Anthropic said researchers using Claude Mythos Preview found new mathematical attacks on the HAWK post-quantum signature scheme and on a reduced-round version of AES-128.
Anthropic said neither result affects production systems. HAWK is still a candidate in NIST’s post-quantum cryptography process, and the AES work applies to 7-round AES-128, not the full 10-round cipher.
The HAWK result targets a third-round candidate in NIST’s competition to replace schemes such as RSA and ECDSA. Anthropic said HAWK had undergone two years of expert review before the new finding.
According to Anthropic, Claude Mythos Preview worked semi-autonomously for about 60 hours at roughly $100,000 in API cost and improved the best-known key-recovery attack on HAWK. The company said the result effectively halved the scheme’s key strength.
Anthropic said the attack uses a previously unexploited symmetry, described as a nontrivial automorphism, in HAWK’s lattice structure. The company said earlier theory had suggested such a symmetry might permit a faster attack, but no one had shown it in HAWK’s design.
Anthropic said the expected cost of breaking HAWK-256 fell to 2^38 operations from 2^64. The company said doubling key sizes would restore the intended security level, but would reduce HAWK’s advantage as a compact post-quantum option.
The company said the HAWK attack remains exponential and is not practical against larger keys. Anthropic also said it does not affect other NIST candidates or lattice cryptography more broadly, and that it disclosed the finding to HAWK’s authors and through NIST.
Anthropic said its second result improved cryptanalysis of 7-round AES-128. Researchers study reduced-round AES versions to develop attack methods, while full AES-128 remains secure, the company said.
Building on meet-in-the-middle methods, Claude Mythos Preview developed a fingerprinting technique Anthropic called a Möbius Bridge. Anthropic said the method removed a guessing step that had required checking 256 values.
That produced an attack 200 to 800 times faster than the previous best, depending on the measurement, according to Anthropic. The company said the discovery was almost fully autonomous after light human prompting over several days, followed by hundreds of hours of validation by researchers.
Anthropic said it has also seen early results against reduced-round LEA and Serpent, with smaller gains on Salsa20, Poseidon and SHA-1. The company said it partnered with ETH Zurich, Tel Aviv University and the University of Haifa to create CryptanalysisBench, a benchmark for evaluating language models on cryptanalysis.
Anthropic said it has started broader audits and plans academic workshops on the role of language models in security research.
Featured image credit
