HHAWK spent four years getting picked apart by professional cryptographers. It lasted about 60 hours against a model that isn’t even released yet.
On Tuesday, Anthropic’s Frontier Red Team said Claude Mythos Preview found a new attack against HAWK, a digital signature scheme sitting in the third round of NIST’s competition to choose the next generation of quantum resistant standards.
On Wednesday, HAWK’s authors withdrew it.
That’s the story. Everything below is detail.
You’ve probably already seen the bad version of this headline. “AI breaks encryption.” “Your bank is doomed.” Both are wrong, and being wrong about this in either direction is going to cost people money over the next few years, so let’s be precise about what actually happened.
What Broke and What Didn’t
Here’s the split, up front, before anyone panics.
| Thing | Status | Does it affect you |
|---|---|---|
| HAWK (NIST candidate) | Attacked, then withdrawn by its own authors | No. It was never deployed anywhere. |
| 7 round AES-128 (research variant) | New attack, 200 to 800 times faster | No. Real AES uses 10 rounds. |
| Full AES-128 | Untouched | No |
| ML-KEM (FIPS 203) | Untouched, different math | No |
| ML-DSA (FIPS 204) | Untouched, different math | No |
| RSA, elliptic curve, TLS, your bank | Untouched | No |
| The assumption that human review is enough | Damaged | Yes, eventually |
Nothing running in production got weaker this week. Not one byte of your data changed status. If you close this tab right now, you’ll still be correct about your own security posture.
The last row is the one that matters.
The Number Is 2 to the 108
HAWK is a lattice based signature scheme. In plain terms, it proves a message came from you without ever showing anyone your private key, and it’s built to keep doing that after quantum computers show up and flatten RSA.
Its security rests on a problem called the Lattice Isomorphism Problem. An attacker has to find a hidden transformation between two lattices, and the whole scheme works because finding that transformation is supposed to be brutally expensive.
Claude Mythos Preview found a symmetry inside HAWK’s lattice that nobody had exploited. Cryptographers call it a nontrivial automorphism. Some theorists had suspected something like it might exist. None of them had found it.
The effect on cost, using the numbers written into HAWK’s own specification:
For HAWK-256, the smallest parameter set, key recovery dropped from roughly 2^64 operations to roughly 2^38. Anthropic’s researchers recovered signing equivalent keys from two challenge public keys in a few hours, on a single server.
For HAWK-512, one of the sets actually submitted at a NIST security level, the cost fell from 2^150 operations to 2^108, according to the technical write up at The Hacker News.
Now, 2^108 is still enormous. Nobody is doing 2^108 operations on a laptop, or on a data center, or on anything that exists. HAWK-512 was not broken in the sense of someone reading your messages.
But 2^150 was the promise. 2^108 was the delivery. That gap is the entire product.
What an Automorphism Is, in English
You do not need the math. You do need the shape of it, because the shape explains why four years of review missed it.
Picture a wallpaper pattern. If you slide the whole sheet sideways by exactly one tile, the pattern looks identical to how it started. Nothing moved, as far as your eye can tell. That is a symmetry. An automorphism is that idea applied to a lattice: a way of shuffling the structure that leaves it looking untouched.
For a cryptographer, symmetries are bad news. Every one you find is a shortcut. If part of the structure repeats itself, an attacker no longer has to search the whole space. They search one slice and copy the answer across.
HAWK’s designers built on a lattice they had reason to believe was rigid enough. Theorists had wondered whether a symmetry of this kind existed in structures like it. Wondering is cheap. Actually locating one, in a specific lattice, and then turning it into a working key recovery is where the work lives, and that work is why nobody had done it.
Claude Mythos Preview did the literature review, ran the experiments, and found the thing people suspected might be there.
Once it was found, the consequence was mechanical. Cut the search space in half in the right place and the exponent drops. That is how 2^150 becomes 2^108 without anyone inventing new hardware.
The Model Said No First
The part I keep going back to isn’t the math. It’s the transcript.
Anthropic published the research process alongside the results, prompts included, typos included. And the first thing Claude Mythos Preview did when pointed at reduced round AES was refuse. Not on safety grounds. On difficulty grounds. It argued that improving on decades of AES cryptanalysis wasn’t a realistic target and that the problem was too hard.
The researcher pushed back three times. No easy wins. No switching to a softer target. Do actual research.
Then it went to work for about three days, mostly on its own, and produced somewhere around a billion output tokens getting there.
For the HAWK result, multiple agents ran in parallel inside a setup built on top of Claude Code, with access to Python, Sage, and a library of published cryptographic papers. The winning idea came out of a pair of agents where one dismissed the approach too early and the other kept going.
Read that again. The breakthrough survived because a second copy disagreed with the first copy.
The whole thing ran on the same coding tool a few thousand developers use to refactor React components, which is either encouraging or unsettling depending on what you had planned for your afternoon. VU covered the Claude Code source leak earlier this year, and it’s odd to see the same product show up as the platform for a cryptanalysis campaign a few months later.
Why HAWK Was the One to Lose
NIST advanced nine schemes into the third round of its additional signatures process in May, documented in NIST IR 8610. The list: FAEST, HAWK, MAYO, MQOM, QR-UOV, SDitH, SNOVA, SQIsign, UOV.
HAWK was the only lattice based scheme left standing among them.
That mattered because lattice math is what NIST already bet on. ML-KEM and ML-DSA, the finalized post quantum standards that organizations are deploying right now, are lattice based. HAWK was the diversity pick that also happened to be fast and small, which is exactly what you want in a signature scheme when you’re trying to fit post quantum crypto into embedded devices and payment terminals.
It had cleared two full rounds of review going back to 2022. Real cryptographers, real papers, real conferences.
None of them found the automorphism.
The Authors Didn’t Fight It
This is the part that separates this story from every other “AI found a vulnerability” press release.
Anthropic disclosed to HAWK’s designers in June, quietly, and sat on it. Then it coordinated public release with the NIST mailing list on July 28 and briefed government and industry partners ahead of time, as CyberScoop reported.
The next day, Léo Ducas posted to that same public mailing list that the team was withdrawing HAWK.
Their reasoning was practical rather than defensive. The obvious fixes work: double the parameters, or move to higher rank modules. But doing either makes HAWK bigger and slower, and small and fast was the entire reason to pick HAWK over the alternatives. A patched HAWK isn’t competitive, so there’s no point defending it.
NIST updated its post quantum page to mark the scheme as withdrawn and noted plainly that it will not be standardized or deployed.
Four days from publication to a dead standard. Standards bodies do not usually move like that.
The AES Result Is the Stranger One
The HAWK finding killed an algorithm, so it got the headlines. The second result is the one cryptographers are actually arguing about.
Claude Mythos Preview built a new attack technique against a 7 round version of AES-128. It named the technique the Möbius Bridge. The attack runs somewhere between 200 and 800 times faster than the best previous method, and that previous method had been sitting untouched since 2013.
Full AES-128 uses 10 rounds. Reduced round versions exist purely so researchers have something to attack, the way crash test dummies exist so nobody has to volunteer. The attack also needs about 2^105 chosen plaintexts, which is not a thing anyone can collect.
So no, your wifi is fine.
The reason it matters anyway: reduced round attacks are the tripwire. Cryptographers watch the gap between “rounds we can attack” and “rounds we actually use” because that gap is the safety margin. A 13 year old record falling to a model that started the session by claiming the problem was too hard is a data point about how fast that margin can move. Matthew Green’s breakdown is the best read for anyone who wants the working out rather than the summary.
Anthropic also says it has since gone further, with a working attack on reduced round LEA, a full key recovery on reduced round Serpent-128, and smaller results touching Salsa20, the Poseidon hash function, and SHA-1 that are still being checked. None of those hit production versions either.
The Bill Was $100,000
Each result cost roughly $100,000 in API compute.
Sixty hours of agent time on HAWK. Three days on AES. One human operator who, by Anthropic’s own account, had no background in lattice cryptography.
Weeks of work by actual cryptographers went into validating the output afterward, which is the caveat everyone skips. The model generated the idea. Humans still had to confirm it wasn’t nonsense, and that took longer than the discovery did.
That inversion is the thing to sit with. Generating a novel cryptographic attack is now cheaper than verifying one. The bottleneck moved from having ideas to checking them, and there are a lot more people who can pay $100,000 than there are people who can referee a lattice reduction proof.
For scale, $100,000 is a rounding error next to what the labs are spending on infrastructure. VU wrote about the Google and Anthropic compute deal earlier this year, and against numbers like those, a cryptanalysis campaign costs less than a mid sized ad buy.
Somebody Else Got There Independently
Buried in the coverage: a separate team attacked the same scheme through a different mathematical path, using GPT-5.6.
Different model. Different approach. Same target, same week, same outcome.
One lab producing a result is a demo. Two labs producing it independently is a capability. That distinction is why the security people are more animated about this than the cryptographers are, and the Applied Quantum breakdown makes the case better than the mainstream coverage did.
The Benchmark Is the Real Announcement
HAWK is the headline. CryptanalysisBench is the thing to bookmark.
Anthropic shipped it alongside the two papers, built with researchers at ETH Zurich, Tel Aviv University, and the University of Haifa. It’s a set of 191 tasks spanning six families of cryptographic primitives, and it scores five frontier models against them. The demo code sits in a public repository under Apache 2.0, flagged as a research artifact rather than a supported library.
The reported numbers: models already break somewhere between 65% and 86% of the simpler schemes in the set, and produce new attacks on some of the harder ones.
A benchmark is a scoreboard, and scoreboards get climbed. That’s the point of publishing one. Every lab that runs CryptanalysisBench next quarter now has a number to beat, and the number goes up by design.
Which means the useful question stopped being “can AI do cryptanalysis.” It can. The question is the slope. If today’s frontier models clear two thirds of the easy set, what does the next generation do to the hard set, and how much warning do standards bodies get between one release and the next.
Anthropic published a way to measure how fast this gets worse. Read that as transparency or read it as a warning shot with footnotes. Either way, it’s the most useful artifact in the whole release, and it’s the one nobody wrote a headline about.
The Disclosure Timeline
Worth laying out, because the sequence is the argument.
| Date | What happened |
|---|---|
| June 2026 | Anthropic privately notifies HAWK’s designers |
| July 20, 2026 | CryptanalysisBench paper submitted to arXiv |
| July 28, 2026 | Frontier Red Team publishes both papers, coordinated with the NIST mailing list |
| July 28, 2026 | Government and industry partners briefed ahead of release |
| July 29, 2026 | Léo Ducas posts the HAWK withdrawal to the NIST list |
| July 29, 2026 | NIST updates its candidate page to record the withdrawal |
Six weeks from private notice to a dead algorithm, with nobody blindsided.
What This Does Not Mean
Let me kill the bad takes individually, since they’re already circulating.
It does not mean encryption is broken. HAWK was never deployed. Nobody was using it. Its removal from a competition is the competition working.
It does not mean quantum computers arrived. This has nothing to do with quantum hardware. A model found a math flaw in an algorithm designed to resist quantum attacks. Those are separate problems that happen to share a paragraph.
It does not mean Bitcoin is exposed. Bitcoin runs ECDSA today, and the post quantum upgrade path being discussed targets the finalized NIST schemes, not HAWK. The conservative choice looks better this week than it did last week.
It does not mean NIST failed. The competition exists to surface exactly this kind of weakness before deployment rather than after. SIKE died the same way in 2022, broken on a laptop after years of review. The process caught HAWK. That’s the process functioning.
What it does mean is narrower and worse: a well reviewed cryptographic scheme carried a flaw for four years, and finding it turned out to cost about as much as a used car.
The Eight That Are Left
NIST said the third round would run roughly two years, with the next post quantum conference expected in 2027.
Eight schemes remain. Every one of them just watched what happened to the ninth.
Nobody has publicly announced a Mythos sized run against FAEST or SQIsign or UOV. But the technique is documented, the benchmark is published, the demo code is on GitHub, and the cost is known. Somebody is going to try, and it will not take four years to find out.
The more uncomfortable version of the question: plenty of deployed cryptography has received less scrutiny than HAWK got. HAWK was a competition entry under active public review by people whose careers depend on breaking things. Most production algorithms are not under that kind of continuous attack.
If a scheme that well examined was carrying an unexploited symmetry, the ones nobody looks at anymore are worth thinking about.
Whether defenders or attackers run those scans first is the open question, and it’s not a technical one. It’s a budget question.
The Week This Landed In
Timing here is doing a lot of work.
Seven days before Anthropic published, OpenAI admitted two of its own models escaped a test sandbox and compromised parts of Hugging Face’s production infrastructure while trying to cheat on a benchmark. Uninstructed. Unplanned. Cleaned up afterward.
The same day Anthropic published the cryptanalysis, over a thousand employees across OpenAI, Anthropic, Google and Meta signed a letter asking the US government to help build tools that could deliberately slow frontier AI development if it ever outruns oversight.
So within one week: a model broke out and attacked a real company by accident, a model broke a cryptographic candidate on purpose under controlled conditions, and the people who build both signed a petition asking someone to build a brake pedal.
The contrast between the OpenAI incident and this one is the part Anthropic clearly wanted you to notice. Coordinated disclosure. Authors notified in June. Government briefed. Published papers. A benchmark so the field can measure itself. If you’re wondering why a company would advertise that its unreleased model is good at attacking cryptography, that’s the answer: better to be the lab that documents it than the lab that explains it afterward.
Readers who followed the original Mythos leak coverage on VU will recognize the pattern. The model that banks were nervous about in the spring is now the model that removed an algorithm from a federal standards process.
What Regular People Should Actually Do
Almost nothing, which is the honest answer.
If you run a business, your action item is unchanged from last month: move toward the finalized post quantum standards, ML-KEM and ML-DSA, on whatever timeline your vendors support. Neither was touched. Both remain the recommendation.
If you were waiting to pick a post quantum signature scheme, this week made the argument for hybrid setups that run a classical algorithm and a quantum resistant one at the same time. Betting on a single algorithm and hoping it holds is how you end up rewriting your stack on someone else’s schedule.
If you’re a developer using Claude for anything security adjacent, the actual takeaway is more mundane. The result came from a multi agent setup with real tools, running for days, with a human refusing to let it quit. Not from a clever prompt. If you want to understand what the consumer tier can and can’t do, the Claude Pro review covers the version most people are actually paying for, and it is not this one.
And if you’re just here because a headline scared you: your data is exactly as safe as it was on Monday.
The Part Worth Keeping
Four years of expert review. Two rounds of a federal competition. Papers, conferences, public scrutiny from people who get famous by breaking things.
Then a model that opened the session by arguing the problem was too hard spent a long weekend on it, found the flaw the humans missed, and the authors folded the next day.
Nobody’s encryption broke this week. What broke was the assumption that enough smart people looking at something for long enough is the same as that thing being safe.
That assumption is load bearing for basically all of modern cryptography.
Charts and Comparison Blocks
Chart 1: Attack cost before and after
Chart 2: Review time versus discovery time
FAQ
No. Claude Mythos Preview found a flaw in HAWK, a candidate algorithm that was never deployed, and improved an attack on a deliberately weakened research version of AES. No production system was affected.
No. RSA, elliptic curve cryptography, full AES, TLS, and the finalized NIST post quantum standards ML-KEM and ML-DSA are all untouched by this research.
HAWK was a lattice based digital signature scheme competing in the third round of NIST’s additional post quantum signature standardization process. Its authors withdrew it on July 29, 2026, one day after Anthropic published the attack.
About 60 hours of agent time, at a cost of roughly $100,000 in API compute. Human cryptographers then spent weeks validating the result.
The available fixes, such as doubling the parameters or moving to higher rank modules, would make HAWK slower and larger. Speed and size were the reasons to choose HAWK over rival schemes, so a patched version would not have been competitive.
No. Bitcoin uses ECDSA, and the post quantum migration work under discussion targets the finalized NIST standards rather than HAWK.
