Anthropic Google AI Race Meets Claude’s Misreported Post-Quantum Security Test

Anthropic says Claude found a new attack on a post-quantum signature candidate in 60 hours, not the under-four-hour feat described in some headlines. The distinction matters. Claude Mythos Preview produced serious cryptographic research, but it did not break deployed post-quantum security or expose current systems.

The result places cryptanalysis inside the broader anthropic google competition over whether frontier models can conduct original scientific work. Google researchers have recently used Gemini for open mathematics problems. Anthropic is now arguing that Claude can extend expert work in a field where errors carry direct security consequences.

Claude also improved an attack against a reduced, seven-round version of AES-128. Full AES-128 uses ten rounds and remains unaffected. The real story is therefore narrower than an encryption emergency, yet more consequential than another benchmark win.

What Claude Actually Found in the HAWK Test

Claude found a mathematical weakness in a proposed signature scheme, but the reported test did not represent a break of deployed post-quantum security.

Anthropic published its findings on July 28, 2026. Its researchers used Claude Mythos Preview to investigate HAWK, a digital signature design under consideration by the National Institute of Standards and Technology.

A digital signature proves that a message or software package came from the expected sender and was not altered. Post-quantum signatures aim to preserve that assurance against future quantum computers.

HAWK is one of the remaining candidates in NIST’s Additional Digital Signatures process. That process deliberately exposes proposals to public analysis before any algorithm becomes a standard.

According to Anthropic’s findings, HAWK had passed two rounds of expert review across roughly two years. Claude then helped identify an improved key-recovery attack during about 60 hours of work.

That timeline directly contradicts the under-four-hour framing attached to the source headline. Anthropic’s detailed account says finding, developing, and verifying the HAWK attack took about 60 hours in total.

The model worked semi-autonomously inside an agentic harness. This harness combined prompts, multiple Claude workers, published papers, mathematical software, and a sandbox for computational experiments.

A human researcher provided occasional project guidance. Anthropic says the operator had theoretical computer science experience but was not a lattice-cryptography specialist.

Claude began with a literature review, examined earlier attacks, and tested mathematical hypotheses. Two worker agents explored the idea that eventually succeeded, although one initially rejected it as impractical.

The useful insight concerned a nontrivial automorphism, a symmetry inside the mathematical lattice supporting HAWK. Earlier research had established that finding such a symmetry would enable a stronger attack.

Claude’s contribution was identifying an exploitable symmetry in HAWK’s specific construction. It then built an end-to-end verification pipeline that could test the attack against generated keys.

For the small HAWK-256 challenge parameter, Anthropic reports that the estimated attack cost fell from 2^64 operations to 2^38. That reduction makes the small test parameter practically recoverable.

However, this result does not mean Claude defeated every HAWK configuration. Anthropic says attacks on the larger proposed key sizes remain computationally impractical.

The attack is also specific to HAWK. It does not transfer automatically to other lattice-based systems or the post-quantum standards already selected by NIST.

That scope is central to understanding the event. Claude did not compromise traffic, banking systems, stored passwords, or software signatures in current production environments.

Instead, the model found a design weakness during the review process created to uncover such problems. That is a successful stress test, not evidence of a live security breach.

Why the Anthropic Google Research Race Now Includes Cryptography

The anthropic google contest is shifting from answering questions toward producing research that human specialists must independently validate.

Frontier AI labs have spent years comparing models through coding tests, science questions, and standardized reasoning benchmarks. Those evaluations usually have known answers and clear scoring rules.

Cryptanalysis changes the standard. A useful result must be novel, mathematically valid, computationally reproducible, and relevant to the security assumptions surrounding an algorithm.

Anthropic’s work therefore pressures Google, OpenAI, and other model developers on a harder measure of capability. The question is no longer whether a model can reproduce expert knowledge.

The new test asks whether an AI system can extend that knowledge after searching a large technical space. It must also survive review from specialists who understand the underlying mathematics.

Google already provides an important comparison point. Anthropic’s research notes that Google researchers used Gemini to resolve several open Erdős mathematics problems.

OpenAI researchers have also reported progress on open mathematical conjectures. These examples establish a wider contest over research-level reasoning rather than a company-versus-company cryptography match.

The anthropic google comparison still matters because both companies are connecting general-purpose models with specialized tools. Those tools allow models to read literature, write code, run experiments, and coordinate parallel attempts.

The HAWK result shows why this combination matters. Claude did not generate a successful attack from one conversational response.

It operated across a long project with multiple workers, external references, mathematical software, and repeated verification. That workflow resembles a computational research group more than a conventional chatbot session.

Anthropic has paired the result with CryptanalysisBench, developed alongside researchers from ETH Zurich, Tel Aviv University, and TU Berlin. The benchmark contains 191 tasks spanning six cryptographic families.

Its three tiers include known practical breaks, stronger schemes with scaled-down variants, and production primitives near the research frontier. That design distinguishes recalled attacks from more demanding cryptanalytic work.

Five frontier models reportedly solved between 65 and 86 percent of the first-tier schemes. They also broke several second-tier schemes at full strength and produced new findings on other designs.

These figures do not establish that models can routinely break production encryption. They show that cryptanalysis has become measurable enough to track rapid capability changes.

That creates pressure for Google and other labs to publish comparable methodology. A claim of original research carries less weight without transcripts, reproducible code, technical papers, and outside review.

It also pressures standards bodies and cryptographic designers. Candidate algorithms can now face far more automated scrutiny before deployment, assuming reviewers can validate the resulting volume.

The competitive advantage may belong to the lab that builds the best research system, not simply the model with the highest benchmark score. Tool access, experiment design, verification, and expert oversight become part of the product.

This development gives the anthropic google race a security dimension that standard mathematics results lack. A wrong theorem wastes research time, while a missed cryptographic flaw can affect digital infrastructure.

The Mechanism Matters More Than the 60-Hour Headline

Claude’s strongest contribution was sustained search across literature, mathematics, and experiments, not a single flash of machine intuition.

Anthropic describes a multi-agent process in which several Claude workers exchanged hypotheses and critiques. This structure let the system explore competing directions without forcing one conversation to preserve every detail.

The successful HAWK idea emerged from disagreement. One worker rejected the symmetry approach, while another found a way to exploit it.

That episode illustrates a useful mechanism for AI-assisted research. Parallel agents can challenge premature conclusions and preserve ideas that one reasoning path discards.

Claude also had access to Sage, a software system used for mathematical computation. It could write code, generate examples, test conjectures, and compare outputs against theoretical expectations.

Computational verification did not replace mathematical reasoning. It narrowed the search and helped confirm whether an abstract attack worked against actual HAWK instances.

The end-to-end implementation matters because cryptographic arguments can fail through a small assumption or complexity error. Recovering a known test key provides stronger evidence than persuasive prose alone.

Yet the process was not fully autonomous. A human managed the project, suggested organizational approaches, and directed Claude toward useful computational libraries.

Anthropic also consulted outside academics and shared the HAWK attack with its authors in June. The company coordinated public disclosure with the relevant NIST mailing list.

This sequence shows an emerging division of labor. Models can generate and test many candidate ideas, while humans select goals, challenge assumptions, and manage responsible disclosure.

Claude’s AES work pushed autonomy further. A researcher built a scaffold that let the model propose hypotheses, run experiments, and reject failed approaches.

The target was a seven-round form of AES-128. Full AES-128 applies ten rounds of transformation, so researchers use shortened versions to study whether attack techniques approach the complete cipher.

Claude initially argued that meaningful improvement was unlikely. Human prompts repeatedly told the system to keep the target and search beyond easy approaches.

After several days, the model developed a fingerprinting method it called the Möbius Bridge. The method removed one guess from an established meet-in-the-middle attack.

A meet-in-the-middle attack stores intermediate calculations and matches them from both directions. This technique exchanges large memory requirements for lower computation time.

Anthropic says the new method accelerated the previous attack by between 200 and 800 times. However, the underlying threat model still assumes access to 2^105 chosen plaintexts.

That requirement is beyond practical collection. The attack also targets only seven rounds, leaving the complete ten-round cipher untouched.

Anthropic’s researchers then spent several hundred hours validating the AES finding. Two researchers reportedly needed nearly a month to become confident in its correctness.

That verification gap may be the most important mechanism in the entire story. AI can produce plausible technical discoveries faster than qualified humans can certify them.

Organizations using these systems will need durable research records. A searchable engineering knowledge base can preserve hypotheses, code, failed experiments, reviews, and disclosure decisions.

Without that record, rapid generation becomes a liability. Teams would struggle to distinguish a genuine attack from an elegant but invalid chain of reasoning.

What the Numbers Do Not Show

Neither result threatens production encryption today, and Anthropic’s evidence still requires continued independent scrutiny.

The HAWK finding sounds dramatic because it nearly halves the scheme’s effective key strength. That description needs two qualifications.

First, HAWK is a candidate, not an adopted production standard. Organizations are not relying on it to secure active systems.

Second, the larger HAWK parameters remain impractical to attack. The result weakens the design and may damage its standardization prospects, but it does not make every configuration immediately breakable.

Key strength also does not fall through a simple physical act. The 2^64 and 2^38 figures describe estimated computational work under a defined attack model.

They do not describe elapsed time on every computer. Hardware, implementation choices, memory, and parallelization all affect practical execution.

The AES result needs even stronger caution. Claude did not break the AES-128 encryption used throughout current computing.

It improved an academic attack against a version with seven rounds instead of ten. Studying reduced-round designs helps researchers measure security margins, but those designs are intentionally weaker.

The assumed 2^105 chosen plaintexts also make the attack infeasible. Even its substantial speed improvement does not turn the method into an operational tool.

Independent cryptographers have emphasized that distinction. Chris Peikert, a cryptography professor involved in lattice research, described the HAWK result as a serious mathematical attack on a candidate scheme.

Other researchers have warned against translating the AES result into claims that ordinary encrypted data is exposed. Both views can be correct because the research advance and its immediate operational impact are different questions.

Anthropic itself states that neither primary result affects production systems. No deployed software needs to change because of these findings.

The company also says the HAWK attack does not affect other NIST post-quantum candidates. That boundary should remain explicit whenever the result is discussed.

Historical precedent supports caution without dismissing the work. The SIKE post-quantum candidate survived years of attention before researchers broke it on a conventional laptop.

That failure did not show that all post-quantum cryptography was unsound. It showed that open standardization works by eliminating candidates with hidden weaknesses.

HAWK now faces a similar test. Its designers can revise the construction, increase parameters, contest the analysis, or accept that the tradeoffs no longer justify standardization.

The under-four-hour claim presents a separate credibility problem. Anthropic’s source material gives 60 hours for the HAWK discovery and verification process.

The smaller HAWK-256 attack may execute quickly once developed. Anthropic also describes a more recent attack against reduced-round LEA that runs in under an hour.

Those separate facts may have been compressed into an inaccurate headline. Readers should not treat that compression as the event’s verified timeline.

The anthropic google framing can create another distortion if it becomes a scorecard. Google did not submit HAWK, and Gemini was not reported as a direct participant in this test.

Google’s role is contextual. Its mathematical research provides evidence that several frontier-model programs are moving toward original scientific work.

The strongest conclusion remains narrower. Claude helped find a serious weakness in one proposed post-quantum scheme and improved research against weakened versions of two established ciphers.

That is impressive evidence of AI-assisted cryptanalysis. It is not evidence that Claude can unlock current encrypted communications.

AI Cryptanalysis Shifts the Bottleneck to Human Review

The immediate pressure falls on reviewers, standards bodies, and security teams that must validate machine-generated findings faster than before.

Traditional cryptographic review depends on a relatively small community of specialists. Researchers publish constructions, analyze proofs, test implementations, and challenge security assumptions over several years.

Frontier models can multiply the number of attempted attacks. They can read large bodies of literature and run computational experiments without normal working-hour constraints.

That expansion favors defenders when models examine candidate standards before adoption. More scrutiny can expose weak assumptions while changing an algorithm remains manageable.

The same capability creates risk after deployment. A valid attack against a widely used primitive would require careful disclosure, rapid validation, coordinated patches, and clear public communication.

Anthropic says it consulted academics, government representatives, industry partners, and the HAWK authors before publishing. That process offers an early model for handling AI-generated cryptographic results.

However, verification remains expensive in expert attention. Anthropic’s AES case required much more human validation time than model discovery time.

This asymmetry will worsen if model output grows faster than the specialist community. Researchers could receive hundreds of technically plausible attacks without enough time to examine each one.

Automated checking can help when a claim produces executable key recovery. HAWK test keys can be generated, attacked, and compared against known answers.

Proof-heavy findings are harder. A subtle theoretical attack may depend on assumptions that test code cannot fully capture.

Cryptographic standards bodies will therefore need new submission rules. Machine-assisted work should include reproducible code, complete complexity estimates, assumptions, failure cases, and detailed provenance.

The same requirements apply inside companies. Security leaders should not deploy an AI-generated fix merely because a model also generated a convincing exploit.

They need separation between discovery and validation. Different reviewers, tools, and model runs should attempt to falsify each claim.

The NIST standards process already provides part of this structure. Candidate submissions receive public review before standardization, allowing weaknesses to emerge without exposing deployed users.

AI can increase the amount of review, but it cannot remove the need for governance. A system that finds attacks also creates sensitive information requiring access controls and disclosure discipline.

The anthropic google competition adds incentives that deserve attention. Labs benefit when their models appear capable of expert-level discovery.

Those incentives can encourage useful transparency, including papers and reproducible artifacts. They can also reward dramatic public framing before independent review reaches consensus.

Readers should therefore separate three layers of evidence. The first is the company’s account of what the model did.

The second is reproducible technical material that other researchers can test. The third is independent confirmation of novelty, correctness, and impact.

Anthropic has provided more than a press release. It published technical papers, demonstration code for HAWK, and a rewritten record of the AES reasoning process.

That evidence makes the claims testable. It does not make critical review optional.

Three Signals to Watch After the Claude Security Test

The next phase will reveal whether this was an isolated success, a repeatable research method, or the start of a validation crisis.

The first signal is HAWK’s status in the NIST process. Reviewers must decide whether larger parameters preserve enough efficiency and security to keep the proposal competitive.

If HAWK is revised successfully, Claude’s work will look like productive predeployment review. If the candidate is withdrawn, the finding will have changed a real standards decision.

Either outcome strengthens the value of AI-assisted testing. A rejection would not mean that post-quantum cryptography broadly failed.

The second signal is independent reproduction of the AES analysis. Researchers must verify the Möbius Bridge method, its complexity estimates, and its claimed speed advantage.

Successful reproduction would establish Claude’s result as a genuine extension of a long cryptanalytic research line. Substantial corrections would weaken claims about autonomous expert-level performance.

The third signal is performance on future benchmark versions. CryptanalysisBench offers a common test across block ciphers, hash functions, and other primitives.

Researchers should watch whether Claude, Gemini, GPT, and open-weight models reproduce known attacks without contamination. Novel results must also survive expert review.

Consistent improvement would turn the anthropic google rivalry into an arms race for scientific research systems. Irregular results would suggest that scaffolding and researcher judgment remain more decisive than model branding.

Security teams do not need to replace production encryption because of this announcement. They should instead examine whether their review and disclosure processes can absorb more machine-generated findings.

That preparation includes preserving experiment logs, separating discovery from approval, and identifying experts before an urgent claim arrives. It also includes tracking standards guidance rather than reacting to compressed headlines.

The reported under-four-hour feat should not become the lasting version of this story. The verified HAWK project took about 60 hours, and its target was not deployed.

Claude’s actual achievement is more useful than the exaggerated claim. It searched a difficult mathematical space, found a verifiable weakness, and forced humans to reconsider the speed of cryptographic review.

That leaves one practical question for every security and research organization: if the next AI-generated attack affects a deployed system, who will validate it before the headline outruns the evidence?