Anthropic Simon Willison Quote Reveals AI Cryptanalysis’s Real Test

Anthropic Simon Willison coverage now carries a sharper warning: Claude found two cryptographic advances, yet neither attack compromises systems operating today. The conflict lies elsewhere. AI cryptanalysis is improving while governments and engineers are choosing the mathematical foundations that must protect digital systems for decades.

On July 28, 2026, Anthropic said Claude Mythos Preview had improved attacks against HAWK and a reduced-round version of AES-128. HAWK is a proposed post-quantum signature scheme. AES is the established symmetric cipher behind countless secure applications, although Anthropic tested only a deliberately weakened variant.

Simon Willison highlighted the work before quoting Johns Hopkins cryptographer Matthew Green on July 29. Green argued that AI cryptanalysis is arriving at an unusually useful moment. The industry is migrating away from RSA and elliptic-curve signatures toward newer problems intended to resist quantum computers.

That timing creates the central tension. Claude’s results can strengthen public review before standards reach production. However, faster automated cryptanalysis can also overwhelm the human institutions responsible for validating discoveries, coordinating disclosure, and replacing damaged designs.

Anthropic Simon Research Changed the Cryptanalysis Baseline

The important change is not that Claude broke deployed encryption, because it did not. Claude produced research-level improvements against two carefully bounded targets.

Anthropic’s first result concerned HAWK, a lattice-based digital signature scheme under consideration in NIST’s additional post-quantum signature process. A digital signature lets software verify identity and detect unauthorized changes without exposing a private signing key.

HAWK had already passed two rounds of public evaluation across roughly two years. According to Anthropic’s cryptography research, Mythos improved the best-known attack after about 60 hours of work.

The model identified a nontrivial automorphism, meaning a mathematical symmetry within HAWK’s underlying lattice structure. Prior research had established that finding such a symmetry would enable an attack. It had not shown that the relevant symmetry was accessible in HAWK.

Anthropic says the resulting enumeration attack reduced the effective security of the smallest HAWK-256 challenge parameter. The expected key-recovery cost fell from approximately 2^64 operations to 2^38 operations.

That difference is substantial. A factor of 2^26 separates those estimates, which represents about 67 million times less work under the stated model. Still, HAWK-256 is a small challenge parameter, not a production configuration.

The attack remains exponential, so its cost rises quickly with larger keys. Anthropic says the larger HAWK parameters remain impractical to attack. The weakness is also specific to HAWK rather than lattice cryptography as a whole.

The second result targeted seven-round AES-128. Production AES-128 applies ten rounds of repeated transformations, while researchers intentionally remove rounds to study how its security margin behaves.

Mythos developed a fingerprinting method called the Möbius Bridge. Anthropic says it removed a 256-way guessing step from an existing meet-in-the-middle attack, which trades additional storage for less computation.

Other optimizations produced an estimated 200-fold to 800-fold speed increase over previous attacks. Yet the experiment still assumed access to 2^105 chosen plaintexts, an impossible volume for any practical operation.

The model therefore did not crack AES as deployed. It advanced a specialized research line involving a weaker laboratory version. That distinction separates a meaningful scientific result from an immediate cybersecurity emergency.

Both research tracks were expensive. Anthropic estimated roughly $100,000 in API usage for each main result. The AES investigation generated about one billion output tokens before reaching its published method.

The Anthropic Simon discussion matters because Willison focused on how little expert prompting appeared necessary. Human operators repeatedly told the model to pursue harder results rather than accept its initial conclusion that the task was infeasible.

Those interventions were important, but they did not contain the final mathematical insight. The model proposed candidate transforms, rejected failed approaches, tested alternatives, and developed the core fingerprint through an agentic research process.

This moves the debate beyond whether an AI can restate known cryptographic literature. The harder question is whether sustained model inference, computational tools, and basic research direction can produce useful new attacks.

Why Matthew Green Calls the Timing Nearly Ideal

AI cryptanalysis is emerging while the security community is replacing its most important public-key foundations, giving defensive review unusually high value.

Green’s argument begins with the post-quantum transition. Current public-key systems commonly depend on RSA or elliptic-curve cryptography, whose security rests on mathematical problems that sufficiently capable quantum computers could solve efficiently.

That threat does not mean a cryptographically relevant quantum computer exists today. It means long-lived systems need replacement algorithms before such a machine becomes available.

Migration takes years because cryptography appears deep inside operating systems, browsers, identity services, embedded devices, certificates, payment infrastructure, and enterprise software. Stored encrypted information can also face “harvest now, decrypt later” attacks.

NIST began formal post-quantum standardization in 2016. It finalized its first three principal post-quantum standards in August 2024, covering general encryption and digital signatures.

The agency has continued evaluating additional signature approaches. Diversity matters because organizations have different performance constraints, while relying on one mathematical family can concentrate systemic risk.

HAWK entered that broader search as a compact signature design based on lattice isomorphism. It had characteristics that could make it attractive where signature size, key size, or implementation tradeoffs matter.

Claude’s result challenges that balance. Anthropic argues that restoring the intended security margin would require larger HAWK keys, removing several qualities that made the proposal appealing.

This outcome is not evidence that public standardization failed. Open competitions deliberately expose candidate algorithms to adversarial analysis before software vendors and governments depend on them.

The historical record shows why. SIKE, another post-quantum candidate, survived years of study before researchers found a devastating classical attack in 2022. The break reportedly ran on an ordinary laptop.

Green sees AI as a way to expand that adversarial capacity during the period when it offers the greatest defensive return. Simon Willison’s Matthew Green quote describes this moment as a “perfect time” for public AI cryptanalysis.

The benefit goes beyond removing weak candidates. Repeated, credible attacks can help researchers identify which assumptions deserve confidence and which design patterns create hidden exposure.

Cryptography does not gain trust because nobody has found an attack yet. Trust grows through years of public attempts, published failures, improved attacks, corrected proofs, and independent reproduction.

AI can increase the number of hypotheses explored during that process. It can search obscure papers, translate mathematical conditions into experiments, write verification code, and keep multiple research branches active.

That capacity matters because expert attention is scarce. Many algorithms receive far less analysis than AES, whose design has faced sustained examination since NIST selected it in 2001.

The best defensive case resembles continuous automated testing for mathematics. Models propose attacks, computational tools reject weak ideas, experts validate the survivors, and designers revise their schemes.

Developers following this work should not interpret every reduced-round result as a reason to abandon approved primitives. They should instead distinguish production impact from evidence about future research capacity.

Knowledge management becomes relevant here because verification requires preserving prompts, source papers, failed hypotheses, code, reviewer comments, and disclosure decisions. A searchable engineering knowledge base can keep that evidence connected during long reviews.

The post-quantum transition gives AI cryptanalysis a clear defensive target. Candidate systems are public, deployment remains limited, and institutions already have processes for receiving critical analysis.

That favorable alignment will not last forever. Once a vulnerable primitive becomes widely deployed, identifying its weakness creates urgent replacement costs and a potentially dangerous disclosure problem.

The Real Contest Is AI Discovery Versus Human Verification

The primary opponent is not Claude versus human cryptographers. It is automated discovery speed versus the limited human capacity needed to establish truth.

Anthropic describes Mythos as mostly autonomous during both investigations. However, discovery and acceptance remained separate stages, and the second stage moved much more slowly.

The HAWK attack was comparatively straightforward to validate because researchers could implement the key-recovery pipeline end to end. A verifier could generate a key, execute the attack, and confirm whether it recovered the secret.

The AES result posed a different challenge. Its requirements remain far beyond practical execution, so reviewers could not simply run the entire attack at the claimed scale.

They instead had to inspect the mathematics, test smaller instances, analyze complexity, and confirm that every reduction behaved as described. Anthropic says two researchers spent several hundred hours on that work.

The model developed the AES idea in roughly one week. Human researchers then needed nearly a month to reach confidence, despite focusing intensely on the claim.

Anthropic also acknowledged that its researchers were not cryptography specialists. They had to learn enough of the field to validate the method and prepare a paper.

That disclosure supports two readings. It shows that a model can help non-specialists reach advanced results. It also shows why independent expert review remains necessary before the field accepts those results.

A model can generate persuasive mathematical prose alongside subtle errors. A long derivation may depend on one unjustified assumption, a missed prior paper, or a complexity estimate that fails under realistic memory costs.

Novelty poses another problem. Rediscovering an obscure result can look new when literature search is incomplete. This risk increases across cryptography, where relevant work may span decades, languages, workshops, preprints, and specialized notation.

The independent CryptanalysisBench study gives broader context. Its authors assembled 191 tasks across six cryptographic families and three difficulty tiers.

Five frontier models reportedly broke between 65% and 86% of schemes with known practical attacks. They also solved between six and twelve full-strength tasks from a harder second tier.

Those numbers do not establish unrestricted expert ability. Benchmarks simplify the environment, selected problems may differ from open research, and performance depends on scaffolding, inference budgets, and evaluation rules.

However, the results support Anthropic’s narrower claim that modern models can perform genuine cryptanalytic work. The relevant question is no longer whether the capability exists at all.

The bottleneck now shifts toward reviewing a rising volume of plausible outputs. Anthropic predicts academic cryptography may face the same triage pressure already emerging in software vulnerability research.

This is not merely an administrative concern. A false claim can waste weeks of expert time, damage confidence in a sound standard, or create public panic around systems that remain secure.

A valid claim can be even harder to manage. Reviewers must reproduce it, locate affected systems, contact designers, coordinate with standards bodies, and decide when technical details should become public.

Large inference budgets deepen the imbalance. The AES work consumed one billion output tokens, while humans cannot read or audit that volume directly.

Researchers need structured evidence rather than raw model transcripts. Useful systems must record which claims survived testing, which code supports them, and where human judgment changed the investigation.

AI laboratories also need incentives that reward careful negative findings. Publishing dramatic “AI broke encryption” headlines can attract attention even when the target is undeployed or deliberately weakened.

Simon Willison avoided that trap by emphasizing Anthropic’s explicit limitation: neither result affects current production systems. His framing kept the focus on the research method and its future consequences.

The contest will therefore be decided by verification infrastructure. Faster models alone cannot make cryptography safer if review queues grow faster than trusted experts can clear them.

What the Anthropic Simon Narrative Must Not Overclaim

Claude’s attacks deserve attention, but they do not show that internet encryption is collapsing or that AI has defeated modern cryptography.

The HAWK result affects one proposed signature scheme. It does not weaken the standardized post-quantum algorithms already selected by NIST, other signature candidates, or every construction based on lattices.

HAWK also has no established production footprint. Removing or revising it during evaluation would represent the standards process working before widespread deployment.

The AES result is even easier to misstate. Full AES-128 uses ten rounds, while Mythos attacked seven. Removing three rounds changes the object under analysis.

Researchers study reduced-round ciphers because improvements can expose structural insights. Yet an attack against seven rounds does not automatically extend to eight, nine, or ten.

Its data requirement also matters. The previous attack assumed 2^105 chosen plaintexts, and Anthropic’s improvement did not make that requirement operationally plausible.

For scale, 2^105 is roughly 40 undecillion inputs. No attacker can collect, transmit, store, or process that many chosen encryptions against a real service.

Anthropic’s own footnote says implementing the reduced-round attack would still cost hundreds of millions of dollars. Even that estimate concerns a weakened cipher rather than deployed AES-128.

The company deserves credit for stating those boundaries prominently. Secondary coverage and social posts can still erase them, turning “improved academic attack” into “AI cracked AES.”

There are also unanswered questions about attribution. Anthropic released materials showing model activity, but any complicated agentic workflow mixes model output with scaffold design, tool access, target selection, and human feedback.

The human prompts were brief, sometimes consisting mainly of encouragement. Yet humans selected the research target, built the environment, reviewed outputs, and decided which branches merited continued computation.

Calling the work fully autonomous would therefore overstate the evidence. A more accurate description is sustained agentic research with limited substantive guidance and extensive human validation.

Cost limits generalization too. Roughly $100,000 per result is manageable for a frontier laboratory or government program. It is not routine spending for most university groups or standards teams.

Future models may reduce that cost. For now, the result demonstrates what a large, concentrated inference budget can achieve, not what every developer can reproduce through a short chat session.

The benchmark evidence deserves similar restraint. Success on known breaks confirms search and reasoning ability, but it does not prove that models will reliably identify unknown flaws in production cryptography.

Research selection can create visibility bias. Successful investigations become papers, while failed runs, duplicated results, and unverifiable claims receive less public attention.

Anthropic noted that many sessions produced no discoveries. That detail should remain central when evaluating the efficiency and reliability of the approach.

Independent confirmation will provide the strongest test. The HAWK authors, NIST participants, and outside cryptographers need to examine the attack’s security estimates and implications.

CyberScoop’s technical account reported that Anthropic coordinated with academics and disclosed the HAWK finding before publication. That process improves confidence, but publication still begins rather than ends public review.

The largest uncertainty concerns what happens when the target changes. Proposed schemes and reduced-round ciphers are safer research subjects than deployed algorithms protecting current communications.

An AI-generated flaw in a common protocol would create conflicting duties. Researchers would need enough openness for independent verification, but premature publication could hand attackers an operational method.

Model providers could also possess material capabilities before external institutions have comparable access. That asymmetry would raise questions about oversight, disclosure timelines, and who decides which research is released.

Those governance problems do not invalidate the defensive case. They show why research capacity and institutional capacity must grow together.

Three Signals Will Show Whether AI Makes Cryptography Safer

The next phase depends on reproducibility, standards adoption, and whether verification systems scale alongside model-generated discoveries.

The first signal is independent reproduction of the HAWK attack. Outside researchers should confirm the nontrivial automorphism, the 2^38 estimate for HAWK-256, and the effect on larger parameters.

Reproduction would strengthen the claim that an agentic model found a meaningful weakness missed during extended public review. Significant corrections would weaken claims about Claude’s research reliability.

The second signal is NIST’s treatment of HAWK and similar candidates. Reviewers might reject HAWK, revise its parameters, request further analysis, or decide that other advantages justify continued consideration.

The exact outcome matters less than the process. Standards bodies need a repeatable way to accept AI-assisted submissions without lowering evidentiary requirements.

AI-generated cryptanalysis should face the same mathematical scrutiny as human work. It may also require additional records covering inference settings, scaffolds, tool access, failed paths, and human interventions.

The third signal is Anthropic’s promised expansion of public evaluation. The company said it planned an academic workshop and further releases covering attacks against other reduced-round ciphers.

Anthropic reported a preliminary attack on 13-round LEA that runs in under an hour on a modern desktop. Full LEA uses 24 rounds, so that result also carries no immediate production impact.

It also described an attack against six rounds of Serpent-128, whose complete design uses 32 rounds. Additional limited improvements reportedly involved Salsa20, Poseidon, and SHA-1.

These follow-up claims need papers, code, outside review, and precise threat models. A steady stream of independently confirmed results would support Green’s optimistic reading.

A flood of unclear or duplicated claims would point toward the verification bottleneck instead. The field would then need better filtering before expanding raw discovery volume.

Longer term, researchers should watch whether models progress from attacking reduced variants toward evaluating complete candidate designs. Full-round production primitives set a far higher bar.

They should also measure how often AI finds flaws before human reviewers do. Individual success stories are informative, but systematic comparisons would reveal whether models add coverage or mostly duplicate expert work.

The HAWK specification and associated public materials offer the right environment for that test. Open specifications let independent teams challenge both the design and Anthropic’s analysis.

Organizations do not need to change deployed AES because of this research. They should continue following approved cryptographic guidance, inventory legacy public-key dependencies, and prepare post-quantum migration plans.

Security leaders should also establish procedures for receiving AI-assisted findings. Those procedures need technical triage, reproducibility requirements, disclosure channels, and clear ownership for remediation decisions.

Researchers should preserve negative results. Failed approaches can prevent duplicated work, reveal model limitations, and show whether a claimed success emerged from systematic search or exceptional luck.

The Anthropic Simon exchange ultimately captures a rare alignment between capability and need. AI is getting better at adversarial mathematics precisely when the world needs wider scrutiny of unfamiliar security assumptions.

Green’s optimism remains conditional. AI cryptanalysis strengthens security only when humans can validate its output, revise weak designs, and coordinate disclosures before attackers gain an advantage.

Will standards organizations build that capacity while the targets are still undeployed? Developers, researchers, and security teams should follow the three signals closely: independent reproduction, NIST’s response, and the quality of Anthropic’s next disclosures.

Those signals will reveal whether Claude’s work begins a safer era of continuous cryptographic review or simply creates a faster queue of claims waiting for human judgment.