Discovering Cryptographic Weaknesses with Claude

Anthropic reports that its Claude Mythos Preview model found flaws in the mathematics of two cryptographic algorithms, the formulas that keep data private, rather than in code that implements them. Its research post is explicit that neither result has a practical impact on today's systems. The first target, HAWK, is a digital signature scheme, the kind of algorithm a browser uses to confirm a website is genuine. It is a third-round candidate in a US National Institute of Standards and Technology (NIST) search for signatures that would resist future quantum computers, and it is not deployed. The second target is a weakened version of AES-128, the 128-bit form of the most widely used cipher for encrypting traffic, cut from its full 10 rounds of scrambling to 7. Cryptographers study cut-down versions like this to probe how much safety margin the full cipher has.

The HAWK result bears on a scheme still under consideration. Anthropic says Mythos found a hidden symmetry in the mathematical structure HAWK's security rests on, which earlier work had shown would enable an attack if one existed. The upshot, by Anthropic's account, is that HAWK keys would need to double in size for the same security, which removes much of what made the scheme attractive. For the smallest HAWK-256 setting, the estimated cost of recovering a secret key fell from about 2^64 operations to 2^38, and the accompanying paper reports recovering a HAWK-256 key end to end in a few hours on a single server. Larger HAWK settings remain impractical to attack, and Anthropic says the method does not affect other NIST candidates. It shared the attack with HAWK's authors in June.

The AES result improves on the strongest previously known attack of its type on the 7-round version by 200 to 800 times, depending on how run time is counted. That attack already assumed an attacker could get 2^105 chosen messages encrypted under the target key, an impossible quantity in practice, so a faster version of it remains a research result. Anthropic says the full cipher is unaffected and that even this reduced version would cost hundreds of millions of dollars to attack.

How the work was done matters as much as what it found. Anthropic says each result cost roughly $100,000 in API usage. HAWK took about 60 hours with one researcher, who was not a lattice-cryptography specialist, giving mostly project-management guidance to a team of Mythos agents. The AES attack came almost entirely from the model working inside a scaffold, after the researcher pushed past its initial claim that AES could not be improved on. Checking the output was the slow part: Anthropic says the model needed about a week to find the AES idea, while two researchers spent nearly a month gaining confidence that it was correct. Anthropic predicts cryptography researchers will soon face the same verification bottleneck that has hit software security teams, where AI finds more flaws than people can triage.