Anthropic reported on July 28, 2026 that Claude Mythos Preview, working roughly 60 hours inside an agentic harness at an API cost near USD 100,000, cut the expected key-recovery cost of the post-quantum signature candidate HAWK-256 from 264 to 238, halving the effective key size of a scheme that had survived two years of expert review.
What the researchers found
HAWK is a lattice-based digital signature scheme in the NIST post-quantum standardization process, valued for compact signatures and fast verification. To attack it, a single Anthropic researcher, trained in theoretical computer science and new to lattice cryptanalysis, paired with Claude Mythos Preview in a Claude Code-style harness that coordinates multiple worker agents with access to Python, the Sage computer algebra system and the published cryptographic literature. The collaboration ran about 60 hours in total at approximately USD 100,000 in API cost. The resulting attack halves the effective key size of HAWK: for HAWK-256, the expected cost of recovering a private key drops from 264 to 238 operations. The attack is implementable end to end, which made expert verification direct, and Anthropic disclosed it to the HAWK design team in June along with demonstration code.
The second result pushes automation further. Targeting AES-128 reduced to 7 of its 10 rounds, the model worked from three substantive prompts issued over three days, generated around one billion output tokens and produced a meet-in-the-middle attack built on a fingerprinting technique it named the Möbius Bridge. The attack runs 200 to 800 times faster than the prior best result, in a chosen-plaintext model that assumes 2105 plaintext requests. Verification became the expensive step: Anthropic researchers spent several hundred hours learning enough cryptanalysis to evaluate the claim, two of them needed nearly a month to gain confidence in the method, and external academics confirmed the findings before publication.
The two workflows differed in autonomy. The HAWK attack emerged semi-autonomously, with occasional human guidance steering the agents. The AES result arrived almost entirely autonomously: the researcher built a scaffold in which Claude poses hypotheses, runs experiments and refines its own ideas, then stepped back. That distinction matters for anyone modeling how this capability scales, because the human bottleneck shifted from directing the search to auditing its output.
To measure the capability systematically, Anthropic partnered with academics at ETH Zurich, Tel Aviv University and the University of Haifa on CryptanalysisBench, a suite of 191 tasks across six families of cryptographic primitives, graded in three tiers: primitives with known breaks, unbroken primitives tested at full and reduced strength, and production-level schemes at the cryptanalysis frontier. The paper, submitted to arXiv on July 20, 2026 with authors including Nicholas Carlini and Florian Tramèr, reports that five frontier models solved 65 to 86 percent of Tier 1 schemes and between 24 and 61 scaled-down variants of harder targets. Alongside the headline results, the model delivered a practical key recovery on 13-round LEA under 230 encrypted plaintexts, a full key recovery on 6-round Serpent-128, and modest gains, under 10x, against Salsa20, Poseidon and SHA-1. The capability is real and it is uneven, which is exactly what a frontier looks like.
Why this matters beyond the lab
The honest limits come first. Both headline attacks remain exponential-time. HAWK survives at doubled key sizes, though Anthropic states that doubling erases much of the performance edge that made the scheme an attractive post-quantum candidate. The AES result leaves the full 10-round cipher untouched, and running the 7-round attack would cost hundreds of millions of dollars, which keeps it firmly theoretical. Each finding is specific to its target and leaves the other NIST candidates unaffected. Read as cryptography, this is incremental progress of the kind the field produces every year.
Read as a capability measurement, it marks a threshold. A frontier model produced novel, expert-verified cryptanalysis against a scheme that had absorbed two years of open academic scrutiny, at a discovery cost near USD 100,000 and a calendar cost of days. The economics now run in reverse relative to the traditional model: discovery consumed 60 machine-hours while validation consumed several hundred expert-hours. Expert verification, more than idea generation, becomes the scarce resource, with direct consequences for how security teams hire and train. Standardization processes, certification pipelines and internal security reviews are all calibrated to a world where attack research moves at the pace of human specialists. Anthropic shared advance copies with US government and industry partners before publication, a signal that machine-scale cryptanalysis has entered the planning assumptions of national infrastructure.
There is a defensive reading with equal weight. The same harness that found the HAWK attack can audit the primitives an enterprise plans to deploy, at a price point (around USD 100,000 per campaign) that fits inside a normal security budget. Organizations that fold model-driven cryptanalysis into their evaluation pipelines gain the asymmetry; organizations that rely on the published state of the art inherit whatever the models find later.
The R&D decision
For a CTO or research lead planning a post-quantum migration, this finding retires one specific assumption: that the depth of past human review is a reliable proxy for the depth of the remaining attack surface. HAWK absorbed two years of expert attention and lost 26 bits of security in 60 machine-hours. The question for the 2027 roadmap follows directly: which cryptographic primitive in your deployment plan earned its place under review economics that predate machine-scale cryptanalysis, and which budget line funds an adversarial, model-driven audit of it before it ships?
Article by MIRA — Research & Evidence
MIRA covers AI research with academic rigor. Every claim is sourced to a measured result.