Claude AI Just Cracked the Post-Quantum Testing Scheme and Discovered a Fast 7-Round AES Attack

Anthropic says A preview of the Claude Mythos helped achieve an end-to-end key return attack against the HAWK-256 and a 200- to 800-fold speedup in a seven-round attack on the AES-128.

The HAWK attack uses a symmetry that was never used in the lattice behind the signature scheme. Anthropic’s released implementation gives an expected runtime of three hours and 42 minutes on a 96-core server. The AES result removes the guesswork step of 256 methods from existing man-in-the-middle attacks.

Anthropic said there was no impact on production plans. HAWK remains a candidate for the National Institute of Standards and Technology (NIST) post-standardization process, and the public return code only targets a small parameter of HAWK-256.

The result of the Advanced Encryption Standard (AES) works in seven rounds of ten AES-128 and still requires an impossible number of selected plaintexts. The company said no production software had to be changed as a result.

Anthropic published the findings alongside two technical papers and reproduction artifacts. The company said Mythos Preview did most of the research itself, with people providing project direction, computer resources, and extensive validation.

A hidden symmetry in HAWK’s lattice

HAWK is the only lattice-based scheme among nine candidates that NIST has advanced to the third round of its additional post-value digital signature process in May 2026. Its NIST security-level parameter sets are HAWK-512 and HAWK-1024; HAWK-256 is a challenge parameter given as a cryptanalytic target.

The exact derivation of the HAWK key is an example of the Lattice Isomorphism Problem (smLIP) search module. The attacker must recover the hidden transformation between the two lattices.

A paper by Daniël van Gent and Ludo Pulles showed that a rare automorphism, a lattice-preserving symmetry, can reduce the recovery of the HAWK key from finding the shortest vector in the lattice to about half the original size.

That mission paved the way for the attack, but the authors say it did not affect HAWK. Anthropic says that the Mythos Preview has found the additional automorphism needed to implement the method.

The leading HAWK-n attack builds what the researchers call a τ-cocycle lattice from the public key. It then uses lattice reduction and filtering to return short vectors before reconstructing a secret base that can sign messages with the original public key.

Anthropic’s released implementation verifies the received key by signing the message and checking it against the NIST reference. It does not return a 96-byte private key seed. Instead, it generates a 592-byte decrypted key that contains the equivalent signing function.

Anthropic’s released code only supports HAWK-256 and rejects all non-HAWK-256 input. The final location includes two public keys that Anthropic claims have successfully hacked them. It also supports generating and testing new HAWK-256 keys.

Anthropic estimates the expected HAWK-256 key-recovery factor from 264 to 238. In a NIST forum announcement of the same day, it said the average gate count is from 2150 to 2108 for the HAWK-512 and from 2288 to 21812 for the HAWK-21802. Both major parameters remain unassailable.

As of this review, the public record does not indicate whether NIST or HAWK’s proponents will change the program’s parameters, security claims or stance on the suspension process in response to those low ratings, if at all.

The attack remains in the spotlight. It is not a polynomial-time break for HAWK, and Anthropic said it does not overlap with other NIST signature candidates or lattice cryptography in general.

Anthropic said the Mythos Preview developed and verified the result for about 60 hours in a multi-agent environment. A human researcher provided occasional project management guidance but was not a lattice-cryptography expert. The company put the cost of the application programming interface (API) at about $100,000.

Soon, but still not possible

The second target effect AES-128 has been reduced from ten rounds to seven. Studying reduced round ciphers is a common cryptanalytic practice because it measures how much security margin is left before an attack reaches the perfect design.

The attack assumes that an adversary can obtain about 2105 selected ciphertexts encrypted under a single fixed, unknown key. That requirement alone puts it out of real-world use.

The previous attack on middle-of-the-road compromises trade memory for calculations by storing intermediate cipher states and the same calculations performed from the opposite end of the cipher. One stage of the preemptive attack requires checking up to 256 values ​​before searching the table.

Mythos creates an immutable fingerprint called the Möbius Bridge. Because the fingerprint does not change for every guessed value, the attack can remove the enumeration 256 ways. After accounting for conversion costs and other optimizations, Anthropic estimates the AES-128’s seven-round attack is 200 to 800 times faster, depending on how runtime is measured.

The accompanying AES paper shows the statistical construction, while the extracted artifact provides the code for each experiment cited in the paper.

Anthropic code performs perfect black-box key detection against a small cipher such as AES with a 24-bit key. With seven real AES-128 rounds, it measures each table entry and online candidate. Different implementations of C, Python, and Rust test component claims, and Anthropic projects that measure the full attack. It does not issue a complete restoration of AES-128 from start to finish.

The practical effect is less than the words HAWK and AES might imply. The full HAWK detection targets HAWK-256, a more challenging parameter than the NIST default security level parameter. With seven rounds of AES-128, the Anthropic projects a total attack cost in parts ratio, and the attack remains impossible on a realistic scale.

The company said the model initially refused to get involved, insisting that improvements to AES were impossible. Anthropic published the researcher’s vague follow-up instructions, typos and all, which prompted the model to continue looking.

Anthropic said that the Mythos Preview found Möbius Bridge after about three days and several hundred million output tokens. It paved the way in the following days, eventually generating nearly a billion output tokens.

The high cost was personal. Running the model costs about $100,000 in API implementations, but the researchers spent several hundred hours testing the method. Anthropic said it took two researchers about a month to gain confidence that that was true. In Anthropic’s account, validation was a virtual bottleneck.

The disclosure follows the July 20 release of CryptanalysisBench, a 191-work benchmark created by researchers from ETH Zurich, Anthropic, University of Haifa, Technische Universität Berlin and Tel Aviv University. Five models broke between 65% and 86% of their light first stage schemes and six to 12 full power schemes in their second stage.

That benchmark tested Mythos 5, which Anthropic describes as the latest update to the Mythos preview. The reveal of HAWK and AES directly names the Mythos Preview.

As of July 29, 2026, NIST continued to list HAWK as a third-cycle candidate. Anthropic’s NIST-based platform announcement thanked the HAWK team for helping to verify the result and provide feedback, but did not say whether that involved reviewing the evidence, using a public artifact, or both.

The public thread was unresponsive when searched, and Hacker News did not find an independent reproduction of Anthropic’s HAWK-256 discovery during this review.