The Second Reading: Claude Mythos Just Did Real Cryptanalysis — HAWK, AES and the Thin Margin of Post-Quantum

On July 28, Anthropic published something the security community has been both expecting and dreading: the first credible, peer-checkable case of a frontier AI model doing original cryptanalysis. An unreleased research configuration of Claude Mythos — the gated sibling of the Fable line — found two previously unknown attacks. One of them targets HAWK, a lattice-based signature scheme competing to become a US federal post-quantum standard. Human reviewers had spent roughly two years scrutinizing it. The model needed about 60 hours.

What was actually found

• HAWK: the model identified a structural symmetry in the scheme’s underlying lattice that no published analysis had exploited. For the smallest parameter set (HAWK-256, the research-grade configuration), key-recovery cost drops from roughly 2⁶⁴ operations to about 2³⁸ — a factor of ~67 million. That does not break the deployed-parameter variants, but it removes a comfortable chunk of the security margin on a scheme mid-standardization.
• AES (reduced-round): the model invented a genuinely new technique — Anthropic calls it the Möbius Bridge — that accelerates a known attack on a deliberately weakened research variant of AES by 200–800×. Full AES, the thing in your TLS stack, is untouched.

Both results were verified by human cryptographers before publication. Nothing protecting real-world data is broken today. If you see headlines implying your bank is exposed, they are wrong. What is new — and it is genuinely new — is where the results came from.

Why this is a different kind of milestone

Cryptanalysis has a specific epistemic status: it is adversarial mathematics with no partial credit. You cannot bluff a key-recovery attack; either the attack recovers the key at the claimed cost or it does not. That makes this a much harder-to-dismiss capability demonstration than benchmark scores or competition medals. A model produced novel, verifiable mathematical structure that a competent, motivated human community had missed for two years — in a domain where missing things is the entire failure mode.

The HAWK finding matters most for what it says about the post-quantum migration itself. The PQ candidate schemes are young. Classical RSA and elliptic-curve crypto have absorbed four decades of attack attention; lattice schemes have had a fraction of that, and the reviewer pool that deeply understands them is small. AI-assisted cryptanalysis just multiplied the effective size of that reviewer pool — for defenders and, eventually, for attackers. Young schemes with thin analysis are exactly where cheap, tireless mathematical search changes the equation.

The defender’s window

Here is the asymmetry worth exploiting: right now, this capability sits inside a gated model, pointed at schemes before they are deployed, with results published responsibly. That is the good timeline — flaws found during standardization cost a parameter revision; flaws found after deployment cost a migration. The uncomfortable corollary is that the window is temporal, not structural. Open-weight models are three to five months behind the frontier and closing, as this month has made abundantly clear. Assume the same search capability becomes broadly available, then plan backwards.

What this means for practitioners

• Crypto-agility stops being a nice-to-have. If a standardized scheme can lose 26 bits of security margin to a novel symmetry, your systems need to be able to swap signature schemes and key sizes without a rewrite. If your PQ migration plan hardcodes one algorithm, it is a bet, not a plan.
• Expect standardization timelines to wobble. HAWK’s team now has a symmetry to patch or parameters to raise. More broadly, expect every serious candidate scheme to face AI-driven re-review — which is healthy, and will be noisy.
• The lesson generalizes past crypto. The same property — tireless search over adversarial structure — applies to your protocol designs, your authorization logic, your parsers. AI-assisted review of high-assurance code is about to get very good, and it will not be polite about what it finds.
• Watch the dual-use line. Anthropic ran this inside a gated model with human verification and coordinated disclosure. The infrastructure for doing this responsibly at ecosystem scale — who gets access, who verifies, who is told first — does not exist yet. That is the same gap the Pacing the Frontier letter is pointing at, from a different angle.

For years, the honest answer to “can LLMs do real math research” was “not really — they remix.” A verified 2²⁶ improvement against a federal standards candidate is not remixing. The models have started reading the math the way cryptanalysts do: looking for the symmetry the author did not know was there. Every scheme, protocol and proof written before 2026 was reviewed by humans only. That corpus is about to get a second reading.