Anthropic Google Security Partnership Faces a New Test as Claude Mythos Outpaces Human Cryptography Research

Anthropic says Claude Mythos Preview found two cryptographic attacks in days, despite years of prior human scrutiny. The Anthropic Google security partnership now faces a harder question than software vulnerability discovery. Can defenders validate and absorb machine-generated research before similar capabilities spread to attackers?

The results do not mean Claude broke the encryption protecting online banking, private messages, or corporate data. One attack targets HAWK, an undeployed digital signature proposal under federal review. The other improves an attack against seven-round AES-128, a deliberately weakened research variant of the ten-round cipher used in production.

That distinction matters, but it does not erase the central reversal. Cryptanalysis has long depended on a small community of specialists combining mathematical intuition with months or years of review. Mythos reportedly produced a serious HAWK attack within 60 hours and improved reduced-round AES research within one week.

Google enters the story through Project Glasswing, Anthropic’s restricted security collaboration with major technology and infrastructure organizations. The program gives vetted partners access to advanced Claude capabilities for defensive research. The latest findings raise the stakes for every participant because cryptographic flaws create a different disclosure problem from ordinary software bugs.

Claude Mythos Found Two Different Kinds of Weakness

The important change is not that AI can explain cryptography. It is that an AI system reportedly helped create new, verifiable cryptanalysis.

Anthropic disclosed the findings on July 28, 2026. Its researchers said Mythos Preview contributed to attacks against HAWK and a reduced version of the Advanced Encryption Standard, or AES.

HAWK is a post-quantum digital signature scheme. Digital signatures let a recipient verify who signed a message and whether anyone changed it. Post-quantum schemes aim to resist attacks from both conventional and future quantum computers.

The National Institute of Standards and Technology has been evaluating HAWK through its process for additional signatures. HAWK is a candidate, not an approved standard, and organizations do not currently rely on it for production security.

According to Anthropic, Mythos identified a nontrivial automorphism in HAWK’s underlying lattice. An automorphism is a symmetry that maps a mathematical structure back onto itself while preserving important relationships.

That symmetry gave researchers a shortcut for recovering a HAWK private key. The attack reduced the effective strength of the scheme enough that maintaining the intended security level would require substantially larger keys.

The smallest HAWK parameter set was expected to require about 2^64 operations to attack. The reported method lowers that estimate to roughly 2^38 operations. That remains a substantial computation, but it changes the security assessment for the candidate.

The finding also challenges a main reason to consider HAWK. Larger keys could offset the weakness, yet that adjustment would reduce the efficiency advantages that helped make the proposal attractive.

Anthropic says Mythos found the core HAWK attack after about 60 hours. Human researchers provided occasional direction, reviewed the output, and turned the model’s work into a formal result.

The second project involved AES-128, the widely deployed symmetric cipher used to protect data. Symmetric encryption uses the same secret key to encrypt and decrypt information.

Production AES-128 applies ten rounds of transformation to each block of data. Cryptographers also study reduced-round versions because those variants expose how much protection each additional round provides.

Mythos attacked a seven-round variant, not the complete cipher. Its main contribution was a mathematical technique called the Möbius Bridge, which removed a memory-intensive lookup from an existing attack.

Combined with other changes, the approach reportedly made the best attack against seven-round AES between 200 and 800 times faster. It still requires more than 2^105 chosen plaintexts, meaning messages selected specifically for analysis.

That data requirement is beyond practical reach. The result therefore improves the academic state of the art without threatening full AES-128.

Anthropic says each research effort consumed substantial model usage. More important than the resource total is what that usage purchased: persistent exploration across many possible mathematical paths without human fatigue.

These are two different results. The HAWK work changes the assessment of an active standardization candidate. The AES work advances analysis of a weakened research target while leaving production encryption intact.

Together, they create the article’s central tension. Claude did not crack the internet, but it reportedly compressed serious cryptographic research into a machine-paced workflow.

Why the Anthropic Google Partnership Now Matters More

Cryptographic research turns Project Glasswing from a software defense program into an early governance test for machine-speed scientific discovery.

Anthropic introduced Claude Mythos Preview and Project Glasswing in April 2026. The initiative brought together organizations including Google, Apple, Microsoft, Cisco, CrowdStrike, Amazon Web Services, NVIDIA, and the Linux Foundation.

The partnership was designed to find and repair serious vulnerabilities before broadly available AI systems gave attackers comparable abilities. Anthropic initially limited Mythos access because the model could reportedly discover and exploit software weaknesses with little guidance.

The company’s earlier cybersecurity assessment said Mythos could inspect large codebases, identify previously unknown bugs, and develop working exploits. It also reported weaknesses in implementations of cryptographic protocols and libraries.

Finding a defective implementation differs from attacking the underlying mathematics. A software bug usually affects particular versions of a program. Maintainers can patch the code, distribute an update, and track adoption.

A weakness in a cryptographic design has a wider blast radius. If organizations deploy the design broadly, replacing it can require changes across software, hardware, protocols, certificates, archived data, and compliance systems.

HAWK is not deployed, which makes this the favorable version of the story. The weakness emerged during evaluation, before the proposal became embedded in infrastructure.

That is exactly what an open standardization process is supposed to achieve. Candidates face sustained public review so weak designs can be modified or rejected before adoption.

Ellen Boehm, Keyfactor’s senior vice president for strategy and AI innovation, told CyberScoop that the finding shows the evaluation process working. Her assessment places Mythos inside the existing review system rather than treating it as a replacement for that system.

The Anthropic Google relationship matters because Google operates software, browsers, cloud services, identity systems, and infrastructure that depend on cryptography. It also employs researchers who design and analyze security protocols.

Google’s participation does not mean its researchers produced or independently endorsed the HAWK and AES findings. Public information only establishes that Google participates in Project Glasswing and has received access within that defensive framework.

Still, Google represents the kind of organization that must react if automated cryptanalysis scales. It maintains enough infrastructure to understand both the defensive opportunity and the migration burden.

The pressure is not limited to Google. Standards bodies must decide how to accept, reproduce, and document AI-assisted submissions. Vendors must track where algorithms appear in their products. Security teams must prepare for more findings than human reviewers can quickly process.

The Anthropic Google partnership therefore offers an early model for controlled access. It connects model developers with organizations capable of validating findings and coordinating repairs.

That approach also concentrates information and capability among a small group. Organizations outside the partnership must trust that participants will disclose relevant results quickly, accurately, and fairly.

Cryptographic research makes that concern more urgent. A software vendor can usually receive a private bug report and issue a patch. A newly discovered mathematical weakness can affect competing vendors, governments, researchers, and standards processes simultaneously.

The challenge is no longer only finding flaws before attackers. It is building a review pipeline that can keep pace without giving a private consortium excessive influence over public security decisions.

The Real Advance Is Research Compression

Mythos did not eliminate human cryptographers. It changed how much exploratory work a small human team can attempt within a fixed period.

Cryptanalysis combines theory, experimentation, implementation, and repeated failure. Researchers form hypotheses, test smaller cases, write code, inspect results, revise assumptions, and decide which path deserves more attention.

Language models can now participate across that loop. They can read specifications, derive equations, implement experiments, invoke mathematical tools, compare outputs, and preserve useful intermediate results.

That range matters more than any single answer. Traditional automation performs well when researchers already know the exact search procedure. Frontier models can propose and test different procedures while responding to unexpected evidence.

The HAWK case reportedly began with Mythos identifying a structural symmetry in the scheme’s lattice. A human researcher then helped steer the investigation and evaluate whether the observation supported a real attack.

This workflow complicates simple claims about autonomy. The model contributed a key idea and performed much of the analysis, but humans selected the research target, configured the environment, reviewed outputs, and prepared the result.

“Autonomous” should therefore describe parts of the process, not the entire scientific project. Mythos could continue technical exploration without constant prompting. It did not independently choose the social objective or publication standard.

The reduced-round AES project demonstrates a different form of value. The target had received extensive human analysis, and the model did not expose a practical break. It found a more efficient route through a highly constrained theoretical attack.

The reported speedup came partly from eliminating a lookup table containing 256 entries. This did not remove the attack’s enormous data requirement, but it improved its time and memory characteristics.

That distinction reveals why AI-assisted research can progress before models become universally reliable. A candidate attack can often be checked through equations, executable code, or a formal security experiment.

Cryptanalysis offers unusually clear feedback. Either a proposed key-recovery method recovers the key under stated conditions, or it does not. Researchers can reject many hallucinated paths without trusting the model’s prose.

The newly released CryptanalysisBench provides broader evidence for this capability shift. Its authors evaluated 191 tasks spanning six families of cryptographic primitives.

Five frontier models solved between 65 and 86 percent of tasks involving schemes with known practical attacks. Claude Mythos 5 achieved 42 successes across 49 Tier 1 tasks, the highest result reported.

The benchmark also included harder schemes without known practical breaks. Mythos 5 broke 61 schemes when full and scaled variants were counted, compared with 37 for Claude Opus 4.8.

Those figures do not show that models can defeat modern production cryptography. The challenge tier remains largely unsolved, and many benchmark wins involve weakened configurations or schemes with known flaws.

The results do show that models can navigate technical research environments, implement attacks, and sometimes find previously unreported design problems. That is a higher bar than summarizing existing papers.

The human comparison also needs care. A 60-hour model run is not equivalent to one cryptographer working for 60 hours. The system can use large amounts of computation, parallel experimentation, and extensive prior knowledge encoded during training.

The meaningful comparison concerns elapsed research time and team output. A small group gained access to far more exploratory labor than it could have produced manually during the same week.

This is research compression. The model turns computation into additional attempts, while humans decide which attempts deserve belief.

That balance pressures labs to redesign research operations. Expertise shifts toward choosing targets, building evaluations, spotting subtle model errors, and converting tentative results into defensible claims.

Human judgment remains essential, but it enters later in the loop. Researchers spend less time generating every candidate and more time validating a much larger stream of candidates.

The Findings Do Not Break Production Encryption

The strongest reason for caution is also the simplest: neither published attack compromises a cryptographic system that people use today.

HAWK remains a proposal. Its designers can revise its parameters, respond to the analysis, or withdraw the affected configuration without forcing users to migrate deployed systems.

The HAWK specification describes a compact signature system based on lattice assumptions. Those assumptions have always required public scrutiny before standardization.

The Mythos result contributes to that scrutiny. It does not imply that every lattice-based signature has the same weakness. The attack depends on HAWK’s particular mathematical structure.

It also does not invalidate NIST’s completed post-quantum standards. HAWK is part of a separate process examining additional digital signature options.

The AES result needs even stronger qualification. Seven-round AES-128 is a research variant designed to be weaker than the deployed ten-round form.

Attacking fewer rounds helps cryptographers measure a cipher’s security margin. Progress against seven rounds can be mathematically valuable without establishing a path through all ten.

The Mythos-assisted attack also assumes an extraordinary volume of chosen plaintexts. A chosen-plaintext setting lets the attacker select messages and observe their encrypted outputs.

Real systems restrict access, rotate keys, limit data, and add protocols around the underlying cipher. Those controls make the published theoretical conditions even less practical.

Calling the result an “AES break” would therefore mislead readers. It is an improvement against reduced-round AES, not a compromise of AES-128 as deployed.

The same caution applies to claims that AI has surpassed all human cryptographers. The model worked within a human-designed scaffold and drew on decades of published research embedded in its training environment.

Researchers have not publicly established how often Mythos pursued false leads, how many runs failed, or how performance changes under a fixed computational budget. Success stories reveal capability, but they do not provide a complete productivity measure.

Reproducibility presents another problem. Independent specialists need enough detail to verify the mathematics and code. Model transcripts can help, yet lengthy agent traces may be harder to audit than a conventional derivation.

Public skepticism has focused on the level of specialist oversight. Critics argue that extraordinary cryptographic claims deserve review by established experts before broad promotional framing.

That criticism should not be dismissed as resistance to automation. Cryptographic errors can survive peer review, and a plausible attack may hide a mistaken assumption about the adversary or security model.

Outside confirmation strengthens the case. Reporting indicates that HAWK’s designers acknowledged the substance of the attack, while independent cryptographers reviewed the reduced-round AES result.

Formal publication and continued peer review remain necessary. An impressive model trace is evidence of a research process, not a substitute for a complete proof.

The benchmark evidence also exposes clear limitations. Even Mythos failed on some schemes with known attacks, and the hardest production-oriented tasks remain open.

Models can waste their budget implementing a correct concept, target the wrong security game, or exploit weaknesses in a testing harness. These are familiar agent failures with unusually high stakes.

A security organization should therefore treat AI-generated cryptanalysis as untrusted research until experts reproduce it. That policy captures the defensive value without converting vendor claims into operational facts.

Machine-Speed Cryptanalysis Changes the Defender’s Bottleneck

Faster discovery helps defenders only when verification, disclosure, and migration can move at comparable speed.

Software security already faces this imbalance. Automated tools can generate more potential findings than maintainers can review. Mythos extends the same pressure to mathematically complex systems.

The first bottleneck is validation. A model can explore many hypotheses quickly, but qualified cryptographers remain scarce. Each serious claim can require careful review of proofs, code, parameter assumptions, and threat models.

The second bottleneck is disclosure. HAWK’s undeployed status simplified coordination, but future findings may affect widely used primitives. Publishing too early could expose systems before vendors prepare mitigations.

Waiting too long also creates risk. A small set of companies or governments could possess knowledge that affects everyone while outside organizations remain unable to evaluate their exposure.

The third bottleneck is cryptographic inventory. Many enterprises do not know which algorithms, key sizes, certificates, libraries, or embedded devices they depend on.

A newly discovered weakness is difficult to manage without that map. Teams cannot prioritize migration if they cannot locate every affected use.

This is where the Anthropic Google collaboration becomes operationally significant. Google and other Glasswing partners maintain systems large enough to test whether machine-generated findings can flow into real remediation programs.

The partnership can help develop review methods, evidence standards, and disclosure procedures. It can also reveal whether major organizations can process findings without overwhelming maintainers.

However, access control does not solve the underlying diffusion problem. Comparable cryptanalytic capability will not remain exclusive to one model or one partnership indefinitely.

CryptanalysisBench evaluated closed and open-weight systems. The open GLM-5.2 model trailed Mythos but still solved 32 of 49 Tier 1 tasks.

That gap matters, yet the broader direction matters more. Multiple model families can already perform meaningful portions of an attack workflow.

The offensive advantage depends on what happens next. If defenders use advanced systems to examine candidates before deployment, AI can strengthen standards. If attackers gain capable models before migration improves, discovery could outpace repair.

Cryptography makes delayed remediation especially dangerous. Replacing a browser component may take weeks. Replacing a primitive embedded across hardware and long-lived certificates can take years.

Archived encrypted data creates another exposure. An adversary can collect information now and decrypt it later if a future attack weakens the underlying protection.

The current findings do not create that scenario for AES. They do reinforce the value of cryptographic agility, meaning the ability to replace algorithms without rebuilding an entire system.

Standards organizations will also need clearer rules for AI-assisted submissions. Researchers should disclose model versions, scaffolding, computational budgets, human interventions, failed runs, and verification methods.

These details allow reviewers to distinguish a scientific result from a selective demonstration. They also make capability trends easier to measure across models.

The most useful near-term response is not panic or blanket restriction. It is expanding the human and institutional capacity surrounding automated discovery.

More validators, reproducible tooling, clearer disclosure channels, and complete cryptographic inventories will determine whether machine-speed research benefits defenders first.

What to Watch After the Claude Mythos Cryptography Results

Three signals will show whether this episode becomes a durable research shift or remains an exceptional demonstration.

The first signal is HAWK’s treatment within the NIST process. Reviewers must determine whether revised parameters preserve enough efficiency and confidence for the candidate to continue.

A significant redesign or removal would strengthen the argument that Mythos changed a real standards decision. A narrow parameter adjustment would indicate a useful but more contained finding.

Either outcome would still validate pre-deployment testing. The key question is whether AI-assisted analysis becomes a normal part of evaluating future candidates.

The second signal is independent reproduction of the HAWK and reduced-round AES attacks. External cryptographers need to verify the assumptions, derivations, implementation, and reported performance.

Clear reproduction would strengthen Anthropic’s claim that Mythos contributed genuine research. Material corrections would narrow the result and expose weaknesses in the current validation process.

The third signal is the next generation of controlled benchmarks. Researchers should focus on full-strength schemes, unpublished test problems, and tasks protected against training-data contamination.

CryptanalysisBench already separates known attacks from harder schemes and audits traces for signs of memorization. Its unsaturated tiers provide a useful starting point.

Progress on those tiers would be more informative than repeating solved attacks. A model that consistently finds new flaws under fixed budgets would support a stronger claim about automated scientific research.

The Anthropic Google security partnership should also disclose how participating organizations handle cryptographic findings. Useful evidence would include validation timelines, disclosure outcomes, and the share of model reports rejected by experts.

Readers should resist both convenient extremes. Claude Mythos did not break everyday encryption, but dismissing the work because its targets were undeployed or reduced would miss the purpose of cryptographic research.

Security margins are studied before they disappear. Candidate standards are attacked before users depend on them. The latest results suggest AI can contribute meaningfully to both activities.

Developers and enterprise buyers should ask whether their organizations can identify every critical algorithm they use. They should also ask how quickly those dependencies can change when a standard loses confidence.

Researchers should watch whether independent teams reproduce the work and whether NIST changes HAWK’s status. Those outcomes will say more than any dramatic headline.

The most credible conclusion is narrower and more consequential. Mythos reportedly compressed years of accumulated expertise into days of directed exploration, while humans remained responsible for verification.

That combination puts pressure on every security institution built around a slower research cycle. The next test is whether defenders can redesign their processes before machine-speed discovery becomes widely available.