Article: Claude Mythos, Anthropic’s new AI research preview, flagged critical weaknesses in two cryptographic constructions in a single run. In the HAWK-256 signature scheme the model identified a lattice symmetry that cuts the theoretical security level from 2⁶⁴ down to 2³⁸, and in a 7-round variant of AES-128 it applied a “Mobius Bridge” technique that speeds attacks by roughly 200-800 times.

Why the findings matter

Both ciphers sit at opposite ends of the security spectrum. HAWK-256 is being groomed as a post-quantum signature algorithm that could protect future communications against quantum computers. AES-128, by contrast, encrypts the bulk of today’s internet traffic, from banking to cloud storage.

The road to the discovery

Human researchers examined HAWK for two years without reporting a flaw. They focused on the algorithm’s lattice-based math, which is notoriously hard to probe exhaustively. Claude Mythos found a mathematical symmetry in the lattice structure that humans missed. That symmetry enables a key-recovery attack, reducing the effort needed to forge a signature from roughly 2⁶⁴ operations to about 2³⁸—still out of reach for current hardware but a dramatic theoretical downgrade.

The AES-128 result is more narrowly scoped. Researchers routinely trim AES to fewer rounds to study its internals; the 7-round version is a common testbed. Claude Mythus introduced a novel “Mobius Bridge” method that links algebraic properties across rounds, shaving off a factor of 200-800 compared with the best known attacks on that same reduced cipher. The AI did not break the full version of AES.

Both breakthroughs cost the project six-figure sums in API usage, and human analysts logged hundreds of hours to verify the AI-generated leads, especially for the AES case where the attack had to be reproduced and its speedup quantified.

Who wins, who worries

  • Researchers gain a new analytical tool. The AI generates candidate patterns, freeing experts to concentrate on proof work and speeding the discovery pipeline.
  • Standards committees receive an early warning. Although HAWK remains under evaluation and the AES attack targets a weakened version, the findings show that algorithmic assumptions can be brittle.
  • Vendors and users can breathe a sigh of relief for now. Neither vulnerability touches a deployed system; HAWK has not been rolled out, and the AES attack applies only to a research-only variant.

The hidden costs

Running Claude Mythos at the scale needed to scour lattice structures and AES round transformations required substantial compute spend—six figures per discovery. That expense, while justified for high-impact research, raises questions about the economics of AI-assisted cryptanalysis at larger scales.

Human verification remains the bottleneck.

Counter-point: not a panic button

Critics argue that the results are overhyped because they do not affect any production environment. Until a concrete exploit against a live system appears, the immediate risk stays theoretical.

What to watch next

  • Further AI audits of other post-quantum candidates.
  • Re-evaluation of AES-128 research practices.

The bottom line: AI can surface cryptographic weaknesses that human eyes miss, but turning a hint into a confirmed flaw still demands seasoned analysts. Claude Mythos’ twin discoveries underscore both the promise and the limits of machine-first security research.