Anthropic Schneier Watch: LLM Cryptanalysis Found New Attacks, but Modern Ciphers Still Hold

Anthropic researchers helped test a new benchmark where frontier AI models found previously unreported cryptographic attacks, despite failing against the hardest production targets. The anthropic schneier signal matters because Bruce Schneier highlighted the results as something security professionals should watch, not dismiss as another reasoning demo.

CryptanalysisBench tests whether an AI agent can turn mathematical analysis into an executable attack against a cryptographic scheme. Its 191 tasks cover six families of cryptographic primitives, including block ciphers, hash functions, authenticated encryption, and public-key systems.

The central conflict is now measurable. AI-assisted cryptanalysis can strengthen defensive reviews before deployment, while the same capability can eventually help attackers examine systems at a scale human experts cannot match. Current models remain far from breaking full-strength AES or similarly mature ciphers, but the benchmark shows they can already contribute original work.

CryptanalysisBench Turns Research Claims Into Executable Attacks

The benchmark changes the AI reasoning debate by requiring working attack code, not persuasive explanations or scores from another model.

The researchers introduced CryptanalysisBench in a July 2026 preprint. Its authors come from ETH Zurich, Anthropic, the University of Haifa, Technische Universität Berlin, and Tel Aviv University.

The benchmark draws primarily from four National Institute of Standards and Technology competitions. Those programs evaluated candidates for AES, SHA-3, lightweight cryptography, and post-quantum cryptography.

The collection includes 191 tasks across six primitive families. A primitive is a foundational cryptographic algorithm used to provide properties such as encryption, authentication, collision resistance, or digital signatures.

Each task gives an AI agent source code, documentation, and access to a formal security game. A security game defines exactly what an attacker can query and what counts as success.

The model must select an attack target and produce a self-contained script. A separate controller holds the secret keys and answers only permitted requests through an interface.

Verification then runs the script against fresh randomness. Key recovery, forgery, and collision attacks must satisfy their respective success conditions without manual intervention.

Some probabilistic games require more than one successful attempt. For those tasks, the benchmark runs 20 independent instances and requires at least 17 wins. The paper estimates that random guessing would pass this threshold about 0.1 percent of the time.

This structure reduces a persistent problem in AI benchmarks. A model can write plausible mathematics, cite familiar attacks, or convince a language-model judge without producing a valid result.

CryptanalysisBench instead asks a binary operational question. Does the submitted attack defeat the scheme under the stated rules?

The tasks are organized into two tiers and a challenge set. Tier 1 contains 49 algorithms with known practical attacks, so it measures whether models can reproduce or independently rediscover established weaknesses.

Tier 2 contains 142 algorithms without a known practical break, or with attacks too expensive to execute. Researchers test both full-strength designs and reduced versions with fewer rounds, shorter keys, or modified parameters.

The challenge set covers production-grade ciphers near the boundary of published cryptanalysis. It includes AES, ChaCha, Katan-32, Present-80, Simon-32/64, Speck-32/64, and Skinny-64/64.

That distinction is essential. Breaking an old competition candidate, a reduced-round cipher, or flawed reference code does not mean an AI has broken the encryption protecting current web traffic.

Schneier’s security assessment captured the appropriate tone. He called the results early, while stressing that the benchmark is worth watching.

The news is not that modern encryption suddenly failed. It is that automated systems crossed from discussing cryptanalysis into producing some verifiable and apparently original attacks.

The Anthropic Schneier Signal Is Novel Work, Not an AES Break

The strongest result is evidence of original cryptanalytic contribution, while the most important restraint is that full-strength production ciphers remain unbroken.

Five frontier models were evaluated: Claude Opus 4.8, Claude Sonnet 5, Claude Mythos 5, GPT-5.5, and the open-weights GLM-5.2. Anthropic provided access to Mythos 5 through its collaboration with the researchers.

Tier 1 performance ranged from 65.3 percent for GLM-5.2 to 85.7 percent for Mythos 5. Opus 4.8 reached 73.5 percent, while Sonnet 5 and GPT-5.5 each reached 75.5 percent.

These results show broad competence on schemes with documented weaknesses. They do not, by themselves, prove that the models independently derived those weaknesses.

An LLM may recall an attack from training data, reconstruct it from familiar patterns, or discover a different path from the source code. The researchers audited execution traces, but they acknowledge that traces cannot fully separate recall from rediscovery.

The more consequential results came from full-strength Tier 2 schemes. Mythos 5 and Sonnet 5 independently produced a full 128-bit key-recovery attack against SpoC, an authenticated-encryption candidate from NIST’s lightweight cryptography process.

Authenticated encryption with associated data, commonly called AEAD, protects both a message’s confidentiality and its integrity. The reported SpoC attack used two oracle queries to exploit a design-level flaw in the unmodified scheme.

Mythos 5 also produced a decryption-reaction attack against KINDI. That method extracts information from how a system reacts when asked to decrypt specially constructed ciphertexts.

According to the paper, the attack exposed an error in KINDI’s published chosen-ciphertext security proof. The authors say both the KINDI issue and the SpoC key-recovery attack were previously unknown to them.

That phrasing deserves care. The attacks appear novel based on the researchers’ literature review, but a preprint cannot establish that no person discovered them privately.

The affected schemes also are not equivalent to AES, ChaCha, or today’s standardized post-quantum winners. SpoC was an unsuccessful competition candidate, while KINDI did not become a deployed NIST standard.

Still, failed or eliminated candidates are valuable research targets. Human cryptographers examined many of them during public competitions, giving the benchmark a harder test than deliberately vulnerable puzzles.

The benchmark also recorded full-strength Tier 2 success rates between 4.4 and 8.9 percent. Mythos 5 led at 8.9 percent, followed by GPT-5.5 at 7.4 percent and Sonnet 5 at 6.7 percent.

Those percentages require context. Some successful attacks targeted implementation defects, underspecified behavior, or flaws that did not compromise the intended mathematical design.

The paper separates design-level cryptanalysis from such results. It also identifies scaling artifacts where parameter-reduction scripts accidentally introduced weaknesses unrelated to the original primitive.

The most defensible conclusion is therefore narrow. Frontier models can find real flaws, occasionally produce apparently new attacks, and convert analysis into working code.

They have not defeated full-strength AES. They have not shown that widely deployed cryptographic standards are generally vulnerable to automated attack.

Why Agentic Cryptanalysis Pressures Security Review

The immediate pressure falls on cryptographic review processes because AI can run more parallel investigations, revisit neglected candidates, and test executable hypotheses continuously.

Traditional cryptanalysis depends on a small group of specialists. They study a design, compare it with known constructions, develop a mathematical hypothesis, and spend substantial time implementing an attack.

The benchmark gives an agent a compressed version of that workflow. It can inspect code, read specifications, choose a security game, test oracle behavior, use mathematical software, and revise its attack script.

This is more than asking a chatbot for an explanation. The model operates inside a harness with tools, runtime, state, and repeated opportunities to correct mistakes.

The study found that models often recognized the right weakness before failing. Many losses came from poor execution, such as choosing an unnecessarily difficult goal or handing an impractical search to a generic solver.

That finding makes future progress easier to imagine. Better planning, longer runtime, improved tool use, and more efficient coordination can raise attack completion rates without requiring a wholly new cryptographic insight.

Mythos 5’s advantage appeared particularly strong when the benchmark allowed more test-time computation. Test-time compute means the processing budget used while a model works on one problem, including tokens, tool calls, and parallel attempts.

This creates a capability-versus-risk tension. Defenders can use the same systems to review candidate schemes, scan reference implementations, and generate attacks before deployment.

Attackers can use them to revisit obscure algorithms, proprietary protocols, or poorly audited products. They do not need to break AES if a system depends on a weaker custom primitive or a flawed implementation.

Anthropic has framed advanced cyber models around controlled defensive deployment. Its cryptographic research describes work on weaknesses in Hawk and reduced-round AES, alongside the broader benchmark effort.

Reduced-round AES removes some of the cipher’s repeated transformation rounds for research purposes. Attacking that weakened variant helps measure progress, but it does not defeat standard AES-128 with all 10 rounds.

This boundary is easy to lose in public discussion. A headline saying “AI attacks AES” can describe a meaningful academic result while implying a practical break that never occurred.

Cryptographers have long studied reduced-round variants to map a design’s safety margin. Progress against seven rounds can improve analytical understanding without making full-round AES decryptable.

The pressure is therefore organizational before it becomes catastrophic. Standards bodies, model developers, and software vendors need procedures for validating AI-generated attacks and disclosing genuine weaknesses.

Review teams will also need to triage a larger volume of plausible findings. A model that proposes hundreds of attacks can consume scarce expert time even when most attempts fail.

Automatic verification helps within the benchmark because each task has a formal game and controlled implementation. Real systems rarely offer such clean conditions.

A production protocol combines cryptographic primitives with serialization, key management, authentication flows, hardware behavior, and operational policy. An attack can succeed through those boundaries without invalidating the core algorithm.

Conversely, an apparently successful laboratory attack may depend on an interface or implementation choice absent from deployed products. Human review remains necessary to determine practical impact.

The benchmark’s open repository gives independent researchers a path to inspect tasks and compare future models. Reproducibility will be critical as vendors make stronger capability claims.

The organizations under the most pressure are not only AI labs. Cryptographic standards projects must decide when agent testing becomes a routine part of evaluation.

Vendors with custom cryptography face an even clearer warning. Models can search the gap between a design’s stated security properties and the actual behavior of its code.

What the Benchmark Does Not Establish

CryptanalysisBench measures a real capability, but memorization, reduced parameters, implementation bugs, and large compute budgets limit broad conclusions.

The first uncertainty concerns training data. Tier 1 attacks are already public, so a model may reproduce text, formulas, or code patterns encountered during training.

The researchers conducted trace-level audits to identify whether models cited papers, recalled known attacks, or developed different routes. However, an apparently fresh derivation can still reflect unrecognized memorization.

AIMer offered a partial control because an efficient 2026 attack appeared after several models’ reported training cutoffs. No tested model reproduced the published elimination method under the benchmark’s conditions.

Some models recovered the secret under more permissive settings, using more initialization vectors than the recent attack required. That suggests useful reasoning, but it also shows the gap between finding an attack and matching expert efficiency.

The second limitation concerns reduced variants. Researchers weakened many Tier 2 algorithms to put attacks within computational reach.

This is standard cryptanalytic practice, but parameter changes can create artificial vulnerabilities. The paper reports cases where a reduction script truncated processing or left dependent buffers at inconsistent sizes.

Those wins describe a broken benchmark variant, not progress against the original design. The authors separated eight or nine such artifacts per model from genuine cryptanalytic results.

The third limitation concerns reference implementations. Four of 24 Tier 1 tasks solved by every model involved code defects rather than flaws in the underlying primitive.

Implementation attacks remain valuable in real security work. However, they answer a different question from whether a cipher’s mathematical construction is sound.

The fourth limitation is resource use. Strong agents can consume long runtimes and vast token budgets while exploring one target.

The result still matters as a capability demonstration, but it does not show that every attacker can cheaply automate expert cryptanalysis. Model access, inference infrastructure, verification, and human supervision remain constraints.

The fifth limitation is benchmark coverage. The challenge set represents several production-grade ciphers, yet it cannot capture every protocol, implementation, side channel, or configuration used in practice.

Its formal games deliberately restrict interaction to a defined threat model. This prevents agents from winning through accidental access to secret files or unrelated container weaknesses.

That isolation improves measurement. It also removes the messy conditions where real attackers often succeed.

Safeguards introduce another complication. The researchers reported that they could not evaluate GPT-5.6 or Claude Fable 5 because those models blocked the cryptanalysis tasks.

A safety refusal does not indicate lower underlying capability. It means benchmark results depend on both model competence and the access policies surrounding that competence.

This creates a comparison problem. A more capable model can appear weaker if it refuses, while a less restricted model can complete more tasks.

It also raises a governance question. Defensive cryptographers need access to advanced analysis, yet unrestricted access can spread offensive capability.

The benchmark does not settle where that line belongs. It provides data for a debate that previously depended heavily on anecdotes.

Another uncertainty is transfer. Performance on historical competition candidates may not predict performance against mature, heavily reviewed standards.

AES has received decades of sustained attention. A model finding a flaw in a less studied candidate does not imply that scaling the same approach will crack AES.

The paper’s challenge tier is designed to track that boundary. Current results leave it far from saturated, which is reassuring and scientifically useful.

The anthropic schneier interpretation should therefore resist both extremes. The work is stronger than a toy cipher demonstration, but weaker than evidence that deployed encryption is facing immediate collapse.

The Defensive Opportunity Arrives Before the Worst-Case Risk

Organizations can benefit now by adding AI-generated attacks to human review, provided they preserve verification, disclosure, and cryptographic agility.

Candidate algorithms are an obvious starting point. Standards teams can let multiple models probe designs before selection, then send reproducible attacks to independent cryptographers.

This can expand coverage across submissions that receive uneven human attention. Early-round candidates often attract less scrutiny after stronger alternatives emerge.

The SpoC and KINDI findings illustrate that value. Even when a scheme never reaches deployment, a newly identified failure can improve future design practice.

Reference implementations are another practical target. Agents can compare a formal security property with code paths that skip authentication, mishandle empty inputs, or omit message components.

This work overlaps with conventional vulnerability discovery, but cryptographic code requires specialized reasoning. A generic scanner may detect memory errors while missing a protocol-level forgery.

AI can also help construct regression tests after a weakness is found. A valid attack script becomes a concrete artifact that developers can preserve alongside patched code.

Organizations should not let a model approve its own findings. Independent reproduction remains necessary, especially when the result affects a standard or widely used library.

A sensible review chain starts with an automatically executable attack. A human cryptographer then identifies whether it targets the design, the implementation, or an artificial benchmark condition.

Maintainers can next reproduce the result in the affected codebase. Only then should teams assess deployed exposure and coordinate disclosure.

This structure limits false alarms without discarding model-generated research. It also keeps the model in the role where the benchmark shows the clearest value: generating and implementing hypotheses.

Cryptographic agility becomes more important as automated analysis improves. The term means designing systems so algorithms and keys can be replaced without rebuilding an entire product.

The NIST standards process already demonstrates why migration planning matters. Selecting an algorithm is only the beginning; deployment across protocols, hardware, and long-lived systems takes years.

AI does not change that operational reality. It can shorten the time between a design’s publication and the discovery of weaknesses, making slow migration more costly.

Teams should inventory where cryptographic primitives appear, which libraries implement them, and whether protocols can negotiate safer replacements. Custom algorithms deserve immediate attention because they lack the review history of established standards.

However, organizations should not replace mature cryptography merely because a model produces a worrying analysis. Premature changes can introduce new implementation defects and interoperability failures.

The defensive opportunity depends on disciplined evidence. An attack that wins a formal game deserves investigation, while unsupported prose deserves skepticism.

The benchmark’s verification model offers a useful template beyond cryptography. AI security evaluations should require reproducible artifacts whenever the task permits them.

This matters because claims about frontier models increasingly shape access rules, purchasing decisions, and public policy. Measurements must distinguish reasoning, memorization, implementation skill, and brute-force resource use.

CryptanalysisBench does not fully solve those measurement problems. It makes them visible in a domain where success has an unusually clear definition.

Three Signals Will Show Whether AI Cryptanalysis Is Accelerating

The next phase depends on harder benchmark wins, independent reproduction of novel attacks, and routine adoption by standards teams.

The first signal is progress against the unsolved challenge set. Researchers should track whether future models produce nontrivial attacks against higher-round AES, ChaCha, or other production ciphers.

A result matters more when it advances the published cryptanalytic frontier without relying on a harness bug. Independent experts should confirm the complexity, data requirements, and practical meaning.

No single reduced-round result means full-strength encryption has failed. A sustained pattern across stronger variants would show that model-assisted research is moving closer to expert cryptanalysis.

The second signal is independent reproduction of the SpoC and KINDI findings. Other cryptographers need to verify the attacks, search the prior literature, and assess whether the affected assumptions appear elsewhere.

Successful reproduction would strengthen the claim that frontier agents can contribute original cryptanalysis. A prior publication or benchmark-specific dependency would narrow that conclusion.

Future benchmark versions should also include fresh, private, or newly published targets that postdate model training. This would make memorization a less plausible explanation.

The third signal is adoption by standards bodies and security laboratories. The benchmark becomes operationally important when agent testing joins code review and human cryptanalysis as a normal predeployment step.

That change should include disclosure rules. Models can generate findings faster than experts can validate them, so a larger queue without triage could slow defensive work.

Watch whether model developers share transcripts, resource budgets, failed attempts, and verification code. Results are easier to trust when outsiders can distinguish a new mathematical attack from a coding defect.

Also watch access policy. Anthropic has limited its most capable cyber model to selected partners, reflecting concern about offensive use.

Restricted access can slow misuse, but it can also concentrate advanced defensive capability among a few laboratories. Wider research participation will require controlled environments and accountable disclosure processes.

Bruce Schneier’s restrained response is the right reference point. These are early results, yet they describe a capability with direct implications for digital infrastructure.

The useful question is not whether an LLM can “break encryption” in the abstract. It is whether each model generation can defeat harder, cleaner, and more current targets under verifiable rules.

Security leaders should follow that progression and prepare their own systems for faster cryptographic review. Inventory the algorithms your organization depends on, remove custom designs, and test whether critical protocols support replacement.

For researchers, the immediate action is equally concrete. Reproduce the new attacks, challenge the benchmark’s assumptions, and submit stronger targets before capability claims outrun evidence.

The anthropic schneier story remains a warning signal, not a declaration of cryptographic collapse. Its value lies in measuring the distance between today’s limited successes and the attacks that would force the entire industry to respond.