Anthropic says Claude Mythos Preview halved HAWK's key strength and sped up reduced-round AES attacks 200 to 800x
- Anthropic's Claude Mythos Preview found a new attack on HAWK, a NIST post-quantum digital signature candidate, cutting its effective key strength roughly in half after just 60 hours of autonomous work despite HAWK surviving two rounds of expert human review over two years.
- Mythos separately found a faster attack on a round-reduced version of AES (the standard symmetric cipher), eliminating one required attacker guess and improving on the best previous attacks by 200 to 800 times.
- Neither result affects deployed systems today: HAWK is only a NIST candidate not yet standardized or used in production, and the AES attack targets a weakened, reduced-round variant rather than full AES.
- Each finding cost roughly $100,000 in API costs to produce, and the AES attack was discovered fully autonomously by Claude using a scaffold built by an Anthropic researcher, while the HAWK attack involved one researcher working alongside the model.
- Anthropic built CryptanalysisBench with researchers from ETH Zurich, Tel Aviv University, and University of Haifa to let others benchmark LLM cryptanalysis capability, and disclosed the HAWK finding to its authors and the NIST mailing list in June.
Hacker News opinions
The multi-agent setup is interesting: one worker rejected the key idea as infeasible, another pursued it and found the exploit, and they converged. Reads more like stochastic search variance across threads than real collaboration insight. Would be worth rerunning the search with perturbed context to see how often it actually finds this path.
My hypothesis is the pairing/collaboration mimics a fiction trope: if one character dismisses an idea, the plot forces the other to pursue it. LLMs are trained on tons of that kind of narrative structure, so this could just be pattern completion rather than genuine reasoning.
Two follow up questions: is this reproducible at some consistent rate across worker pairs, and can you tune models/training to raise the success rate? By itself this isn't obviously good news, but it could point toward something useful.
Wait, in Claude Code style setups subagents don't talk back and forth like this, so they must be using a different harness here.
Odd they're still on 'Mythos Preview' instead of 'Mythos 5', I heard from people with access to both that Mythos 5 is actually less capable.
Maybe it's just more available or has fewer safety guardrails getting in the way, similar to how Fable outperforms Opus 4.8 in cases where Opus just refuses the task.
Anthropic is basically setting up the 'what if a model finds a real world breaking vulnerability' conversation, and there's a not so subtle pitch here that their researchers needed serious cryptography background just to validate the model's claims.
I'd be shocked if Anthropic hasn't already been pulling on these threads privately for as long as they've had access to these models.
What this really shows is how ML augments expert researchers by searching solution spaces and connecting half finished academic results, not that AI is doing cryptanalysis from scratch. There's also obvious publication bias since we never see the dead ends.
We're at the end of hand-written 'artisanal' code being good enough. Neither artisanal code nor AI slop code is acceptable anymore, we needed formal methods years ago.
TL;DR: this is a marginal improvement on the best known academic attack on 7-round AES-128 out of the normal 10 rounds, so full AES is not remotely threatened. The HAWK result is more notable, they halved the effective key length of a NIST post-quantum signature candidate that isn't even standardized or deployed yet.
Important caveat: the AES attack is a chosen-plaintext attack, which is the strongest and least realistic attack model. Modern modes like AES-GCM's counter mode make chosen-plaintext attacks impossible in practice, so this doesn't translate to real world vulnerability.
Worth noting HAWK-256 is a simplified version of the proposed standard, so it's not fully clear the attack carries over to HAWK-512. Never heard of LEA before either, apparently it's a Korean AES-equivalent standard.
If a human researcher found a real world breaking cryptographic vulnerability, would we expect them to react any differently than we're now asking about AI? The disclosure dilemma isn't new just because a model did the finding.