It Took $100,000 and Some Badly Spelled Prompts to Weaken a Post-Quantum Cipher

Anthropic published research today showing Claude Mythos Preview found genuine Claude cryptographic weaknesses in two algorithms. The first cuts the effective key size of HAWK, a post-quantum signature scheme currently in NIST’s third round, roughly in half. The second improves the best known attack on a 7-round version of AES by 200 to 800 times. Production systems are unaffected: HAWK has never been deployed, and full AES-128 runs 10 rounds, not 7. What makes this a story is the process. One finding took 60 hours and about $100,000 in API cost, the other ran almost entirely on its own, and verifying the results took human researchers roughly a month.

Matters most to: cryptographers, security teams tracking post-quantum migration, anyone tracking how fast autonomous research is moving.

Changes nothing for: your bank, your browser, your VPN, or anything else you used today.

Claude Cryptographic Weaknesses: What Actually Broke

That last row is the whole correction. Every attack here lands on either a candidate that was never shipped or a deliberately weakened research variant. Cryptographers build those weakened versions on purpose, so they can study how attacks behave long before anyone has to worry about the deployed version.

So no, AI did not break encryption this morning.

What the Claude cryptographic weaknesses research does show is that a model can now do original cryptanalysis at the level of a strong human specialist. That was not true a year ago. It was barely true six months ago. And the gap between finding a flaw in a research variant and finding one in a deployed cipher is a matter of scrutiny budget rather than capability.

The HAWK Result

HAWK is one of the remaining third-round candidates in NIST’s call for additional post-quantum digital signatures. That process has run for years, and it keeps getting more urgent as the timeline to a useful quantum computer shortens. HAWK’s security rests on a mathematical problem called the Lattice Isomorphism Problem.

Mythos found a previously unexploited symmetry in the lattice HAWK uses, technically a nontrivial automorphism. Anthropic published demonstration code showing the attack running end to end. Earlier academic work had proved that finding one would enable an attack. Nobody had answered whether one existed in HAWK’s particular lattice. Mythos answered it.

The practical effect: the expected cost of recovering a HAWK-256 key was believed to be around 2^64 operations. Mythos demonstrated 2^38. That’s roughly 67 million times less work. The attack is still exponential, so larger HAWK keys stay out of reach, but the fix is doubling key sizes. And doubling key sizes removes most of what made HAWK attractive as a candidate in the first place.

Anthropic shared the attack with HAWK’s authors in June and coordinated disclosure to the public NIST mailing list for today. That’s the process working. NIST publishes candidates specifically so people can try to break them before deployment, and late breaks happen. In the previous round, a candidate called SIKE was famously cracked in about an hour on a laptop.

The AES Result and the Möbius Bridge

The second finding is stranger, because of how little help it needed.

AES-128 applies its round function 10 times. Mythos attacked a version running 7. Researchers study these reduced variants constantly, partly to develop techniques that might generalize and partly to estimate how much margin the full cipher really has. The prior work Mythos built on assumes an attacker can request encryption of 2^105 chosen plaintexts, which is a completely impractical number and exists only to quantify attack cost.

Mythos improved on the strongest known meet-in-the-middle attack by inventing a fingerprinting method it named the Möbius Bridge. The short version: one stage of the earlier attack required the attacker to enumerate a large space of values and look each one up in a precomputed table. Mythos built a fingerprint that stays invariant across that guess, which removes the enumeration entirely. Computing the new transform costs more, so it then found further optimizations to pay that back. Net result is an attack between 200 and 800 times faster depending on how you measure runtime.

Naming its own technique after a Möbius transform is a detail I keep thinking about.

The Part Everyone Should Read

Here is how that AES result actually got made.

At first Claude refused to engage. It reported back that there was nothing to find, and that AES is the most studied block cipher in existence. Which is true, and also exactly the kind of reasonable conclusion that ends a research program before it starts.

So the researcher pushed. He explained that models assume the problem is impossible and therefore need pushing. In response to that single message, Claude rewrote its own agent setup to search for genuinely novel ideas instead of easy ones. That change worked, and it produced early progress on 6 rounds.

Then the researcher asked why not go after 7 rounds, since the entire point was beating existing approaches.

Over the following three days Claude ran autonomously and burned several hundred million tokens. It received exactly three more substantive prompts. One told it to aim at top-researcher output rather than quick wins. One stopped it from wandering off to a different cipher. The last was <cite index=”96-1″>encouragement: “we want proper research to find genuinly hard findings.”</cite>

Typo included. Anthropic published the prompts unedited, which was the right call.

Three days after that came the Möbius Bridge. By the time Claude finished refining the attack it had produced a billion output tokens. Anthropic also released a cleaned-up version of the model’s chain of thought during the key insight. It’s the closest thing anyone has published to a research notebook from an autonomous run.

How the HAWK Side Ran

A similar pattern ran on the HAWK side. That human operator had a theoretical computer science background, but he was not a lattice cryptography expert. His input stayed mostly at the project management level: how to track ideas, which libraries to use for verification.

Then the multi-agent setup did something worth noticing. Two worker agents chased the same idea. The first dismissed it as infeasible too early. The second found the way through, and they argued it out over messages until both agreed.

What Didn’t Break

Worth being blunt, because the crypto press is already running panic headlines.

AES is fine. The attack hits 7 of 10 rounds and even then assumes an attacker with resources that don’t exist. Anthropic’s own note puts the cost of implementing it at hundreds of millions of dollars, against a version of the cipher nobody uses.

HTTPS is fine. Your banking session is fine. Signal is fine. Bitcoin is fine, and the number of headlines suggesting otherwise this morning tells you more about crypto media incentives than about cryptography.

HAWK was never deployed. Anthropic states the attack doesn’t extend to the other NIST post-quantum candidates or to lattice-based cryptography generally.

The follow-up findings are the same shape. A 13-round version of LEA, a cipher standardized under ISO for low-power devices, now falls in under an hour on a desktop. The full cipher runs 24 rounds. Serpent-128 got a practical key recovery on 6 of its 32 rounds. There are smaller gains against Salsa20, Poseidon, and SHA-1, all under 10x.

None of it touches production. All of it moves the line.

The Bottleneck Is Now Us

This is the finding buried under the cryptography.

Mythos took about a week to discover the AES attack autonomously. It then took two Anthropic researchers close to a month to convince themselves the method was correct, plus several hundred hours learning enough cryptography to write the paper. Anthropic says the majority of their time over recent months went to verification rather than discovery.

Think about what that ratio implies at scale. The company has already described a situation in its vulnerability work where models find bugs faster than human triage and remediation can absorb them. Now the same pattern is showing up in mathematics. The model generates candidate results quickly and cheaply. Humans become the slow, expensive step that decides whether any of it is real.

Anthropic is hosting an academic workshop in the coming weeks specifically to talk about this. Notably, the disclosure also went through government and industry partners before publication, which is the same posture that put the company in front of federal scrutiny during the Pentagon supply chain fight earlier this year. They also raise the question nobody has a policy for yet. What happens when a model finds a break in a cipher that is deployed right now, protecting live systems?

To make the capability trackable over time, they built CryptanalysisBench with academics at ETH Zurich, Tel Aviv University, and the University of Haifa. It packages a range of ciphers into a single evaluation, so anyone can score how well a given model does cryptanalysis. That sounds procedural until you remember nobody could have run this test two years ago. There was nothing to measure.

The disclosure path matters too. Anthropic consulted academics on validity, shared advance copies with government and industry partners, and coordinated the HAWK release with the scheme’s authors and the public NIST mailing list. That’s slower than shipping a blog post, and it’s the difference between research and a leak.

Why $100,000 Is the Real Headline

Each of the two main results cost roughly $100,000 in API spend.

That is a rounding error for a university department, let alone a government. It is less than one cryptographer’s annual salary. And it bought a result that survived two rounds of expert human review over two years without anyone spotting it.

The scaffold was built on top of Claude Code, the same tool people use to refactor their side projects. Mythos itself is restricted and nowhere near what a $20 Claude subscription gets you, but the tooling around it is off the shelf. Anthropic even tested whether the AES scaffold could rediscover the HAWK break on its own. It could.

That’s the part with consequences. A frontier model doing cryptography is interesting. A setup cheap enough and general enough to point somewhere else tomorrow is the thing that changes planning assumptions. If you’ve read the Claude Mythos coverage from earlier this year, this is the same capability profile showing up in pure math instead of memory corruption.

These Claude cryptographic weaknesses also land in the same week Washington is arguing about who should be allowed to run Chinese open weight models. That fight ran through yesterday’s piece on the Kimi K3 release. Meanwhile one lab spent $200,000 and found math nobody else had found. The policy conversation is still mostly about download permissions.

Where This Goes

A year ago models could not do cryptanalysis on beginner ciphers. Today one found a flaw that two years of expert review missed. It did that while its operator typed at it with the spellcheck apparently disabled.

Anthropic’s own framing is that neither result should surprise anyone. NIST’s process exists precisely to catch weak candidates before deployment, and reduced-round AES attacks are a long research tradition with a paper trail going back decades. Both points are fair, and both are the kind of thing a lab says when it wants the finding read calmly.

But the interesting ciphers are not the famous ones. They’re the thousands of algorithms embedded in industrial controllers, payment terminals, car keys, and medical devices that never got a fraction of the scrutiny AES did. Anthropic says it has already started auditing others.

Somebody is going to run this playbook on one of those and find something that does matter. The only open question is whether they publish it or sell it.

FAQ