Anthropic's Claude Mythos Cracks Two Encryption Systems in 60 Hours

Cryptography has always been a game of adversarial review: propose an algorithm, let the world attack it, and trust what survives. New research from Anthropic suggests AI is about to dramatically accelerate that game. Using Claude Mythos Preview, Anthropic researchers found meaningful weaknesses in two cryptographic systems: one a post-quantum signature candidate still under government review, the other a reduced variant of the most battle-tested cipher in existence.

Why cryptography, why now

Cryptographic algorithms are the foundation of digital security. When you visit a webpage, your browser checks authenticity using a digital signature scheme and encrypts traffic using a symmetric cipher. Flaws in widely deployed systems could put billions of users' data at risk. Until recently, finding those flaws required years of expert human effort. Anthropic set out to test whether a frontier AI model could compress that timeline.

When Anthropic launched Claude Mythos Preview, it could already autonomously find and exploit vulnerabilities in major cryptographic libraries. Those vulnerabilities stemmed from incorrect implementation: errors in how programmers used the algorithms in their code. This new work goes a level deeper, targeting mathematical flaws in the algorithms themselves.

Two targets, two results

The first target was HAWK, a digital signature scheme designed to resist quantum computers. In 2022, NIST solicited additional cryptographic systems that would remain secure even as quantum hardware matures, since quantum computers could break most signature schemes in use today. HAWK is a third-round candidate. It had survived two years of expert human review. Mythos improved the best-known attack on it in 60 hours, effectively cutting its key strength in half.

The second target was a reduced-round variant of AES (Advanced Encryption Standard), the symmetric cipher securing most encrypted internet traffic. AES encrypts data by repeatedly applying the same round function: AES-128 runs 10 rounds. The attack targets a modified version with 7 of those 10 rounds. Academics study round-reduced ciphers to develop attack techniques that might generalize to the full cipher. Mythos extended a long line of research using a technique called a meet-in-the-middle attack, which trades storage for speed: by caching intermediate calculations in a lookup table, you can cut runtime significantly.

How the HAWK attack works

HAWK's security rests on the hardness of the Lattice Isomorphism Problem. Mythos found a specific, previously unexploited symmetry in HAWK's underlying lattice called a nontrivial automorphism. Prior work had shown that finding such an automorphism would enable an attack, but left open whether one existed in HAWK's particular lattice structure.

The automorphism Mythos found enables a faster enumeration attack. The attack remains exponential, but the speedup is large enough that HAWK keys would need to double in size to restore the original security level. Doubling key size eliminates most of the properties that made HAWK an attractive post-quantum candidate in the first place.

In concrete terms: a full key recovery attack against HAWK-256 was expected to cost 2⁶⁴ operations. Mythos demonstrated it at 2³⁸, a speedup of roughly 67 million times on the smallest key size. Larger HAWK keys remain impractical to attack.

How the AES attack works

Mythos improved on the strongest prior meet-in-the-middle attack by developing a more sophisticated fingerprinting algorithm it named the Möbius Bridge. The fingerprint's job is to increase the fraction of table lookups that succeed. A previous attack stage required enumerating 2⁵⁶ values and looking each up in a precomputed table. Mythos's fingerprint is invariant to the guessed value in that stage, cutting the required work by a factor of 256.

Computing the transform costs more, but Mythos also found several other optimizations. The combined result is an attack between 200 and 800 times faster than the prior best, depending on how runtime is measured.

How the model actually worked

For the HAWK result, Claude Mythos Preview ran semi-autonomously inside an agentic harness, with occasional human guidance. It began with an extensive literature review to map the state of the art, then moved through mathematical reasoning and computational experiments before building an end-to-end verification pipeline to confirm the attack's correctness. The harness supported multiple worker agents collaborating in a sandboxed environment with access to Python, Sage, and published cryptographic papers. The human operator had a background in theoretical computer science but no expertise in lattice-based cryptography.

The AES result was more autonomous still. A researcher built a scaffold that let Claude pose hypotheses, run experiments to test them, and iterate. At first, Claude refused to engage, claiming it was impossible to improve on existing AES cryptanalysis. The fix was a single message that rewrote the agent harness to explicitly direct Claude to search for genuinely novel ideas. That change worked. Over three days, with just three short prompts from the researcher, Claude produced several hundred million tokens while working on the problem and surfaced the Möbius Bridge idea. A few days later, after outputting one billion tokens total, it had refined the full attack.

The HAWK session produced an interesting dynamic: the key insight came from two worker agents collaborating. The first investigated the automorphism idea and prematurely rejected it as infeasible. The second found a way to exploit it fully. The two agents exchanged messages until both agreed the attack was valid.

A benchmark to track progress

Alongside the two attacks, Anthropic partnered with researchers at ETH Zurich, Tel Aviv University, and the University of Haifa to release CryptanalysisBench, a structured evaluation for tracking how well language models perform at cryptanalysis over time.

The benchmark contains 191 tasks across six families of cryptographic primitives, drawn primarily from four NIST standardization competitions, organized into three tiers:

• Tier 1: Primitives with known practical breaks
• Tier 2: Primitives with no known practical break, evaluated at full strength and as scaled-down variants
• Challenge tier: Production primitives at the frontier of current cryptanalysis

Five frontier models tested on the benchmark (Claude Opus 4.8, Sonnet 5, Mythos 5, GPT 5.5, and the open-weights GLM 5.2) broke 65–86% of Tier 1 schemes, 6–12 Tier 2 schemes at full strength, and 24–61 across all scaled-down variants. Beyond reproducing known attacks, models also produced novel results, including a key-recovery attack exploiting a design flaw in the SpoC AEAD and an error in KINDI's published security proof.

Cost, limits, and what comes next

Each of the two main results cost roughly $100,000 in API compute. That is steep for an individual researcher and routine for a nation-state or a well-funded security team, and compute prices fall over time.

Neither result threatens production systems today. HAWK is a candidate scheme, not a deployed one. The AES attack targets a 7-round variant, not the full 10-round cipher. Human validation also remains a significant bottleneck: Mythos found the improved AES attack in one week, but two researchers needed nearly a month to gain confidence the method was correct.

Anthropic has already extended the work further. Mythos Preview developed a practical attack recovering a 13-round LEA key in under 2³⁰ encrypted plaintexts, running in under an hour on a modern desktop. It also identified a practical full key-recovery attack on 6-round Serpent-128.

The pattern across all of this is clear. In roughly one year, language models have gone from failing at basic cipher analysis to finding flaws that escaped years of expert human review. Many ciphers protecting modern systems have received less scrutiny than they deserve, and AI-assisted cryptanalysis is now a practical tool for stress-testing algorithms before deployment. The open question is how fast the field can build the human infrastructure to validate, act on, and govern what these models find.

• Demonstration code for the HAWK attack is on GitHub.
• The full AES technical paper and HAWK paper are publicly available.
• Anthropic released Claude's raw chain-of-thought from the AES discovery session, a rare look at how the model reasoned through the problem.
• CryptanalysisBench is open for others to evaluate their own models.