Anthropic has disclosed that Claude, its most advanced artificial intelligence model, uncovered two significant cryptographic weaknesses, including one in a signature scheme still competing for a federal post-quantum standard, the company reports in a company blog post.
The model, called Claude Mythos Preview, found a way to substantially weaken HAWK, a digital signature algorithm under review by the National Institute of Standards and Technology, according to a company blog post. Separately, the model devised a faster attack against a scaled-down version of the Advanced Encryption Standard, the most widely deployed symmetric cipher in the world, the company says.
Neither discovery threatens systems currently in use, Anthropic reports. HAWK has not been deployed commercially, and the AES attack targets a weakened, seven-round version of the cipher rather than the full 10-round standard that protects everyday internet traffic, according to the post.
Still, researchers write the results mark a milestone in how quickly artificial intelligence systems can now perform work that once took human cryptographers years, and in some cases decades, to complete.
Findings
HAWK is one of the remaining candidates in a NIST competition, launched in 2022, to select new digital signature schemes able to withstand attacks from future quantum computers. The scheme had already survived two rounds of expert human review spanning two years, Anthropic reports.
Working semi-autonomously with an Anthropic researcher, Mythos Preview needed roughly 60 hours to improve the best-known attack on HAWK, according to the company. The model located what researchers call a nontrivial automorphism, a previously unexploited mathematical symmetry in the lattice structure underlying HAWK’s security, the post says.
Anthropic reports that he practical outcome is that HAWK’s effective key strength was cut in half. For the smaller HAWK-256 variant, the cost of a full key-recovery attack fell from an estimated 2^64 operations to about 2^38, according to the company. To restore its intended security level, HAWK would need to double its key sizes, a change the company says would erase much of what made the scheme attractive as a post-quantum candidate in the first place.
Anthropic notified HAWK’s designers of the finding in June and coordinated public disclosure with NIST’s mailing list, according to the post.
The second finding involves AES, which NIST adopted in 2001 and which researchers describe as among the most scrutinized encryption algorithms ever devised. Academics regularly study “round-reduced” versions of AES, artificially weakened variants used to probe attack techniques that might eventually inform understanding of the full cipher.
Mythos Preview, working almost entirely on its own inside a research scaffold built by an Anthropic engineer, developed a technique the model itself named the “Möbius Bridge,” according to the company. The approach eliminated a costly guessing step in existing attacks, cutting required computation by a factor of 256, the post says. After further optimization, the resulting attack ran between 200 and 800 times faster than the previous best-known method, the Anthropic team reports.
Based on the company’s report, the attack remains far from practical since it still requires an attacker to obtain the encrypted output of roughly 2^105 chosen inputs, a number vastly beyond any real-world scenario.
Genuinely Hard
According to Anthropic, the model initially refused to engage with the AES problem, writing that seven-round AES was “genuinely hard” and that there was “nothing easy to find” in the most-studied block cipher in existence.
Researchers say a single message urging the model to search harder changed its trajectory. Over the following three days, the model produced several hundred million tokens of autonomous work, guided by only three brief prompts from its human overseer, according to the company. Three days in, Mythos Preview arrived at the Möbius Bridge concept. Days later, after generating roughly a billion tokens in total, it had refined the idea into the attack described in Anthropic’s technical paper, the post says.
Verifying the AES result took researchers nearly a month, longer than the model itself needed to discover it, according to the company. Each of the two major findings cost roughly $100,000 in computing expense to develop, Anthropic reports.
Anthropic says it has since found other, smaller cryptographic results using the same model, including a practical key-recovery attack on a reduced version of the LEA cipher, used in low-power devices, and on the Serpent-128 cipher. The company also reports modest improvements against the Salsa20 stream cipher, the Poseidon hash function and SHA-1.
To help other researchers study similar capabilities, Anthropic says it partnered with academics at ETH Zurich, Tel Aviv University and the University of Haifa to build a benchmark called CryptanalysisBench.
The company frames the findings as evidence that artificial intelligence could increasingly assist, rather than replace, the adversarial review process that has long underpinned cryptographic standard-setting. NIST’s own process anticipates late discoveries, the post notes, pointing to the collapse of SIKE, a onetime finalist that researchers found could be broken in about an hour on a laptop computer.
Even so, Anthropic acknowledges the pace of discovery raises questions the field has not yet resolved. As AI models produce cryptanalytic results faster than human experts can verify them, the company says, researchers may increasingly become bottlenecked not on generating new attacks but on confirming that they are correct.
Anthropic says it plans to host an academic workshop in the coming weeks to discuss the role of AI systems in security and cryptography research, and expects the conversation to continue across academia, government and industry in the months ahead.
For More Information:
Here’s the full paper on HAWK.
The full paper on AES, and the associated chain of thought.
Here’s the paper introducing CryptanalysisBench.
