Anthropic says Claude Mythos Preview helped derive an end-to-end key-recovery attack against HAWK-256 and a 200- to 800-fold speedup for an attack on seven-round AES-128.
The HAWK attack exploits a previously unused symmetry in the lattice behind the signature scheme. Anthropic’s released implementation gives an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server. The AES result removes a 256-way guessing step from an existing meet-in-the-middle attack.
Anthropic said neither result affects production systems. HAWK remains a candidate in a National Institute of Standards and Technology (NIST) post-quantum standardization process, and the public recovery code only targets the smaller HAWK-256 parameter.
The Advanced Encryption Standard (AES) result applies to seven of AES-128’s ten rounds and still requires an impractical number of chosen plaintexts. The company said no production software needs to change as a result.
Anthropic published the findings alongside two technical papers and reproducibility artifacts. The company said Mythos Preview largely conducted the research itself, with humans supplying project direction, computing resources, and extensive verification.
A symmetry hiding in HAWK’s lattice
HAWK is the only lattice-based scheme among the nine candidates that NIST advanced to the third round of its additional post-quantum digital-signature process in May 2026. Its NIST security-level parameter sets are HAWK-512 and HAWK-1024; HAWK-256 is a challenge parameter provided as a cryptanalytic target.
Direct HAWK key recovery is an instance of the search module Lattice Isomorphism Problem (smLIP). An attacker must recover a hidden transformation between two lattices.
A paper by Daniël van Gent and Ludo Pulles showed that a nontrivial automorphism, a symmetry that preserves the lattice, would reduce HAWK key recovery to finding a short vector in a lattice of roughly half the original dimension.
That work opened the attack path, but the authors said it did not then affect HAWK. Anthropic says Mythos Preview found the additional automorphism needed to exploit the path.
The resulting HAWK-n attack constructs what the researchers call a τ-cocycle lattice from the public key. It then uses lattice reduction and sieving to recover short vectors before reconstructing a secret basis that can sign messages for the original public key.
Anthropic’s released implementation verifies the recovered key by signing a message and checking it with the NIST reference implementation. It does not recover the original 96-byte secret-key seed. Instead, it produces a 592-byte decoded key containing functionally equivalent signing material.
Anthropic’s released code supports HAWK-256 only and rejects every non-HAWK-256 input. The repository includes two public keys that Anthropic says it successfully attacked. It also supports generating and testing fresh HAWK-256 keys.
Anthropic estimates that the expected HAWK-256 key-recovery work factor falls from 264 to 238. In a same-day NIST-forum announcement, it said the gate-count estimate falls from 2150 to 2108 for HAWK-512 and from 2288 to 2182 for HAWK-1024. Both larger parameters remain impractical to attack.
As of this review, the public record does not show whether NIST or the HAWK submitters will change the scheme’s parameters, security claims or standing in the standardization process in response to those lower estimates, if at all.
The attack remains exponential. It is not a polynomial-time break of HAWK, and Anthropic said it does not extend to other NIST signature candidates or lattice cryptography generally.
Anthropic said Mythos Preview developed and verified the result over approximately 60 hours in a multi-agent environment. A human researcher provided occasional project-management guidance but was not a lattice-cryptography specialist. The company put the application programming interface (API) cost at about $100,000.
Faster, but still impractical
The second result targets AES-128 reduced from ten rounds to seven. Studying reduced-round ciphers is standard cryptanalytic practice because it measures how much safety margin remains before an attack reaches the full construction.
The attack assumes an adversary can obtain about 2105 chosen plaintexts encrypted under one fixed, unknown key. That requirement alone puts it far outside real-world use.
Previous meet-in-the-middle attacks trade memory for computation by storing intermediate cipher states and matching calculations made from opposite ends of the cipher. One stage in the prior attack required testing 256 possible values before searching the table.
Mythos developed an invariant fingerprint Anthropic calls the Möbius Bridge. Because the fingerprint does not change across that guessed value, the attack can remove the 256-way enumeration. After accounting for the transform’s cost and other optimizations, Anthropic estimates the seven-round AES-128 attack is 200 to 800 times faster, depending on how runtime is measured.
The accompanying AES paper presents the mathematical construction, while the released artifact provides code for each experiment cited in the paper.
Anthropic’s code performs complete black-box key recovery against a smaller AES-like cipher with a 24-bit key. For real seven-round AES-128, it measures individual table entries and online candidates. Separate C, Python, and Rust implementations test the component claims, and Anthropic projects those measurements to the complete attack. It does not execute the full AES-128 recovery from beginning to end.
The practical result is narrower than the names HAWK and AES might imply. The complete HAWK recovery targets HAWK-256, a challenge parameter rather than either NIST security-level parameter set. For seven-round AES-128, Anthropic projects the complete attack’s cost from component measurements, and the attack remains infeasible at realistic scale.
The company said the model initially refused to engage, insisting that improving on AES was impossible. Anthropic published the researcher’s blunt follow-up prompts, typos and all, that pushed the model to keep looking.
Anthropic said Mythos Preview found the Möbius Bridge after about three days and several hundred million output tokens. It refined the method over the following days, ultimately generating roughly one billion output tokens.
The higher cost was human. The model run cost approximately $100,000 in API usage, but researchers spent several hundred hours checking the method. Anthropic said two researchers took nearly a month to reach confidence that it was correct. On Anthropic’s account, verification was the visible bottleneck.
The disclosures follow the July 20 release of CryptanalysisBench, a 191-task benchmark developed by researchers from ETH Zurich, Anthropic, the University of Haifa, Technische Universität Berlin and Tel Aviv University. Five models broke between 65% and 86% of its easier first-tier schemes and six to 12 full-strength schemes in its second tier.
That benchmark evaluated Mythos 5, which Anthropic describes as the latest update to Mythos Preview. The HAWK and AES disclosure specifically names Mythos Preview.
As of July 29, 2026, NIST continued to list HAWK as a third-round candidate. Anthropic’s NIST-forum announcement thanked the HAWK team for helping verify the result and providing feedback, but did not say whether that involved reviewing the proof, running the public artifact, or both.
The public thread contained no replies when checked, and The Hacker News did not locate an independent reproduction of Anthropic’s HAWK-256 recovery during this review.
