Anthropic Google Security Race Sharpens as Claude Finds Cryptography Weaknesses

Anthropic says Claude Mythos Preview found two cryptographic attacks, including one against a post-quantum signature candidate that survived two years of expert review. The Anthropic Google security relationship now faces a harder question than ordinary software defense. Can frontier laboratories safely manage AI systems that increasingly operate like cryptography researchers?

The findings do not compromise online banking, encrypted messages, or deployed Google services. One targets HAWK, an undeployed digital signature proposal being evaluated by the National Institute of Standards and Technology. The other improves an attack against seven-round AES, a deliberately weakened research version of the widely deployed cipher.

That limitation matters, but it does not make the research routine. Mythos found the HAWK attack after about 60 hours and performed most of the work with limited human direction. It also developed a new technique that made an existing theoretical AES attack between 200 and 800 times faster.

Google enters the story as both an Anthropic partner and a frontier research rival. It participates in Anthropic’s Project Glasswing security initiative while developing Gemini and its own mathematical reasoning systems. That arrangement turns the result into a test of shared defense, competitive capability, and responsible disclosure.

Claude Moved From Finding Coding Errors to Testing Cryptographic Designs

The important change is that Claude attacked the mathematics behind proposed algorithms, not merely mistakes in software implementations.

Software vulnerabilities and cryptographic weaknesses are related, but they are not interchangeable. An implementation bug appears when developers incorrectly translate a sound design into working code. A cryptanalytic weakness concerns assumptions inside the design itself.

Claude had already found implementation problems in cryptographic libraries. Those cases involved code that used encryption algorithms incorrectly. Anthropic’s cryptography research says Mythos Preview has now found improved mathematical attacks against the algorithms researchers gave it.

The first target was HAWK, a post-quantum digital signature scheme. A digital signature lets a system verify identity and detect unauthorized changes without exposing the signer’s private key.

Post-quantum cryptography aims to resist both conventional computers and future cryptographically relevant quantum machines. Such machines would threaten widely used public-key systems, including RSA and elliptic-curve signatures.

HAWK remains a candidate in NIST’s process for selecting additional digital signature standards. Its public evaluation is designed to expose weaknesses before governments and businesses depend on it.

That process had already subjected HAWK to two rounds of expert analysis across roughly two years. Mythos then identified a previously unused symmetry in the mathematical lattice supporting the scheme.

A lattice is a structured grid of points used to construct problems believed to be difficult for computers. HAWK relies on the difficulty of finding relationships between particular lattices.

Mythos found a nontrivial automorphism, meaning a hidden symmetry that preserves the lattice’s structure. Earlier research had shown that locating such a symmetry would enable an attack. It had not established that the relevant symmetry was accessible in HAWK.

The resulting attack reduced the estimated work needed to recover the smallest HAWK-256 key from 2^64 operations to 2^38. Larger HAWK parameters remain impractical to attack, and the method does not undermine lattice cryptography generally.

The practical consequence is still serious for HAWK’s design. According to Anthropic, maintaining the intended security would require roughly doubling its key size. That change would remove important efficiency benefits behind the proposal.

The HAWK evaluation is therefore doing what public cryptographic review should do. A design entered an adversarial process, a weakness emerged before deployment, and reviewers gained evidence for their standardization decision.

The reversal lies in who supplied that evidence. A language model, supported by a researcher without specialist lattice-cryptography training, found the central idea that established experts had not published.

The Anthropic Google Partnership Now Covers a More Sensitive Frontier

The Anthropic Google relationship gives defenders access to stronger analysis, while creating shared responsibility for results that cannot always be published immediately.

Google is one of several technology companies participating in Project Glasswing, Anthropic’s program for applying Claude Mythos to important software. Other named participants include Apple, Microsoft, Amazon Web Services, Cisco, NVIDIA, and the Linux Foundation.

That group gives Anthropic access to experienced security teams and widely deployed systems. It also creates channels for validating findings, coordinating patches, and deciding when technical details can safely become public.

Cryptography makes those coordination questions more difficult. A software vulnerability normally has an identifiable maintainer and a patching path. A weakness in a deployed cryptographic primitive can affect protocols, hardware, certificates, identity systems, and archived information.

Replacing an algorithm can require years. Organizations must first identify every place where the algorithm appears. They then need compatible replacements, updated hardware, migrated keys, vendor support, and rules for old data.

Google has a direct interest in that transition. Its browsers, cloud services, operating systems, and identity infrastructure depend on cryptography. It also conducts quantum computing research that informs estimates about when existing public-key systems need replacement.

Anthropic linked its HAWK analysis to Google’s discussion of the shrinking timeline for a cryptographically relevant quantum computer. Google’s quantum risk estimate is not proof that such a machine will arrive on a fixed schedule. It is evidence that major laboratories treat migration planning as an active engineering problem.

The Anthropic Google partnership also illustrates an unusual market structure. The companies cooperate on defensive security while competing to build increasingly capable general-purpose models.

Google has reported mathematical research performed with Gemini. Anthropic has presented Claude’s cryptanalysis as evidence of expert-level research ability. OpenAI has made similar claims about models addressing difficult mathematical problems.

These results shift competition beyond chatbot quality and coding benchmarks. Laboratories now want models that can search literature, propose hypotheses, run experiments, reject failed approaches, and produce results suitable for expert review.

Cryptanalysis is an unusually revealing test. Many proposed attacks can be checked with mathematical arguments or executable demonstrations. That makes success easier to evaluate than an open-ended essay or business recommendation.

The field also has unusually high consequences. A false claim can waste weeks of specialist effort. A correct result against a deployed system can create an immediate disclosure problem.

This is why the Anthropic Google connection matters more than a conventional partnership announcement. The relevant product is not only the model. It is the combined system of researchers, secure infrastructure, validation procedures, vendors, and government contacts surrounding the model.

Enterprises should draw a similar lesson. Buying access to an advanced model does not create a cryptography program. Organizations need an inventory of algorithms, accountable reviewers, controlled testing environments, and a route for escalating credible findings.

They also need durable records of evidence and decisions. A searchable engineering knowledge base can help teams preserve test results, implementation context, and reviewer conclusions across a long migration.

The pressure falls most heavily on security leaders who still treat cryptography as static infrastructure. AI-assisted research makes continuous evaluation more realistic, while shortening the time available to respond when assumptions fail.

Anthropic Google Researchers Face a New Validation Bottleneck

Claude generated candidate discoveries faster than Anthropic’s researchers could confidently validate and prepare them for publication.

The HAWK effort used a multi-agent harness, a controlled environment where several Claude instances could exchange findings and use computational tools. The system had access to Python, Sage mathematics software, and published cryptographic research.

A human operator provided project management and occasional nontechnical direction. The operator had theoretical computer science experience but was not a lattice-cryptography specialist.

Two model workers independently examined the symmetry that became central to the attack. One rejected the approach prematurely. The other developed it further, shared evidence, and eventually convinced its peer.

Mythos then constructed an end-to-end verification pipeline. That step let the human operator test whether the proposed key-recovery method worked as described.

The AES experiment required less direct guidance after Anthropic built the initial scaffold. AES, or the Advanced Encryption Standard, encrypts data by repeatedly transforming fixed-size blocks under a secret key.

AES-128 uses 10 rounds. Researchers study reduced-round versions to measure security margins and develop techniques that might reveal structural weaknesses. Breaking seven rounds does not break the full deployed cipher.

The previous seven-round attack used a meet-in-the-middle method. This technique stores intermediate calculations so an attacker can connect partial computations from opposite directions.

One stage required 256 separate guesses and lookups. Mythos created a fingerprint that remained unchanged across those guesses, eliminating that portion of the search.

Claude called the construction a Möbius Bridge. Additional optimizations offset the cost of computing the new transform, producing the reported 200-to-800-fold speed increase.

The attack still assumes access to 2^105 chosen plaintexts. A chosen-plaintext model lets an attacker request encryptions of selected messages under an unknown key. That data requirement makes the result completely impractical.

Anthropic also says implementing the attack would require extraordinary computing resources. More importantly, the method applies to seven rounds rather than the 10 rounds used by AES-128.

The research therefore changes the published understanding of a reduced system without creating a working attack on everyday encryption. Both statements can be true at the same time.

What stands out is the difference between discovery and verification time. Mythos found the AES idea within about one week, after producing a very large volume of intermediate work. Human researchers then spent several hundred hours studying cryptography and checking the result.

Anthropic says two researchers needed nearly a month to become confident in the method. That imbalance is the mechanism driving the larger industry problem.

Models can run many speculative investigations in parallel. Human specialists must determine whether each result is correct, novel, relevant, and safe to disclose. Scaling the first activity without scaling the second produces an expanding review queue.

The new CryptanalysisBench study makes that trend measurable. Its authors assembled 191 tasks across six families of cryptographic primitives and three difficulty tiers.

Five frontier models reportedly broke between 65% and 86% of the first-tier schemes. They also found attacks across stronger and scaled-down tasks, including results the authors considered previously unknown.

Those benchmark findings remain research claims rather than a guarantee of reliable autonomous cryptanalysis. However, they provide a broader test than Anthropic’s two headline examples.

For the Anthropic Google security network, the operational question is now clear. Model access can expand discovery capacity, but the partners still need scarce specialists to validate what the models produce.

The AES Result Is Significant Without Being an Encryption Emergency

Neither finding breaks a production cryptographic system, and overstating that point would obscure the research’s real importance.

The easiest misleading headline would say Claude broke AES. It did not. Mythos improved a theoretical attack on a modified version using seven of AES-128’s 10 rounds.

Cryptographers intentionally study reduced-round designs because full-strength algorithms often resist direct analysis. These smaller targets help researchers test ideas and understand how much protection additional rounds provide.

A better attack can narrow a cipher’s perceived security margin. It does not automatically transfer to the full cipher, especially when several rounds remain untouched.

NIST standardized AES encryption in 2001. The algorithm has received decades of public analysis and remains central to digital communications, storage, and authentication systems.

The Mythos result extends that research tradition. It improves the best known attack under an extreme data assumption, but it leaves full AES-128 unaffected.

HAWK also presents no immediate production exposure. NIST has not standardized or deployed it. The new attack does not affect other post-quantum signature candidates, according to Anthropic’s analysis.

That boundary should temper claims that Claude found weaknesses threatening current internet security. It should not erase the speed or novelty of the work.

An independent report from CyberScoop quoted Keyfactor executive Ellen Boehm describing the HAWK result as evidence that NIST’s evaluation process works. Public review is supposed to reject weak candidates before adoption.

The finding also resembles earlier post-quantum standardization failures. SIKE, another candidate, survived substantial attention before researchers found a devastating attack that ran on ordinary hardware.

Cryptographic competitions expect losses. Their purpose is to concentrate adversarial effort before standards become difficult to replace. AI adds another source of adversarial effort to that process.

The strongest skeptical point concerns external validation. Anthropic produced the model, designed the harness, employed the researchers, and published the headline interpretation.

The company says it consulted academics, notified HAWK’s authors, released papers, and provided demonstration code. Those steps make independent scrutiny possible, but scrutiny still needs time.

The AES paper presents another complication. Anthropic acknowledges that its researchers were not cryptography experts and spent substantial time learning enough material to check Claude’s work.

That admission is valuable because it exposes the verification gap. It also means outside cryptographers should examine the claimed novelty, runtime analysis, assumptions, and relationship to prior attacks.

Reproducible code offers stronger evidence for HAWK because researchers can run the recovery process against test keys. The AES result depends more heavily on detailed mathematical and complexity analysis.

AI systems can generate plausible technical narratives even when an underlying argument contains a subtle error. Long autonomous runs can make those errors harder to locate because reviewers must inspect extensive intermediate reasoning.

Anthropic released a rewritten account of one relevant Claude session. It also notes that many sessions failed and that later sessions refined the central idea.

That disclosure helps readers understand the process, but it does not provide a simple success rate. The public cannot infer that assigning Claude any difficult cipher will produce a valid discovery.

The right conclusion is narrower. A carefully scaffolded frontier model produced two serious cryptanalytic results under controlled research conditions. One is directly testable, while the other requires continued expert review.

This distinction protects both sides of the story. It avoids an unfounded encryption panic while recognizing that AI-assisted cryptanalysis has crossed a meaningful capability threshold.

The Real Contest Is Discovery Speed Versus Defensive Response

AI makes cryptographic review cheaper to scale, but it can also give attackers more chances to find the one weakness defenders overlooked.

Traditional cryptographic research depends on a limited community of mathematicians, security engineers, and protocol specialists. Each person can pursue only a small number of ideas at once.

Agent systems change that constraint. They can read papers, write experimental code, generate conjectures, and launch parallel searches without waiting for additional human hires.

Most paths will fail. That does not necessarily undermine the model. Security research often rewards the one successful path among hundreds of rejected ideas.

The HAWK workflow illustrates this search advantage. One agent discarded the useful direction, but another continued. Their shared environment allowed a promising idea to survive an individual mistake.

The same capability creates asymmetric risk. Defenders must find and fix every exploitable weakness across systems they maintain. An attacker needs only one overlooked weakness and a workable route to exploitation.

Cryptography raises the stakes because a single primitive can sit beneath many products. A flaw may affect data recorded before its public discovery, particularly when adversaries store encrypted traffic for later analysis.

No such failure occurred here. HAWK is undeployed, and full AES remains intact. The concern is what happens when the same research process reaches less studied production algorithms.

Anthropic says it has already tested reduced versions of other ciphers. It reported preliminary work involving LEA, Serpent-128, Salsa20, Poseidon, and SHA-1.

The company carefully limited those claims. Several attacks apply only to reduced-round variants, while other reported improvements remain modest or await fuller investigation.

Still, this long-tail focus matters. Security attention concentrates on standards like AES, TLS, and widely deployed signature systems. Specialized algorithms may receive much less sustained analysis.

A model does not become tired of reading obscure papers or testing niche designs. Once a capable scaffold exists, researchers can redirect it toward many targets.

The Anthropic Google partnership offers defenders an early coordination advantage. Google and other Glasswing members can identify critical systems, contribute domain expertise, and prepare remediation channels before broader access expands.

That advantage will not remain exclusive forever. Competing laboratories are improving reasoning systems, open models continue advancing, and published scaffolding techniques can spread between research groups.

The central tradeoff is therefore access versus preparedness. Restricting a capable model can slow misuse, but it also limits the number of defenders who can apply it.

Broad release expands defensive coverage while increasing the chance that poorly governed users target deployed systems. It also creates more unverified findings for maintainers to process.

A workable response needs graduated access based on capability and target sensitivity. Benign benchmark tasks require fewer controls than searches against deployed identity systems or critical infrastructure.

Research teams also need disclosure rules before discovery begins. Those rules should identify who receives a finding, how validation occurs, when vendors are contacted, and what evidence can be published.

Anthropic says it shared the HAWK attack with its authors in June. It coordinated release through a public NIST mailing list and briefed government and industry partners beforehand.

That procedure worked because HAWK had identifiable authors, a standards forum, and no deployment base. A flaw in a widely embedded primitive would create a much more complex decision.

The main opponent is no longer Anthropic versus Google. It is accelerated AI discovery versus the slower human system responsible for verification, repair, and migration.

What the Anthropic Google Security Network Must Prove Next

The next evidence must show repeatable validation, responsible access, and faster defensive remediation rather than another isolated research headline.

The first signal to watch is independent reproduction of the HAWK and AES papers. Cryptographers should verify the implementation, complexity estimates, novelty, and boundaries of both attacks.

Successful reproduction would strengthen Anthropic’s claim that Claude performed expert-level cryptographic research. Material errors or overlooked prior work would weaken the broader capability argument.

The second signal is NIST’s treatment of HAWK. Reviewers may reject the current parameters, request a redesign, or decide that larger keys preserve enough value for continued consideration.

That response will show whether Mythos merely adjusted an academic estimate or changed a live standardization decision. Either outcome would also demonstrate how AI-generated evidence enters a formal public process.

The third signal is how Project Glasswing handles a finding against deployed cryptography. That case would test whether the Anthropic Google security network can validate, contain, and coordinate a result before attackers exploit it.

A responsible system must separate raw model output from actionable vulnerability claims. It must also give affected vendors enough evidence to respond without unnecessarily exposing users.

The next few months should reveal whether academic groups adopt CryptanalysisBench and obtain comparable results from other models. Repeated success across independent laboratories would matter more than additional Anthropic case studies.

Researchers should also report failure rates and total search effort. A model that finds one useful attack after enormous exploration has value, but its reliability differs from a consistent research assistant.

For enterprise buyers, the immediate action is not replacing AES or reacting to every AI-generated cryptography claim. It is mapping where cryptographic dependencies exist and assigning owners for future migrations.

Security teams should ask vendors how they inventory algorithms, validate AI-assisted findings, and coordinate disclosure. They should also preserve the ability to rotate keys and replace primitives without rebuilding entire applications.

Claude’s results do not announce an encryption crisis. They announce a faster research loop whose defensive institutions still operate at human speed.

The decisive question is whether Anthropic, Google, standards bodies, and outside cryptographers can shorten that response loop together. If they cannot, the next valid discovery may arrive before its users are ready.