Anthropic's Mythos Model Found Two Cryptographic Attacks

A model that has not shipped yet just did work that cryptographers normally reserve for their own specialists. On July 28 Anthropic published research saying its unreleased Claude Mythos Preview produced new attacks against two well-studied targets: the post-quantum signature scheme HAWK, and a reduced-round variant of AES.

HAWK is one of the candidate schemes designed for a world where quantum computers can break today's public-key cryptography. It had been through two years of development and two separate rounds of expert review before this.

What the model actually found

In HAWK, the model identified a previously unnoticed symmetry in the underlying lattice, technically a nontrivial automorphism. The practical effect was to halve the effective key strength. For HAWK-256, the expected cost of a key-recovery attack dropped from 2^64 to 2^38, which is roughly 67 million times less work. Anthropic says the result took about 60 hours and around $100,000 in API spend.

The AES result came from a new fingerprinting technique the model called "Möbius Bridge." It produced an attack between 200 and 800 times faster than the previous best known result. That run took three days of autonomous work and about a billion tokens of output.

The part headlines tend to drop

The AES finding applies to a 7-round variant, not the full 10-round AES that protects your traffic and your databases. Reduced-round attacks are a genuine signal in cryptanalysis, and researchers take them seriously as early warnings, but they do not break deployed encryption.

Anthropic says as much directly: neither result has a practical impact on today's computer systems. HAWK is not yet deployed anywhere, and the AES work stops short of the real thing. The company also followed coordinated disclosure, sharing the HAWK findings with the scheme's authors in June 2026 before going public.

Who checked the work

A lab announcing that its own model made a breakthrough deserves a raised eyebrow by default. What makes this case sturdier than most is the verification path: two researchers spent a month confirming the findings by hand, and the results went to the people who designed the scheme.

Cryptography also has a property that most AI claims lack. An attack either works against the math or it doesn't, and anyone with the paper can check. That removes the usual argument about whether a benchmark measured anything real.

Does this touch your encryption?

No. Your TLS certificates, your database encryption, your VPN: none of them are affected by this research, and there is nothing to patch this week. Saying that plainly matters, because stories like this one tend to generate panic purchases of things nobody needs.

What it does point at is a slower question worth putting on a roadmap:

• Crypto agility. If your systems have a specific algorithm baked into application code, swapping it later becomes a migration project. Treating the algorithm as a configurable layer costs almost nothing when you build it and saves a great deal when a standard changes.
• Harvest-now-decrypt-later. If the data you collect today is still sensitive in ten years, such as medical records, contracts, or identity archives, then post-quantum planning is a 2026 conversation rather than a 2032 emergency.

For most companies the only action item today is unglamorous: keep the cryptographic libraries in your dependencies current. The interesting part of this story is not the algorithms. It is that a model spent 60 hours on a problem specialists had already picked over, and came back with something they had missed.

Sources: Anthropic, Simon Willison, The Next Web