, no real-world systems are at risk.

“To be clear, neither of these results has a practical impact on today’s computer systems; no production software will have to change as a result. HAWK is only a candidate signature scheme and so is not deployed; our second attack is on a reduced version of AES and does not break the full cipher,” Anthropic said in a Tuesday blog post announcing the research.

“Nevertheless, both results show the potential for frontier AI models to help discover flaws in important cryptographic algorithms, both before and after real-world deployment. This is cryptography research working as intended: stress-testing algorithms to build trust and ultimately make systems more secure,” the company said.

Working with researchers at ETH Zurich, Tel Aviv University and TU Berlin, Anthropic has also built and released CryptanalysisBench, which is designed “to help track if (or when) AI cryptanalysis becomes a serious factor and as a scaffold for stress-testing candidate schemes before deployment.” Researchers envision the tool, which taps multiple LLMs, being used to study not just newly introduced cryptosystems, but also already-deployed cryptosystems for which no known attacks exist, to stress-test whether that’s really true.

Ease of use and access is another factor: Anthropic also noted that the researchers who found the AES and HAWK flaws were computer scientists, but not cryptographers.

Studying How AES Breaks

Because it gets used to secure everything from WiFi traffic and web browsing to cloud storage and messaging apps, AES remains a repeat cryptanalysis focus.

Cryptographers often use a deliberately weakened version of the algorithm to study potential attacks against it. Such attacks are possible because AES uses an S-box, for substitution box, which is a lookup table. While many cryptosystems rely on randomness, AES instead uses S-boxes across multiple rounds to scramble bytes in a way that makes them difficult to recover without the key.

The reduced-round attack discovered by Claude can’t be used to effectively target non-weakened versions of AES. “So, it’s not panic time, but it shows a very interesting direction of travel,” Woodward told ISMG.

“If you were just to try and brute force something like AES, it would take longer than the age of the universe to actually do it. But there are other ways of having a go at it, and as these AIs – particularly the large language models – scale, we’re at the point where we’re talking about trillions of weights in some of these models,” meaning they’ve got the power required to approach these challenges from sometimes unexpected directions,” he said.

Direction of Travel

“Many ciphers protecting modern systems have received less scrutiny than they deserve. They might still have important weaknesses lying dormant that LLMs will soon be able to discover,” Anthropic said.

Some AI firms have a reputation, legitimate or not, for marketing product advancements to within an inch of their life (see: Anthropic Calls Its New Model Too Dangerous to Release).

But multiple cryptographers and cybersecurity experts have welcomed Anthropic’s cryptanalysis findings. In the words of technologist Bruce Schneier: “Still early results, but this is definitely something to watch.”

“Sobering” is how Matthew D. Green, a cryptographer and professor at the Johns Hopkins Information Security Institute, described the findings, in part because it shows the “impressive” cryptanalysis results that LLMs can deliver, as well as how much they’ve improved, even compared to the “silly mistakes” tools such as Claude made earlier this year, he said.

These LLM-driven capabilities arrive at a time when they’re arguably needed more than ever, with the world continuing to adopt quantum-safe cryptography. “Having massive cryptanalysis resources come on line just as we’re beginning a major tech transition in public-key crypto is about as ideal a time as you could get,” Green said.

Another benefit of LLMs is that they can require relatively few people to run. Anthropic said its HAWK research was the result of one researcher with a background in theoretical computer science – but not cryptography – spending about 60 hours to develop the attack. The firm said two researchers worked on the reduced-round AES attack over the course of three days, but only submitted three prompts to the LLM.

Even so, validating the reduced-round AES attack required two researchers spending nearly a month of their time to train themselves in cryptography and review the results.

“The biggest barrier to these results is that verifying them is now the hard part. Current models will happily produce false ‘result slop’ that takes hours for an expert to unravel. This is now the killer,” Johns Hopkins’ Green said.

Cost is another factor. Anthropic said the two attacks its researchers demonstrated cost about $100,000 each in Claude tokens. While expensive, that isn’t out of reach for all potential users.

“It’s not the sort of thing that people are going to be doing at home, but it’s certainly going to wake up a few people in government circles and people that have the resources to do these things,” the University of Surrey’s Woodward said.