Anthropic’s Claude Mythos HAWK Attack Exposes the Security Gap That PQC Won’t Fix

Anthropic’s Claude Mythos HAWK attack cut the candidate signature scheme’s estimated key strength after roughly 60 hours of AI-assisted research. HAWK had already survived two years and two rounds of expert review. That contrast, not an immediate breach of deployed encryption, is the important event.

Anthropic disclosed the result on July 28, 2026, alongside a separate attack on a reduced version of AES. The HAWK team then withdrew its algorithm from the National Institute of Standards and Technology’s post-quantum signature competition. No finalized NIST post-quantum standard was affected.

The episode creates a harder security problem than the headline suggests. Post-quantum cryptography, or PQC, protects systems against future quantum attacks. It does not protect a new algorithm from previously undiscovered mathematical weaknesses, faster automated analysis, or inadequate human review capacity.

That leaves cryptographers, standards bodies, software vendors, and enterprise buyers facing a mismatch. AI can now search some technical attack spaces faster, while validation and remediation still depend on scarce human experts.

The Claude Mythos HAWK Attack Changed a Standards Contest

Claude Mythos did not break a deployed security standard, but it changed which candidate could credibly become one.

HAWK was a digital signature proposal in NIST’s Additional Digital Signatures process. Digital signatures let systems verify who signed a message and whether someone altered it. HAWK was designed to resist attacks from both classical and future quantum computers.

The scheme relied on the presumed difficulty of a lattice problem. A lattice is a mathematical arrangement of points whose structure can support cryptographic constructions. HAWK’s compact signatures and performance characteristics made it an appealing candidate for further evaluation.

Anthropic says one researcher used Claude Mythos Preview in an agentic research harness. The system reviewed literature, reasoned about mathematical structures, ran experiments, and exchanged findings with the researcher.

The process found a nontrivial automorphism, which is a symmetry that preserves a mathematical structure. Earlier work had shown that finding such a symmetry could support an attack. The unresolved question was whether an exploitable version existed inside HAWK’s particular construction.

According to Anthropic’s research disclosure, the model-assisted process found that missing connection. It enabled a faster key-recovery method based on searching a smaller effective space.

For the small HAWK-256 challenge parameters, Anthropic reported that the expected attack cost fell from 2^64 operations to 2^38. That reduction is enormous, even though the challenge parameters were not intended for deployment.

The result also affected larger HAWK parameter sets. Anthropic concluded that maintaining the expected security level would require substantially larger keys. That change would erase important efficiency advantages that supported HAWK’s candidacy.

HAWK’s designers subsequently withdrew the proposal from the NIST process. The withdrawal prevented a weakened candidate from progressing toward standardization or deployment.

That outcome is evidence of review working before adoption. NIST’s public competition deliberately exposes proposals to adversarial analysis. Candidates are expected to fail when researchers discover weaknesses.

However, the speed and source of this finding still matter. HAWK had survived extensive expert attention before an AI-assisted workflow found a decisive avenue in approximately 60 hours.

Anthropic estimated that developing and validating the attack required about $100,000 in model usage. That is expensive for an individual researcher. It is modest compared with the potential value of breaking widely trusted cryptography.

The event therefore changes more than one candidate list. It changes expectations about how much cryptanalytic exploration a well-funded lab can perform within a short period.

Why Post-Quantum Cryptography Cannot Close This Security Gap

PQC addresses the capabilities of the attacker’s computer, while the HAWK episode concerns weaknesses in the defender’s mathematical design.

Post-quantum algorithms are built around problems believed to resist both classical and quantum computation. They replace vulnerable public-key systems such as RSA and elliptic-curve cryptography in selected roles.

That protection has a defined boundary. A quantum-resistant assumption cannot compensate for an overlooked shortcut, structural symmetry, implementation error, stolen key, compromised endpoint, or flawed protocol integration.

Claude Mythos attacked the first category. It did not use a quantum computer or simulate a practical quantum assault. It found a more efficient classical route through HAWK’s mathematical structure.

That distinction explains why the result does not weaken the broader case for PQC migration. Current public-key systems still need replacements before cryptographically relevant quantum computers arrive.

NIST finalized its first three principal PQC standards in 2024. These include ML-KEM for establishing shared secrets and ML-DSA and SLH-DSA for digital signatures. NIST says the HAWK finding does not affect those finalized standards.

Organizations can confirm that boundary on NIST’s PQC standards page. ML-KEM and ML-DSA use different constructions from the specific HAWK mechanism targeted by the attack.

The lesson is not that quantum-resistant cryptography has failed. It is that “quantum-resistant” describes resistance to a particular computing threat, not immunity from every form of cryptanalysis.

The same distinction applies to deployed systems. An organization might complete a PQC migration while leaving private keys exposed through weak access controls. It might secure network traffic while an AI agent leaks data through an authorized tool.

A valid signature algorithm also cannot determine whether the signed instruction is malicious. It verifies authenticity and integrity, not whether a trusted system made a safe decision.

PQC therefore represents one layer of security. It needs key management, secure implementations, authenticated updates, access controls, monitoring, and rapid algorithm replacement around it.

Crypto-agility becomes especially important under these conditions. Crypto-agility means designing systems so teams can replace algorithms and keys without rebuilding the surrounding application.

That capability has always been useful. AI-assisted cryptanalysis makes it operationally urgent because the interval between discovery and widespread knowledge can shrink.

Enterprises also need an accurate cryptographic inventory. Teams must know where an algorithm appears, which vendors control it, what data it protects, and how quickly they can replace it.

A migration that installs one new algorithm everywhere can create another concentration risk. If that algorithm later develops a weakness, every dependent system enters the remediation queue together.

Hybrid designs can reduce that exposure during transition. They combine classical and post-quantum components so one layer remains available if the other encounters an unexpected problem.

Hybrid cryptography is not a permanent guarantee. It adds complexity, larger messages, interoperability demands, and more opportunities for integration errors. Yet it can provide useful diversity while newer algorithms accumulate scrutiny.

The Claude Mythos HAWK attack reinforces that security depends on replaceable components and layered controls. It does not support freezing PQC deployment until every mathematical uncertainty disappears.

Waiting would preserve exposure to known quantum risks. Moving without replacement plans would create a different form of fragility. Security teams must manage both pressures at once.

AI Is Compressing the Cryptanalysis Timeline

The most consequential change is not that AI found one attack, but that it can repeatedly search for weaknesses at machine scale.

Traditional cryptanalysis combines deep specialization, intuition, literature review, experiments, and painstaking verification. Progress can take months or years, with many unproductive paths between useful ideas.

Anthropic’s workflow automated parts of that cycle. Claude Mythos searched papers, proposed connections, wrote experimental code, examined results, and revised its approach with limited human direction.

The HAWK work was not fully autonomous. A researcher provided guidance and helped determine whether the emerging result was meaningful. Human experts and the affected designers were also involved before disclosure.

Still, the division of labor matters. AI can create more candidate arguments and experiments than a person could manually explore during the same period. Humans can then focus on validation and consequences.

Anthropic’s second reported result illustrates that scaling potential. A separate scaffold let Claude Mythos autonomously develop a faster attack against seven-round AES-128.

AES-128 normally uses ten rounds of transformation. Researchers examine reduced-round variants to understand the safety margin around the full algorithm. Breaking seven rounds does not mean attackers can break production AES-128.

Anthropic reported a 200-fold to 800-fold improvement over previous attacks on that reduced version. The company also said the attack would remain impractically expensive and would not threaten full AES.

Those caveats are essential. Without them, a narrow research result becomes a false claim that AI broke the encryption protecting modern systems.

The value lies in the research process. HAWK and reduced-round AES involve different cryptographic structures, yet the same class of AI system contributed to both analyses.

Anthropic and academic researchers have since introduced CryptanalysisBench, a collection of 191 tasks across six cryptographic families. Agents must exploit real implementations and satisfy formal security tests.

The benchmark’s initial results show that frontier models can reproduce many known attacks against deliberately broken schemes. Researchers also reported novel findings involving other experimental cryptographic designs.

A benchmark does not measure every skill required for open-ended cryptanalysis. Its tasks have defined environments, accessible implementations, and measurable success conditions.

Real research begins with greater ambiguity. A model must decide which assumptions matter, identify useful literature, avoid invalid proofs, and distinguish a genuine weakness from experimental noise.

The HAWK case is notable because it crossed some of that gap. The system did more than rediscover an answer hidden inside a training exercise. Anthropic says it developed a previously unknown attack and supplied working demonstration code.

Independent scrutiny remains necessary. Anthropic developed the model, ran the project, and published the headline performance claims. That creates incentives to emphasize success and understate failed sessions.

The company acknowledges that many sessions produced no new discovery. It also reports substantial human verification, which complicates simple claims that the model independently solved the entire problem.

An independent assessment highlighted both the importance of the result and uncertainty around Anthropic’s broader marketing narrative. That is the right balance.

The attack can be technically meaningful without proving that AI has become an autonomous master cryptanalyst. One successful result does not reveal the system’s failure rate across unseen research problems.

Yet attackers do not need reliable genius on every attempt. They can run parallel searches, retain the successful paths, and discard thousands of failures.

That asymmetry puts defenders under pressure. A standards body must examine every credible result carefully. An attacker needs only one path that works.

The Real Bottleneck Is Human Verification

Faster discovery becomes a security benefit only when defenders can verify, prioritize, and fix the findings fast enough.

AI vulnerability research produces a familiar scaling problem. Generating a plausible report is cheaper than confirming its correctness, measuring its impact, coordinating disclosure, and shipping a safe repair.

Cryptography intensifies that problem because small mathematical mistakes can invalidate an entire attack. A persuasive model explanation cannot replace a proof, reproducible code, or expert review.

False positives consume scarce attention. If laboratories generate thousands of speculative weaknesses, maintainers and standards teams must separate genuine findings from confident errors.

True positives create another burden. Each one may require independent analysis, communication with designers, new parameters, updated implementations, interoperability testing, and revised compliance guidance.

The HAWK response happened under favorable conditions. The algorithm remained inside an open standardization process, and no production systems depended on it.

Its designers could withdraw the candidate without forcing organizations to rotate keys or replace certificates. That will not be true when AI finds weaknesses in widely deployed software or protocols.

Production cryptography has long dependency chains. Operating systems, browsers, cloud platforms, hardware modules, embedded devices, identity services, and third-party libraries can share the same primitive.

A mathematically sound replacement may still take years to reach every endpoint. Unsupported devices and hard-coded dependencies can leave vulnerable components in service after vendors publish fixes.

AI can make that remediation gap visible more often. It can also widen the gap if offensive users obtain the same capabilities before defenders build adequate intake capacity.

Anthropic describes the HAWK project as responsible research. The company says it shared the attack with HAWK’s authors in June and coordinated publication through NIST channels.

That process reduced immediate risk because HAWK was not deployed. Future results might involve systems that cannot be patched safely within a short disclosure window.

Access policy then becomes part of the security architecture. Laboratories must decide who can use advanced cyber capabilities, what activities require monitoring, and when a result needs mandatory review.

Restricting one model will not settle the issue. Capabilities diffuse through new models, open research, distilled systems, and specialized agent frameworks.

The more durable defense is expanded verification capacity. Standards bodies need reproducible submissions, automated test environments, independent reviewers, and clear evidence requirements.

Vendors need systems that can accept machine-generated reports without flooding human response teams. Reports should include code, affected configurations, attack assumptions, and repeatable impact measurements.

AI can help on the defensive side of that queue. Separate systems can reproduce experiments, compare patches, inspect dependencies, and group duplicate findings.

However, using the same model to propose and approve a result creates an obvious conflict. Independent verification should involve different tools, separate prompts, and qualified human judgment.

Security teams should also resist treating every mathematical improvement as an emergency. The HAWK attack changed a candidate’s security estimate, but larger parameters remained impractical to attack.

Similarly, the reduced-round AES result does not justify rotating production AES keys. Overreaction would waste resources and weaken trust in future disclosures.

The correct response depends on evidence, deployment status, attack cost, and affected security assumptions. Those factors must remain explicit in every AI-generated report.

What Security Leaders Should Watch Next

Three signals will show whether the Claude Mythos HAWK attack was an isolated success or the start of a durable change in security research.

The first signal is independent reproduction. Researchers outside Anthropic must validate the HAWK technique, its complexity estimates, and its impact across parameter choices.

Working demonstration code raises confidence because researchers can observe a recovered challenge key. It does not automatically validate every extrapolation to larger instances.

Independent cryptographers should also test whether related constructions contain comparable symmetries. A broader pattern would increase pressure on other lattice-based designs, while a HAWK-specific result would narrow the impact.

NIST’s handling of the withdrawal provides the second signal. Its additional signature process exists partly to select algorithms with different performance and security properties.

The relevant question is whether AI-assisted review becomes a standard part of candidate evaluation. NIST already exposes proposals to public scrutiny through its signature project.

Formal AI evaluation requirements would strengthen the argument that standards processes are adapting. Informal experimentation alone would leave coverage dependent on individual labs and uneven access to expensive models.

The third signal is performance on unseen cryptanalytic problems. Public benchmarks become less useful when models or developers can optimize directly against their known tasks.

Researchers need controlled tests that preserve hidden problems, document unsuccessful attempts, and separate model output from human contributions. Cost and elapsed time should be reported alongside success.

Repeated novel results across unrelated algorithms would support Anthropic’s broader claim. Failure to reproduce those gains would suggest that HAWK matched a favorable problem structure.

Security leaders should not wait for that debate to settle before acting. They can map cryptographic dependencies, require replacement paths in procurement, and test how quickly critical services can rotate algorithms.

They should also separate quantum readiness from general AI security. PQC protects data and authentication against a specific future computing capability. It does not govern what an authorized AI agent does with decrypted information.

A secure organization needs both programs. One reduces exposure to quantum decryption. The other manages model access, tool permissions, data flow, monitoring, and human authorization.

The near-term decision is therefore not whether to choose PQC or AI defenses. It is whether existing security operations can absorb faster discovery while completing a difficult cryptographic migration.

Ask one practical question during the next architecture review: if an AI system invalidated a trusted algorithm tomorrow, could your team locate every dependency and replace it safely?

The Claude Mythos HAWK attack suggests that discovery cycles are getting shorter. Organizations now need replacement, verification, and governance cycles that can keep pace.