Anthropic Claude Finds New HAWK and Reduced-Round AES Attacks

Anthropic Claude has produced two notable cryptographic attacks, despite neither threatening software or encrypted data in production today. Claude Mythos Preview weakened the proposed HAWK signature scheme and accelerated an attack against seven-round AES-128.

The immediate story is reassuring. HAWK remains a candidate in a public review process, while standard AES-128 uses ten rounds rather than seven. Anthropic explicitly says that no production software must change because of either result.

The deeper conflict concerns who performs advanced cryptanalysis and how quickly the field can validate the resulting work. Anthropic says its multi-agent system reached one result after about 60 hours and generated the other largely autonomously within a week. Human researchers then spent far longer checking the AES work.

That imbalance changes the meaning of the announcement. The important development is not that Anthropic Claude broke internet encryption. It did not. The development is that an AI system generated credible mathematical attacks against schemes already examined by specialist researchers.

What Anthropic Claude Actually Found

The two results advance cryptographic research, but neither constitutes a practical attack against current internet security.

Anthropic disclosed the work on July 28, 2026, through its Frontier Red Team. The company published separate technical papers covering HAWK key recovery and an improved attack against seven-round AES-128.

The cryptography findings differ from the software vulnerabilities Anthropic previously attributed to Mythos Preview. Those earlier findings often involved implementation errors, where software used a sound algorithm incorrectly.

This research targets the mathematical designs themselves. That distinction matters because implementation auditing and cryptanalysis demand different forms of reasoning.

An implementation bug might involve unsafe memory access, an incorrect boundary check, or a flawed authentication path. Researchers can often reproduce such errors by executing code and observing a crash or unauthorized action.

Cryptanalysis asks whether an algorithm provides the security its designers expect under a defined mathematical threat model. A proposed attack must be novel, internally consistent, and cheaper than the best known alternative.

The first result concerns HAWK, a post-quantum digital signature candidate. Digital signatures let a recipient verify a message’s origin and detect unauthorized changes.

HAWK belongs to a NIST process for evaluating additional signatures designed to resist attacks from future quantum computers. It is not a deployed internet standard.

According to Anthropic, HAWK had passed two rounds of expert review over two years. Mythos Preview then identified an unexploited mathematical symmetry within the lattice structure supporting the scheme.

The system used that symmetry to create a faster key-recovery method. Key recovery seeks to reconstruct a private signing key from public information.

For the small HAWK-256 challenge parameters, Anthropic says the expected attack cost fell from 2^64 operations to 2^38. HAWK-256 was deliberately included as a cryptanalytic target rather than a recommended production parameter set.

The attack remains exponential, meaning its cost continues growing rapidly with the key size. Anthropic also says larger HAWK parameters remain impractical to attack.

However, preserving the intended security level would require substantially larger keys. That change would erode the compactness and efficiency that made HAWK attractive.

The second result applies to a deliberately weakened form of AES-128. Standard AES-128 transforms data through ten repeated rounds, while the research target uses only seven.

Academics study reduced-round ciphers to measure their security margins and develop techniques that might expose deeper structural weaknesses. Breaking such a research variant does not mean the full cipher is broken.

Mythos Preview improved a meet-in-the-middle attack, which reduces computation by saving and matching intermediate results. It designed a fingerprinting technique that Anthropic calls the Möbius Bridge.

The technique removes one guess involving 256 possible values. After accounting for its added computational cost, Anthropic estimates a speed improvement between 200 and 800 times.

That sounds dramatic, but the underlying scenario remains impractical. The attack assumes access to 2^105 chosen plaintexts, which are inputs selected by an attacker and encrypted under one unknown key.

Anthropic further estimates that implementing even this reduced-round attack would require resources far beyond ordinary attackers. Full ten-round AES-128 remains unaffected.

These limits should appear beside every account of the headline. Calling the findings an AES break or an internet encryption failure would misrepresent the research.

Why the HAWK Result Pressures Cryptographic Review

The HAWK attack puts pressure on the speed and coverage of human review, not on systems already using post-quantum standards.

NIST began seeking additional post-quantum signature schemes to broaden the available design choices. Public competitions let independent researchers inspect proposals, challenge their assumptions, and identify unsafe parameters before standardization.

HAWK reached the third round of that signature review. Its design emphasizes compact signatures, fast operations, and modest memory requirements, including on constrained hardware.

Its direct key-recovery security depends on a mathematical structure called the lattice isomorphism problem. The problem asks whether two lattices are related through a transformation that preserves their essential structure.

Earlier research established that finding a useful automorphism, a symmetry mapping a lattice onto itself, could support an attack. The unresolved question was whether HAWK’s particular construction exposed an accessible one.

Anthropic says Mythos Preview found such a symmetry and constructed an end-to-end verification pipeline. The resulting enumeration attack searches possible keys more efficiently than previous techniques.

The process used several Claude workers inside an agentic harness. An agentic harness combines prompts, tools, shared records, and task coordination so models can pursue a long research objective.

The workers could consult published research and use computational systems such as Python and Sage. A human operator provided project management and occasional nontechnical guidance.

Anthropic’s account offers an important detail about multi-agent research. Two workers examined the critical idea, but one rejected it prematurely. The second continued and found a workable path.

The workers exchanged messages until both accepted the attack. This resembles parallel scientific investigation more than a single chatbot producing an answer.

Finding and verifying the HAWK attack took about 60 hours, according to Anthropic. The human operator had theoretical computer science experience but lacked specialist expertise in lattice cryptography.

The company shared the attack with HAWK’s authors in June. It then coordinated the public disclosure with the relevant NIST mailing list.

That process is closer to responsible cryptographic review than opportunistic vulnerability disclosure. HAWK was submitted publicly so researchers could search for weaknesses before deployment.

The result therefore shows the NIST process working as intended. A candidate received adversarial scrutiny, a weakness emerged, and evaluators gained new evidence before approving a standard.

History provides a useful comparison. SIKE, another post-quantum candidate, survived extensive attention before researchers found a devastating classical attack in 2022.

That attack could recover a secret key on an ordinary laptop. The SIKE failure was far more severe than the new HAWK result, but it reinforced the value of long public review.

The difference now is the source of the pressure. A multi-agent AI system can search literature, generate hypotheses, run experiments, and coordinate competing approaches without resting.

That does not make its conclusions trustworthy by default. It does increase the number of credible attack paths that experts may need to examine.

Cryptographic organizations will therefore need more than model access. They need review systems that preserve failed hypotheses, reproduce calculations, compare prior work, and route promising findings to qualified specialists.

The pressure target is the human validation pipeline. If AI systems generate plausible attacks faster than experts can reject or confirm them, review queues become a security constraint.

That constraint affects standards bodies, academic conferences, vendors, and government agencies. Each group relies on scarce specialists who can distinguish a genuine advance from a subtle mathematical error.

The HAWK result offers unusually strong verification because Anthropic implemented the attack end to end. Researchers can choose a key, run the method, and observe whether it recovers that key.

Not every future result will permit such direct testing. Some claims will depend on asymptotic reasoning, complicated probability bounds, or assumptions that are difficult to reproduce experimentally.

AI can expand the search surface. Human institutions must expand the verification surface with it.

The Reduced-Round AES Attack Shows the Mechanism

The AES result matters because Claude created a new optimization through sustained experimentation, not because full AES-128 became unsafe.

NIST standardized the AES cipher in 2001. AES-128 applies ten rounds of substitutions, permutations, and key-dependent operations to each block of data.

Its long history makes it an unusually difficult research target. Cryptographers have examined AES more intensively than almost any other symmetric cipher.

That maturity also explains why researchers study versions with fewer rounds. Reduced-round analysis reveals how much protection each additional round provides and whether new techniques approach the full design.

Anthropic asked Mythos Preview to improve the strongest published attack against seven-round AES-128. The model initially resisted, claiming that the problem offered no easy path.

Researchers changed the harness so the agents would keep searching for genuinely novel ideas. They also repeatedly directed Claude back toward seven rounds when it tried easier targets.

The system generated several hundred million tokens during its first three days of investigation. Anthropic says it ultimately produced one billion output tokens while refining the complete method.

Volume alone does not establish intelligence or research quality. It does reveal one advantage of automated experimentation: the system can explore, discard, and recombine ideas at a scale unavailable to one researcher.

The resulting Möbius Bridge acts as a fingerprint invariant to a previously required guess. Invariance means the fingerprint remains useful even when that specific value changes.

Earlier work had to enumerate 256 values and compare them against a precomputed lookup table. Removing that step theoretically cuts the relevant work by a factor of 256.

The new transform also adds overhead. Anthropic therefore reports a practical analytical improvement of 200 to 800 times, depending on how researchers measure runtime.

The attack remains a meet-in-the-middle technique. These methods trade storage for speed by calculating values from opposite directions and searching for a matching internal state.

Such attacks can outperform brute force without exposing a simple flaw in the cipher. Their practicality depends on data access, memory requirements, computation, and the number of rounds involved.

Here, the assumed data requirement is 2^105 chosen plaintexts. That figure is astronomically beyond a realistic collection scenario.

The target also omits three of AES-128’s ten rounds. Those additional rounds greatly increase the difficulty of extending the technique to the standard cipher.

Anthropic’s paper therefore contributes to the academic attack record for reduced-round AES. It does not give criminals a workable method for decrypting banking traffic, stored files, or private messages.

The most important mechanism sits above the cipher. One researcher built the scaffold, then Claude autonomously proposed hypotheses, tested them, read critiques, and passed discoveries between agents.

The system did not return one polished answer after one prompt. It operated as a research organization compressed into software, with multiple attempts and persistent computational support.

This approach resembles methods used by other frontier laboratories. Google DeepMind and OpenAI have both applied model-assisted search to difficult mathematics, algorithms, and scientific problems.

The shared direction is more significant than any single benchmark score. Model capability increasingly depends on the surrounding system, including tools, memory, verification, and parallel workers.

Cryptanalysis is well suited to this arrangement because many ideas can be tested computationally. A model can search for patterns, implement candidate transforms, and compare them against known results.

Yet cryptography also punishes tiny mistakes. A missed condition, understated data assumption, or incorrect complexity term can invalidate an otherwise convincing paper.

That creates the central tradeoff. Automated research expands the supply of candidate discoveries, while expert validation remains slow and expensive.

The Anthropic researchers acknowledge that imbalance directly. Mythos Preview needed about one week to develop the AES result, while two researchers spent nearly a month building confidence in it.

They also spent several hundred hours learning enough cryptography to evaluate the method. Anthropic notes that those researchers were not cryptography specialists.

That admission strengthens the need for independent review. It also makes the result more interesting, because the system apparently helped nonspecialists enter a technically demanding field.

The next stage should not remove experts from the process. It should give them reproducible artifacts, structured reasoning, executable tests, and clear comparisons against prior research.

The Claim Is Impressive, but Verification Is the Bottleneck

Anthropic has released meaningful evidence, yet the broader claim of expert-level cryptography still requires independent and repeated validation.

The strongest skeptical argument does not deny the two attacks. It questions what they establish about general research ability.

Both targets were selected and framed by Anthropic researchers. The agents received access to relevant literature, computational tools, repeated prompts, and a purpose-built scaffold.

Many sessions produced no useful discovery. Anthropic’s published account focuses on the successful trajectories, which makes it difficult to estimate the overall success rate.

The model also required unusually large computational effort. One billion generated tokens is not a normal interactive workload, even for well-funded research organizations.

That scale changes the comparison with humans. The relevant question is not whether one Claude response outperformed one cryptographer.

A fair comparison must consider total compute, human setup, prompt refinement, failed attempts, validation time, and access to specialist literature. It must also measure novelty across unseen problems.

Anthropic collaborated with academics from ETH Zurich, Tel Aviv University, and TU Berlin to create CryptanalysisBench. The benchmark packages cryptographic schemes for standardized model evaluation.

Early benchmark results suggest frontier models can solve known and novel cryptanalytic tasks. However, benchmarks can become less informative once developers optimize directly against them.

Independent groups should reproduce the HAWK implementation, verify the AES complexity analysis, and test the same scaffold against untouched schemes. Failed replications would weaken the broader capability claim.

Success across several undisclosed targets would strengthen it. Anthropic has mentioned preliminary results involving reduced-round LEA, Serpent-128, Salsa20, Poseidon, and SHA-1.

Those additional claims require different confidence levels. Anthropic says its LEA attack runs end to end, making direct verification easier.

Other improvements remain limited or preliminary. They should not receive the same evidentiary weight as an implemented key-recovery demonstration.

The AES work presents a harder validation problem. Researchers can inspect its derivation and computational experiments, but the complete attack remains impractical to execute at full scale.

Experts must therefore validate the reasoning rather than simply run the entire attack. That process can expose hidden assumptions or accounting errors.

Another uncertainty concerns authorship. The model generated the central ideas, but humans selected goals, maintained the harness, redirected failed searches, and prepared the final papers.

Calling the work fully autonomous would erase those interventions. Calling it ordinary tool use would erase the system’s independent hypothesis generation and prolonged experimentation.

“Mostly autonomous” is the more defensible description. It recognizes substantial machine agency without pretending the research emerged without human choices.

The disclosure environment also matters. Anthropic controls Mythos Preview access because the model can support both defensive research and offensive operations.

That restricted access makes independent evaluation harder. Outside researchers cannot easily repeat the workflow using the same model, settings, and computational budget.

Mythos Preview has since been succeeded by Mythos 5, which Anthropic limits to vetted partners. Access control reduces immediate misuse but concentrates advanced security research within a small group.

This creates another tradeoff between safety and scientific scrutiny. Broad release supports replication, while restricted release reduces the number of actors able to weaponize discoveries.

No access policy resolves that conflict completely. A defensible program needs trusted external evaluators, controlled reproduction environments, and prompt disclosure sufficient to examine the research process.

Anthropic took useful steps by releasing technical papers, demonstration code for HAWK, and a reconstructed account of Claude’s AES reasoning. Those artifacts provide more evidence than a marketing claim alone.

Still, reconstructed reasoning is not a perfect audit trail. Anthropic states that the published document expands the model’s original chain of thought for readability.

Future evaluations should emphasize executable records over narrative transcripts. Logs should connect hypotheses, code, experimental outputs, and final claims without exposing dangerous operational details.

Cryptographers will also need better systems for triage. A queue containing thousands of plausible papers can overwhelm a community even when most submissions are wrong.

Automated critics can help, but using one model to validate another creates correlated failure risks. Independent formal methods and expert review remain necessary.

The research community should avoid two opposite mistakes. It should not dismiss the work because AI contributed to it, and it should not treat model-generated mathematics as correct by default.

The HAWK demonstration is concrete. The AES paper is detailed. The general claim that frontier models now match top cryptographers remains a hypothesis requiring broader evidence.

The Real Shift Is From Discovery Scarcity to Validation Scarcity

Anthropic Claude changes the economics of generating cryptographic hypotheses before it changes the security of deployed algorithms.

Cryptography has historically relied on a small community of specialists to design schemes and attack them. High-quality review demands years of training and sustained attention.

That structure creates an uneven distribution of scrutiny. AES attracts extensive analysis, while specialized ciphers and regional standards may receive far less attention.

Anthropic argues that AI systems can examine this long tail. If that claim holds, neglected algorithms could receive deeper testing without assigning a full human team to each one.

The defensive value is clear. Standards organizations could run agentic reviews before accepting new schemes, then provide specialists with ranked and reproducible findings.

Product teams could use similar systems to compare their implementations against formal specifications. That would combine mathematical review with conventional vulnerability discovery.

The risk is equally clear. The same workflow can search deployed cryptosystems for weaknesses that have immediate value to attackers.

Cryptographic flaws differ from ordinary software bugs because remediation can require new standards, new keys, hardware updates, and long migration periods. Some encrypted historical data may remain exposed afterward.

Current findings do not create that crisis. They show a workflow capable of moving toward increasingly difficult targets.

Anthropic’s April assessment of Mythos Preview already described a model able to discover and exploit subtle software vulnerabilities. The company limited access through Project Glasswing because offensive and defensive capabilities overlap.

Cryptanalysis extends that concern beyond code. A correct implementation cannot protect users when its underlying algorithm has an exploitable structural weakness.

That does not mean full-strength AES is next. Strong ciphers include generous security margins precisely because researchers expect attacks against simplified variants.

The correct response is preparedness, not panic. Organizations should inventory cryptographic dependencies and preserve the ability to replace algorithms without rebuilding entire systems.

Standards bodies should add AI-assisted analysis to public competitions while documenting how model findings are verified. Vendors should avoid proprietary cryptography that lacks sustained external review.

Researchers should also treat validation capacity as infrastructure. Compute can create more candidate results, but qualified human attention cannot scale at the same rate.

Universities may need training that combines classical cryptography, automated theorem checking, and agent supervision. Security teams will need reviewers who can inspect both proofs and generated code.

Research records will become increasingly important. Teams must retain the papers, prompts, experiments, rejected hypotheses, and validation decisions behind each conclusion.

A searchable knowledge base can support that work when it preserves source documents and connects claims to evidence. The goal is traceability, not automated acceptance.

Publication incentives may also need adjustment. Producing many plausible attacks is less valuable than producing a smaller set with reproducible verification.

Conferences and standards groups could require machine-generated work to disclose computational budgets, human interventions, failed runs, and validation methods. Those details would enable fairer comparisons.

Security teams should distinguish three levels of evidence.

First, a model may suggest an attack concept. That is a research lead, not a finding.

Second, the system may provide a mathematical analysis and supporting experiments. That is a candidate result requiring expert review.

Third, researchers may implement the attack end to end and reproduce it independently. That offers the strongest practical confirmation.

The HAWK work approaches the third level. The AES result relies more heavily on analysis because its full computational requirements prevent complete execution.

Keeping those levels separate prevents sensational claims. It also ensures that genuinely important AI contributions receive appropriate credit.

The wider competitive context includes every frontier laboratory developing models with stronger reasoning and longer autonomous operation. Cryptanalysis will not remain an Anthropic-only capability.

Open models may eventually narrow the gap, while specialized research systems could outperform general models on selected mathematical domains. Access to compute and high-quality scaffolds will shape that race.

The likely competition is therefore not Claude versus one rival chatbot. It is AI-assisted defenders versus AI-assisted attackers, with verification speed determining who benefits first.

Defenders have structural advantages when they can review schemes before deployment and coordinate fixes privately. Attackers gain an advantage when vulnerable systems remain exposed for years.

Anthropic’s two results favor the defensive case. HAWK was caught before deployment, and the AES experiment targeted an intentionally weakened academic variant.

Future discoveries may not be so conveniently timed. That possibility makes responsible disclosure systems and cryptographic agility more urgent.

What to Watch After the Anthropic Claude Findings

Three signals will show whether this research marks a durable capability shift or an impressive pair of isolated results.

The first signal is independent technical validation. Cryptographers outside Anthropic should reproduce the HAWK attack and closely review the AES paper’s assumptions, complexity, and novelty.

Confirmation would strengthen the claim that Mythos Preview produced legitimate research contributions. Material corrections would narrow the result and expose weaknesses in Anthropic’s validation process.

The second signal is NIST’s treatment of HAWK. Evaluators could reject the existing parameters, request larger keys, encourage a redesign, or remove the candidate from consideration.

A parameter revision would show that the attack changed the proposal without destroying its foundation. Removal would indicate that the efficiency loss damaged HAWK’s value proposition.

The third signal is performance on new, unseen schemes. Anthropic plans further experiments and continued work with CryptanalysisBench.

Repeated advances across different cryptographic structures would support a general research capability. Success only on heavily scaffolded targets would suggest a narrower tool.

Readers should also watch the ratio between discovery time and validation time. That operational metric may matter more than benchmark scores.

If models produce credible findings within days while humans need weeks to verify each one, organizations will face a growing review backlog. Better models alone will not solve it.

A convincing next step would combine independent experts, formal verification, executable demonstrations, and complete research logs. It would also report unsuccessful runs and total resource use.

For developers and enterprise buyers, no emergency migration follows from this announcement. Standard AES-128 remains intact, and HAWK has not entered production.

The practical action is to confirm that systems use approved full-round algorithms, maintain current libraries, and document cryptographic dependencies. Avoid interpreting reduced-round research as evidence that encrypted data is already exposed.

For researchers, the opportunity is more immediate. Agentic systems can search wider, test more hypotheses, and preserve parallel lines of inquiry.

The responsibility is to keep their claims auditable. Cryptography cannot accept a result because a capable model generated persuasive mathematics.

Anthropic Claude has supplied two serious research objects, not an internet-wide security emergency. Their lasting importance depends on replication, standards decisions, and performance beyond these selected targets.

The next question is practical: can independent experts verify these attacks faster than frontier systems produce the next set? That answer will determine whether AI expands cryptographic assurance or overwhelms it.