Claude Mythos Preview did something no human had. It stared at a weakened form of AES, the encryption workhorse protecting bank transfers, emails and military secrets, and found a shortcut. Not a small one. The AI sped up the best prior attack by factors of 200 to 1,000.
Anthropic released the details Tuesday. The findings appear in two papers: one on HAWK key-recovery and another on the AES Möbius Bridge. Neither breaks systems in use today. But the speed of discovery raises hard questions. How long before AI models start finding flaws in production-grade cryptography?
AI Steps Into the Mathematicians’ Arena
The HAWK result hit first. HAWK is a post-quantum digital signature candidate still under review by the National Institute of Standards and Technology. It survived two rounds of expert scrutiny. Then Mythos Preview, working in a multi-agent setup with occasional human nudges, spotted a nontrivial automorphism in the underlying lattice. That symmetry sliced the effective key strength in half.
The model needed about 60 hours. Cost ran near $100,000 in API calls. One agent prematurely dismissed the core idea. Its partner pushed forward. They traded messages until both agreed the attack held. The human researcher, strong in theoretical computer science but no lattice expert, mostly managed the workflow.
Result? A key-recovery attack that drops the expected cost for small HAWK-256 from 2^64 to 2^38. Larger keys stay out of reach. Still, the finding forces designers to double key sizes or abandon the scheme. Either choice erodes HAWK’s appeal for post-quantum deployment. Anthropic shared the work with HAWK’s authors in June and coordinated public disclosure via the NIST mailing list.
The AES attack followed a different path. Researchers built a scaffold that let the model generate hypotheses, run experiments and refine. Mythos initially refused the task. “If you want a different outcome, the target has to change,” it replied at one point. “AES-128 r5/r6 is just genuinely hard.” After coaxing, it spent a week on the idea.
Humans then spent far longer verifying. The breakthrough centered on a new fingerprinting technique called the Möbius Bridge. Previous meet-in-the-middle attacks on 7-round reduced AES required guessing 256 values before table lookup. The new method makes the fingerprint invariant to that guess. Combined with other optimizations, attack runtime fell 200- to 800-fold. The paper lays out the full math, correctness proofs and runtime analysis.
Both efforts were validated. Independent cryptographers reviewed the AES work. HAWK’s authors confirmed the key-recovery attack. Anthropic also partnered with academics at ETH Zurich, Tel Aviv University and University of Haifa to release CryptanalysisBench, a benchmark for testing large language models on ciphers. The goal is to let others measure progress without reinventing the infrastructure.
Nicholas Carlini, the Anthropic research scientist who helped run the tests, put the advance in perspective. “They could not do problems that I could do when I was 16,” he told The New York Times. “Now they are doing state-of-the-art research not previously discovered in the field.” Carlini previously worked at Google’s AI division.
But. These are still research attacks. The AES target is a deliberately weakened, reduced-round variant studied precisely because full AES has withstood decades of analysis. No production software needs patching. HAWK has never shipped. The company stressed this point repeatedly. No immediate risk to online banking, private messages or classified data.
Yet the trajectory matters. Cryptographers have long tested weakened versions to probe future limits. AI just accelerated that process dramatically. And it did so with little domain expertise baked in. The model taught itself through literature review, computation and iteration. That autonomy is new.
Glenn S. Gerstell, former general counsel at the National Security Agency, captured the unease. “Given that we are constantly underestimating the power and time of availability of future models, are we really comfortable that two years from now strong encryption won’t be threatened?” he asked in the same New York Times article. Gerstell helped author a 2022 report on cryptology. He added that mathematicians insist current computing power cannot break strong encryption in any practical timeframe. “But I don’t think the capabilities of future models in the medium term — before quantum computing or quantum-proof cryptography — should be dismissed as trivial in this context.”
Anthropic itself frames the work as cryptography functioning correctly. Stress tests expose weaknesses before deployment. The company shared findings with U.S. government agencies and industry partners in advance. Responsible disclosure, they called it. Discussions on broader implications followed.
This isn’t the first time Mythos Preview made headlines. When it debuted in April, the model proved so capable at finding and chaining software vulnerabilities that Anthropic restricted access to select government and enterprise users. It uncovered bugs in major cryptographic libraries, though those involved implementation errors rather than mathematical breaks. The model also surfaced long-hidden flaws in OpenBSD, FFmpeg and FreeBSD, according to earlier company reports referenced across recent coverage.
The pattern is clear. Frontier models keep improving at security tasks. Coding. Bug hunting. Now pure cryptanalysis. Each leap forces a recalibration of risk. Intelligence officials have warned for years that broken encryption would reshape digital life. Nations like China have reportedly stockpiled encrypted intercepts hoping for exactly this kind of breakthrough. Quantum computers add another vector. AI offers a third, one that doesn’t require exotic physics.
So what now? Cryptographers will pore over the new papers. NIST will weigh the HAWK impact during its final review rounds. AI labs will likely expand red-teaming of cryptographic primitives. Some researchers already talk about using models to design the next generation of ciphers rather than just attack them.
Anthropic broadened its own search after these successes and found additional attacks. Details are coming. The company also built tools to let the broader community test LLMs against ciphers. Progress will accelerate. The question is whether defensive cryptography can keep pace.
Encryption underpins the modern internet. From TLS handshakes to VPN tunnels to secure messaging apps, the math has to hold. For now it does. The attacks target reduced versions or candidates. But the demonstration that an AI can autonomously improve on decades of human work in a mathematically rigorous field changes the risk equation. It compresses timelines. It lowers the bar for discovery.
Two years from now. Five years. The models will be smarter. Cheaper. More autonomous. Gerstell’s question hangs there. Are we comfortable? The answer, for many in the field, is shifting. Not because today’s systems are broken. Because tomorrow’s might arrive faster than expected. And the AI that finds the flaw may not wait for human permission to look.