Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery assault towards HAWK-256 and a 200- to 800-fold speedup for an assault on seven-round AES-128.
The HAWK assault exploits a beforehand unused symmetry within the lattice behind the signature scheme. Anthropic’s launched implementation provides an anticipated end-to-end runtime of about three hours and 42 minutes on a 96-core server. The AES end result removes a 256-way guessing step from an present meet-in-the-middle assault.
Anthropic stated neither end result impacts manufacturing programs. HAWK stays a candidate in a Nationwide Institute of Requirements and Expertise (NIST) post-quantum standardization course of, and the general public restoration code solely targets the smaller HAWK-256 parameter.
The Superior Encryption Commonplace (AES) end result applies to seven of AES-128’s ten rounds and nonetheless requires an impractical variety of chosen plaintexts. The corporate stated no manufacturing software program wants to alter consequently.
Anthropic revealed the findings alongside two technical papers and reproducibility artifacts. The corporate stated Mythos Preview largely performed the analysis itself, with people supplying mission path, computing assets, and in depth verification.
A symmetry hiding in HAWK’s lattice
HAWK is the one lattice-based scheme among the many 9 candidates that NIST superior to the third spherical of its further post-quantum digital-signature course of in Could 2026. Its NIST security-level parameter units are HAWK-512 and HAWK-1024; HAWK-256 is a problem parameter supplied as a cryptanalytic goal.
Direct HAWK key restoration is an occasion of the search module Lattice Isomorphism Drawback (smLIP). An attacker should get better a hidden transformation between two lattices.
A paper by Daniël van Gent and Ludo Pulles confirmed {that a} nontrivial automorphism, a symmetry that preserves the lattice, would scale back HAWK key restoration to discovering a brief vector in a lattice of roughly half the unique dimension.
That work opened the assault path, however the authors stated it didn’t then have an effect on HAWK. Anthropic says Mythos Preview discovered the extra automorphism wanted to use the trail.
The ensuing HAWK-n assault constructs what the researchers name a τ-cocycle lattice from the general public key. It then makes use of lattice discount and sieving to get better brief vectors earlier than reconstructing a secret foundation that may signal messages for the unique public key.
Anthropic’s launched implementation verifies the recovered key by signing a message and checking it with the NIST reference implementation. It doesn’t get better the unique 96-byte secret-key seed. As a substitute, it produces a 592-byte decoded key containing functionally equal signing materials.
Anthropic’s launched code helps HAWK-256 solely and rejects each non-HAWK-256 enter. The repository contains two public keys that Anthropic says it efficiently attacked. It additionally helps producing and testing recent HAWK-256 keys.
Anthropic estimates that the anticipated HAWK-256 key-recovery work issue falls from 264 to 238. In a same-day NIST-forum announcement, it stated the gate-count estimate falls from 2150 to 2108 for HAWK-512 and from 2288 to 2182 for HAWK-1024. Each bigger parameters stay impractical to assault.
As of this overview, the general public document doesn’t present whether or not NIST or the HAWK submitters will change the scheme’s parameters, safety claims or standing within the standardization course of in response to these decrease estimates, if in any respect.
The assault stays exponential. It’s not a polynomial-time break of HAWK, and Anthropic stated it doesn’t lengthen to different NIST signature candidates or lattice cryptography typically.
Anthropic stated Mythos Preview developed and verified the end result over roughly 60 hours in a multi-agent surroundings. A human researcher supplied occasional project-management steering however was not a lattice-cryptography specialist. The corporate put the appliance programming interface (API) price at about $100,000.
Quicker, however nonetheless impractical
The second end result targets AES-128 lowered from ten rounds to seven. Finding out reduced-round ciphers is normal cryptanalytic observe as a result of it measures how a lot security margin stays earlier than an assault reaches the total development.
The assault assumes an adversary can get hold of about 2105 chosen plaintexts encrypted beneath one mounted, unknown key. That requirement alone places it far outdoors real-world use.
Earlier meet-in-the-middle assaults commerce reminiscence for computation by storing intermediate cipher states and matching calculations comprised of reverse ends of the cipher. One stage within the prior assault required testing 256 potential values earlier than looking out the desk.
Mythos developed an invariant fingerprint Anthropic calls the Möbius Bridge. As a result of the fingerprint doesn’t change throughout that guessed worth, the assault can take away the 256-way enumeration. After accounting for the remodel’s price and different optimizations, Anthropic estimates the seven-round AES-128 assault is 200 to 800 occasions sooner, relying on how runtime is measured.
The accompanying AES paper presents the mathematical development, whereas the launched artifact supplies code for every experiment cited within the paper.
Anthropic’s code performs full black-box key restoration towards a smaller AES-like cipher with a 24-bit key. For actual seven-round AES-128, it measures particular person desk entries and on-line candidates. Separate C, Python, and Rust implementations take a look at the part claims, and Anthropic initiatives these measurements to the whole assault. It doesn’t execute the total AES-128 restoration from starting to finish.
The sensible result’s narrower than the names HAWK and AES may suggest. The entire HAWK restoration targets HAWK-256, a problem parameter fairly than both NIST security-level parameter set. For seven-round AES-128, Anthropic initiatives the whole assault’s price from part measurements, and the assault stays infeasible at life like scale.
The corporate stated the mannequin initially refused to interact, insisting that bettering on AES was inconceivable. Anthropic revealed the researcher’s blunt follow-up prompts, typos and all, that pushed the mannequin to maintain trying.
Anthropic stated Mythos Preview discovered the Möbius Bridge after about three days and several other hundred million output tokens. It refined the strategy over the next days, finally producing roughly one billion output tokens.
The upper price was human. The mannequin run price roughly $100,000 in API utilization, however researchers spent a number of hundred hours checking the strategy. Anthropic stated two researchers took almost a month to achieve confidence that it was right. On Anthropic’s account, verification was the seen bottleneck.
The disclosures observe the July 20 launch of CryptanalysisBench, a 191-task benchmark developed by researchers from ETH Zurich, Anthropic, the College of Haifa, Technische Universität Berlin and Tel Aviv College. 5 fashions broke between 65% and 86% of its simpler first-tier schemes and 6 to 12 full-strength schemes in its second tier.
That benchmark evaluated Mythos 5, which Anthropic describes as the newest replace to Mythos Preview. The HAWK and AES disclosure particularly names Mythos Preview.
As of July 29, 2026, NIST continued to checklist HAWK as a third-round candidate. Anthropic’s NIST-forum announcement thanked the HAWK workforce for serving to confirm the end result and offering suggestions, however didn’t say whether or not that concerned reviewing the proof, working the general public artifact, or each.
The general public thread contained no replies when checked, and The Hacker Information didn’t find an unbiased copy of Anthropic’s HAWK-256 restoration throughout this overview.
