Amazon Anthropic Partnership Faces a New Test as Claude Finds Cryptographic Weaknesses

Amazon Anthropic partner researchers say Claude Mythos Preview found two new cryptographic attacks, despite initially insisting that the harder target was nearly impossible. The results affect HAWK and a seven-round research version of AES-128. Neither attack threatens production systems, but both challenge assumptions about how AI contributes to advanced mathematical research.

The most revealing detail was not the attack speed or the computing budget. It was how much persistence the model needed from its human operators. Claude repeatedly tried easier problems, dismissed promising routes, and suggested changing the target. Researchers kept directing it toward a result suitable for publication.

That interaction defines the real contest here. The relevant comparison is not simply Claude against human cryptographers. It is persistent, scaffolded AI research against the model’s tendency to abandon work that looks unproductive. The discovery depended on both sides, while human verification took much longer than machine exploration.

Claude found two attacks, but neither breaks deployed encryption

Claude Mythos produced legitimate research advances without compromising the encryption used in current products.

Anthropic published the results on July 28, 2026. Its cryptography research describes an improved key-recovery attack against HAWK and a faster attack against seven-round AES-128.

HAWK is a post-quantum digital signature proposal. Digital signatures let a system verify the identity of a sender and confirm that information has not changed. Post-quantum schemes aim to preserve those guarantees against future quantum computers.

The US National Institute of Standards and Technology began seeking additional post-quantum signature algorithms in 2022. HAWK reached the third round of that public review process after surviving two earlier rounds over roughly two years.

Mythos found a previously unused symmetry in HAWK’s underlying lattice. A lattice is a structured mathematical grid whose difficult computational problems can provide cryptographic security. The symmetry, called a nontrivial automorphism, enables a faster search for a secret key.

The result cuts HAWK’s effective key strength roughly in half, according to Anthropic. For the smaller HAWK-256 parameter set, the estimated work for full key recovery fell from 2^64 operations to 2^38.

That does not mean every HAWK configuration is now easy to attack. Larger keys still require an impractical exponential search. The attack is also specific to HAWK and does not weaken other post-quantum signature candidates or lattice cryptography broadly.

However, maintaining HAWK’s intended security would require much larger keys. That change would erode the efficiency that made the proposal attractive. The attack therefore matters to standards selection, even though HAWK has not entered production.

The second finding concerns AES, the Advanced Encryption Standard adopted by NIST in 2001. AES-128 protects data by applying 10 repeated transformation rounds. Each round further obscures the relationship between the plaintext, key, and encrypted output.

Claude did not attack those 10 rounds. It attacked a deliberately weakened seven-round version that researchers use to measure the full cipher’s safety margin.

This distinction is decisive. Reduced-round cryptanalysis tests whether attack methods begin making progress before reaching a cipher’s complete design. It resembles stress-testing part of a bridge, not showing that the bridge has collapsed.

The attack also assumes access to 2^105 chosen plaintexts. Under a chosen-plaintext model, an attacker selects inputs and receives their encrypted outputs under an unknown, fixed key. That data requirement alone makes the experiment impossible in practice.

Anthropic estimates that even an implementation of the theoretical attack would require hundreds of millions of dollars. Full AES-128 remains outside its reach.

These boundaries explain why Anthropic stated that no production software needs to change. They also prevent a dramatic but inaccurate conclusion that Claude “broke AES.”

What changed is narrower and more interesting. An AI system extended serious cryptanalytic research against two heavily studied targets. One result materially damaged a standards candidate, while the other improved the best-known method for a classic research problem.

That combination creates pressure well beyond HAWK’s designers. Standards bodies, model developers, cloud providers, and security teams must now decide how AI-generated discoveries should be produced, checked, and disclosed.

Why the Amazon Anthropic relationship matters here

This experiment turns frontier-model infrastructure into part of the cryptographic research process, not merely a way to run a chatbot.

Amazon did not author the two papers, and AWS did not announce the attacks. The work came from Anthropic researchers using Claude Mythos Preview. Still, the Amazon Anthropic relationship provides essential commercial and infrastructure context.

Amazon has invested a total of $8 billion in Anthropic while retaining a minority position. Anthropic also identifies AWS as its primary cloud and training partner. Claude models are available to enterprise customers through Amazon Bedrock.

That partnership links model capability, specialized computing infrastructure, and enterprise distribution. Anthropic works with AWS on Trainium accelerators and related software, while Amazon gains a major model provider for its cloud platform.

The latest cryptography work shows what intensive inference can support. Each main result consumed an estimated $100,000 in API usage. The AES project eventually produced one billion output tokens, according to Anthropic.

Those numbers do not describe normal enterprise workloads. They show a research pattern that spends large amounts of computation across many agents, hypotheses, experiments, critiques, and failed paths.

For Amazon, the important question is not whether customers will reproduce this exact experiment through a standard Bedrock prompt. Mythos Preview is not generally available, and Anthropic has restricted access because of its cybersecurity capabilities.

The issue is whether cloud infrastructure becomes a defining input to automated research. If useful discoveries require sustained multi-agent work, repeated experiments, and enormous token budgets, compute providers occupy a strategic position in the workflow.

Amazon’s Anthropic investment therefore looks different through this lens. The partnership is not only about hosting general assistants. It places AWS near experiments where models search technical literature, operate mathematical tools, and test original ideas.

That opportunity also brings responsibility. More compute lets defensive researchers investigate neglected algorithms. The same scaling can accelerate offensive analysis when models or equivalent capabilities spread.

Anthropic previously said Mythos could find and exploit software vulnerabilities across major operating systems and browsers. Cryptographic design research moves the question from programming errors toward weaknesses in the mathematics itself.

Implementation bugs have concrete verification tools. A crashing program, sanitizer report, or working exploit can provide an objective result. Novel cryptanalysis is harder because correctness depends on mathematical assumptions, prior literature, and precise complexity estimates.

That makes human review more important, not less. It also makes the cost structure less predictable. A model can generate hundreds of plausible ideas faster than qualified experts can reject them.

Enterprise buyers should not interpret the experiment as permission to delegate security decisions to a model. Instead, it shows why provenance, experiment logs, and human review must remain attached to every consequential claim.

Engineering teams already struggle to preserve the context behind complex decisions. A searchable knowledge base becomes more relevant when an agent produces thousands of intermediate artifacts that reviewers must trace.

The infrastructure race is therefore paired with a validation race. AWS, Anthropic, and other model platforms can increase the volume of candidate discoveries. The scarce resource becomes expert attention capable of separating a publishable result from confident mathematical noise.

The key mechanism was persistence, not one perfect prompt

Claude’s decisive advantage appeared only after humans stopped it from redefining the assignment around easier work.

For the HAWK project, Mythos worked semi-autonomously inside an agentic harness. A harness combines prompts, tools, memory, and code so a model can pursue a longer objective instead of answering once.

The environment resembled Claude Code and supported multiple worker agents. Those agents could consult published papers and use computational tools such as Python and Sage, a system for symbolic and mathematical computation.

The human operator had theoretical computer science experience but was not a specialist in lattice cryptography. Human guidance focused mainly on research management, such as tracking ideas and choosing verification libraries.

Two workers identified the crucial HAWK direction. One dismissed it prematurely, while the other developed it further. Continued exchanges eventually led both workers to recognize the viable attack.

The complete HAWK discovery and verification process took about 60 hours. Mythos performed a literature review, explored the mathematics, ran computational experiments, and built an end-to-end verification pipeline.

The AES process reveals an even sharper division of labor. An Anthropic researcher built a scaffold that let Claude propose hypotheses, test them, reject failures, and continue searching. The assignment required an improvement over the best published attack.

Claude initially resisted. It argued that reduced-round AES had been studied too thoroughly and suggested that a different outcome required a different target. This response was sensible at a conversational level but unhelpful for original research.

The human operator responded with increasingly direct instructions. The messages emphasized that the model should seek new attacks, retain AES-128 with seven rounds, and avoid low-value findings. Anthropic published the prompts with their spelling and grammatical errors intact.

Simon Willison highlighted those messages in his prompt analysis. Their importance lies in what they reveal about agent behavior, not their wording.

The prompts contributed little specialist cryptographic knowledge. They supplied ambition, target stability, and permission to spend more effort. The model already had access to technical literature, tools, and earlier agent outputs.

After receiving that direction, Mythos spent three days producing several hundred million tokens. It eventually proposed the Möbius Bridge, a fingerprinting method that removes one expensive guess from the previous attack.

A meet-in-the-middle attack saves time by computing from two directions and matching intermediate states. It usually trades reduced runtime for a large table of stored calculations.

The previous seven-round AES method needed to enumerate 256 possible values during one stage and check them against a table. Mythos constructed a fingerprint that remains unchanged across that guess, removing the enumeration.

Computing the new transform introduced extra work. Claude then developed additional optimizations to offset that cost. Anthropic estimates that the combined method runs between 200 and 800 times faster, depending on how runtime is measured.

This is the central mechanism behind the result. Claude did not answer a clever question with a finished attack. It operated a large search process whose useful direction emerged after humans repeatedly blocked easier exits.

Calling that “prompt engineering” understates the workflow. The researchers set goals, maintained the target, allocated computation, preserved intermediate work, and demanded verification. Those are research-management functions.

The process also challenges the idea that an intelligent model should require no encouragement. Frontier models optimize for producing helpful responses, and declaring a famous problem difficult can sound responsible. Research requires continuing after that socially acceptable answer.

This creates a subtle evaluation problem. A model may possess the components needed for a discovery while failing because it does not allocate enough effort. Standard benchmarks often measure whether it solves a fixed problem within one bounded run.

Long-running research agents behave differently. Their output depends on scaffolding, parallel workers, tool access, context management, feedback, and a budget for failed attempts. Capability belongs partly to the system surrounding the model.

The AES result does not show that any determined user can turn a short prompt into elite cryptanalysis. It shows that persistent orchestration can expose model capabilities hidden by early pessimism.

Human verification became the real bottleneck

The model generated research faster than Anthropic’s team could establish that the research was correct, novel, and useful.

Anthropic says Mythos conceived the improved AES attack in roughly one week. Two researchers then spent nearly a month gaining confidence in the result.

The company also says those researchers devoted several hundred hours to learning enough cryptography to validate the claim and prepare the paper. Anthropic explicitly notes that they were not cryptography experts.

That disclosure deserves as much attention as the attack itself. Mathematical research does not become reliable because a model supplies equations, code, and an authoritative explanation. Reviewers must verify every assumption and compare the method with decades of prior work.

HAWK offered a more concrete validation path. The team could implement the key-recovery method end to end and check whether it recovered a chosen key. That makes the result easier to test than a vast, theoretical AES attack.

For AES, no one can run the complete attack under its stated resource assumptions. Review instead depends on proving the algorithm’s correctness, checking its complexity, and validating smaller components experimentally.

Anthropic says it consulted academics, shared the HAWK result with its designers in June, and coordinated publication through a NIST mailing list. It also briefed US government and industry partners before release.

Those steps reduce the chance of an obvious error. They do not replace broader peer review. The two papers and associated code now give independent cryptographers an opportunity to challenge the claims.

The public nature of cryptographic review matters. Security usually comes from repeated adversarial analysis, not trust in the organization announcing a result. Experts must attempt to reproduce the reasoning and identify hidden assumptions.

CyberScoop reported that Keyfactor executive Ellen Boehm viewed the discovery as evidence that the post-quantum evaluation process is working. Candidate algorithms enter public competitions precisely so researchers can find weaknesses before deployment.

That interpretation prevents the wrong lesson about HAWK. Its setback does not mean post-quantum standardization failed. It means a public candidate received a demanding test before becoming infrastructure.

The history of NIST competitions supports that view. SIKE, an earlier post-quantum candidate, survived years of attention before researchers found a devastating attack that ran on a laptop.

AI adds a new source of adversarial pressure. Standards bodies can use models to test more constructions and explore more variations. Designers can also run the same techniques before submitting a proposal.

However, greater search capacity produces a queueing problem. If models generate attacks much faster than specialists can assess them, the backlog grows. Incorrect results can absorb months of attention, while genuine discoveries may wait unnoticed.

Models can also create a false sense of verification by writing tests that confirm their own mistaken assumptions. Independent implementations and reviewers remain necessary because internal consistency is not the same as correctness.

The Amazon Anthropic partnership sits near this bottleneck because scaling models and serving longer agent sessions expands the upstream flow. Infrastructure can increase candidate output faster than academic communities can increase qualified reviewers.

The appropriate response is not to suppress all automated exploration. It is to build review systems alongside it. Those systems need complete logs, reproducible code, explicit threat models, versioned literature, and clear records of human intervention.

CryptanalysisBench represents one attempt to make model performance more measurable. Anthropic created the benchmark with academic researchers to package cryptographic problems into a form that different models can attempt.

Benchmarks will still capture only part of the picture. Anthropic’s strongest result depended on a persistent human refusing to let Claude change targets. Evaluation designs must therefore measure both autonomous work and performance under realistic research supervision.

What the results do not prove

The attacks are credible enough to study, but too limited to support claims that Claude has broken modern encryption or replaced cryptographers.

The first limitation is practical impact. HAWK is a candidate rather than a deployed standard. Seven-round AES is an intentionally weakened object of study. Full AES-128 uses 10 rounds and remains unaffected.

The second limitation is computational feasibility. The AES attack assumes 2^105 chosen plaintexts, an amount of data far beyond collection in any realistic environment. Its 200-to-800-fold improvement does not turn an impossible attack into a usable one.

The third limitation concerns autonomy. Mythos performed most technical exploration independently, but people selected the targets, constructed the scaffolds, monitored progress, redirected the model, and validated the output.

Describing the work as fully autonomous would erase those contributions. Describing it as merely a human discovery written by AI would also be inaccurate. The useful unit is the combined research system.

The fourth limitation is external validation. Anthropic released papers, code, and selected reasoning artifacts, but the broader cryptographic community has only begun examining them. Independent review will determine whether every claimed improvement survives scrutiny.

The released reasoning is also not a complete record of every internal token. Anthropic says the document was rewritten by Claude to provide a more readable account of one successful session. Many other sessions produced no discovery.

That selection makes the artifact useful for understanding the successful path, but weaker for estimating success rates. Readers cannot infer how often similar spending produces publishable research.

The fifth limitation is generalization. A symmetry in HAWK does not imply the same weakness exists across lattice cryptography. A fingerprint improvement against seven AES rounds does not imply a route through the remaining three.

Cryptographic rounds are designed so complexity compounds. Progress against a reduced version helps measure security margins, yet the final rounds can remain beyond every known technique.

Anthropic’s preliminary follow-up claims also require caution. The company reports an attack on 13-round LEA that runs on a desktop and another against six-round Serpent-128. Neither reaches the complete versions of those ciphers.

The team plans to release more details after further work. Until then, those results remain company claims rather than fully inspectable findings.

There is also an economic question. Spending roughly $100,000 per result can make sense for a frontier laboratory studying major standards. It is less accessible to university groups, maintainers, and smaller security teams.

That imbalance could concentrate early access to AI-assisted cryptanalysis among model companies, hyperscale cloud providers, governments, and well-funded vendors. The organizations producing results might also control the systems needed to reproduce them.

Restricted access to Mythos complicates independent replication further. Researchers can inspect the published artifacts, but they cannot necessarily rerun the same model and scaffold.

These constraints do not negate the findings. They define what the findings mean. Claude Mythos appears capable of contributing original ideas within a carefully managed research program. It has not established a general ability to defeat deployed cryptography on demand.

The right skepticism targets the surrounding claims, not the value of testing algorithms. Stronger review before deployment is beneficial, whether the useful idea comes from a person, a model, or their collaboration.

Amazon Anthropic watchers should follow three signals

The next phase will be decided by independent replication, measurable research reliability, and disclosure rules for findings with real operational impact.

The first signal is how outside cryptographers assess the HAWK and AES papers. Reproduced calculations, corrected complexity estimates, and independent implementations will show whether the results withstand expert pressure.

Strong replication would support Anthropic’s claim that frontier models can contribute novel cryptanalysis. Major corrections would weaken the broader capability narrative, even if the experiments remain informative.

The second signal is performance on CryptanalysisBench and similar evaluations. Researchers need results from multiple models, repeated runs, documented budgets, and different levels of human guidance.

A benchmark should distinguish discovery from rediscovery. It should also record failed sessions, token consumption, tool use, and the interventions that changed an agent’s direction.

If several model families produce new, validated attacks under controlled conditions, AI cryptanalysis becomes an industry-wide capability. If success remains rare and dependent on Mythos-specific infrastructure, the conclusion stays narrower.

The third signal is how Anthropic, Amazon, standards bodies, and governments handle a discovery that affects deployed software. These two attacks allowed orderly disclosure because neither endangered a production system.

A practical break would create harder choices. Researchers would need to notify vendors, coordinate patches or migrations, restrict technical details, and decide when the public deserves warning.

Anthropic already says it consulted government and industry leaders about the current work. The next test is whether those relationships produce transparent rules before a crisis rather than improvised controls afterward.

For developers and enterprise security leaders, the immediate action is not to replace encryption or panic about AES. It is to improve visibility into where cryptographic algorithms, libraries, keys, and protocols enter their systems.

Teams should also prepare to evaluate machine-generated security claims. That means retaining source material, experiments, prompts, code, and reviewer decisions instead of accepting a polished final report.

The Amazon Anthropic story ultimately concerns leverage. Amazon supplies capital, cloud infrastructure, and a route to enterprise distribution. Anthropic supplies a restricted model that can sustain unusually deep technical searches.

Claude’s cryptographic work shows what that combination can enable, but it also exposes its limiting factor. Computation can generate candidate discoveries at enormous scale. Confidence still moves at the speed of careful human review.

The question for the next several months is therefore specific: will independent experts validate these attacks and reproduce the research pattern with other models? That evidence will determine whether this was an exceptional experiment or the beginning of a repeatable method for auditing the mathematics beneath digital security.