Claude Mythos Finds Real Math Flaws in HAWK and Weakened AES

Anthropic has published a case study on using a specialised model — Claude Mythos Preview — to do original cryptanalysis, and Simon Willison's writeup of it is worth a read for the prompting details alone. The headline claim is not that an LLM broke a real-world cipher; it's that a model, given enough time and the right human steering, found two genuinely new mathematical results in cryptanalysis — one against a NIST post-quantum signature candidate, one against a deliberately weakened variant of AES.

What was actually found

The first result targets HAWK, a lattice-based digital signature scheme currently under consideration in NIST's post-quantum standardisation process — it is not yet a deployed standard. Mythos discovered an improved attack that halves HAWK's effective keysize, dropping the expected attack cost for HAWK-256 from 2^64 to 2^38. That is a substantial theoretical speed-up, on the order of what a real cryptanalytic advance looks like, even though 2^38 is still far below anything practically exploitable and HAWK itself isn't in production anywhere.

The second result is against a reduced-round variant of AES-128 — 7 of the algorithm's normal 10 rounds — using a fingerprinting technique the researchers call the "Möbius Bridge," which eliminates one required guess in the attack and improves speed by roughly 200-800x. Anthropic is explicit that this doesn't touch full-round AES-128 as deployed everywhere from TLS to disk encryption; reduced-round variants are a standard academic sandbox for testing new cryptanalytic techniques, precisely because attacking the full cipher is currently infeasible by any method. As the researchers put it, breaking the full weakened variant in practice "would cost hundreds of millions of dollars to implement" — i.e., still not a threat to real systems.

How the research actually happened

The interesting part for practitioners is the process, not just the result. The HAWK finding took about 60 hours of model runtime and roughly $100,000 in API costs. For the AES work, one researcher built the scaffolding and let Mythos run autonomously, producing several hundred million tokens over three days before the attack was refined further to around a billion output tokens total. Anthropic and Willison both note that human researchers spent a lot of their time simply preventing the model from giving up — the model's default instinct, faced with a problem framed as "find something better than the current best-known attack," was to conclude it was impossible and stop trying.

The shared prompts illustrate that steering problem directly, spelling mistakes and all: researchers had to explicitly push back on the model's pattern-matched pessimism ("the models tend to think it is impossible to solve so they don't try — they need a good amount of prompting"), redirect it away from re-deriving known results ("why not do aes-128 r7? the whole point is to find something better than existing approaches"), and keep raising the bar on what counted as a real finding ("the goal is that we have highly [novel/rigorous] ... genuinly hard findings"). None of this reads like a model spontaneously breaking cryptography — it reads like a long, expensive, human-supervised research collaboration where the model did the heavy combinatorial search and humans did the judgment calls.

Why this matters for security teams

This isn't a vulnerability disclosure and nothing here is exploitable today. But it's a concrete data point on a trend worth tracking: frontier models doing genuinely novel mathematical work in security-adjacent domains, given enough compute, scaffolding, and human oversight to keep them from quitting or drifting. For teams evaluating AI-assisted security research or red-teaming, the operational lesson is more useful than the crypto result itself — meaningful output required sustained human steering against specific failure modes (giving up, re-deriving known work, settling for shallow findings), not a single clever prompt. Anthropic has released demonstration code for both the HAWK and AES work in a public repository.

FAQ