AI Broke a NIST Candidate. Not Your Encryption

July 28, 2026 – On July 28, Anthropic disclosed that Claude Mythos Preview had recovered signing-equivalent keys from two HAWK-256 challenge public keys, in a few hours, on one server. A separate team independently attacked the same scheme through a different mathematical path using GPT-5.6. In the same release, Mythos also improved the best-known attack on 7-round AES-128, a research target that had stood since 2013. The coverage has been predictably bad in both directions, so before going any further:

• No deployed system is affected. HAWK is a NIST candidate, not a standard. The AES result targets 7 of 10 rounds and requires $$2^{105}$$ chosen plaintexts. No key was recovered from any production system, and your algorithm roadmap does not change today.
• These are weaknesses in the algorithm designs themselves. The HAWK attack exploits a symmetry in the mathematical ring the designers chose. The AES attack exploits algebraic properties of the S-box as defined in the FIPS 197 standard. Any correct implementation inherits both properties. A software patch cannot fix a flaw in the specification. For HAWK, the response is reparameterization or a redesign; for AES, no response is needed because the full 10-round cipher absorbed the finding.
• ML-KEM, ML-DSA, SLH-DSA, Falcon, and production AES are untouched. The HAWK finding is specific to HAWK. It does not affect other lattice schemes or any finalized NIST standard.
• What changed is the economics of finding these flaws. A publishable cryptanalytic result now costs about USD 100,000 and a week of model time. Three independent efforts produced attacks on three cipher families within days of each other.

That second point is the one both sides of the media coverage are getting wrong, so I want to spend a moment on it.

The three tiers of cryptographic failure

Cryptographic failures come in three kinds, and conflating them is how you get both panic and false reassurance from the same event.

Implementation bugs are coding errors, timing leaks, API misuse. The algorithm’s mathematical design is sound; the software got it wrong. You patch the library and move on. This is what Anthropic’s Project Glasswing found in April when Mythos discovered vulnerabilities in OpenSSL and wolfSSL cryptographic libraries. Those were implementation bugs. What happened this week is categorically different.

Algorithm design weaknesses mean the mathematical structure the designers chose has more exploitable properties than anyone realized when the parameters were set. The algorithm’s underlying hard problem is not dead, but the specific construction does not deliver the security margin claimed. You change the parameters or change the algorithm. This is where the HAWK and AES results sit. HAWK’s underlying hard problem, module-LIP in general, is intact. What Mythos found is that HAWK’s specific power-of-two cyclotomic ring has a Galois symmetry (the involution that sends ζ to −ζ) that roughly halves the SVP oracle dimension. The HAWK paper confirms this is a property of the algebraic structure: it explicitly identifies which ring conductors evade the attack and which do not, proving the flaw follows the mathematics rather than any particular codebase. For AES, what Mythos found is that 7 rounds provide less margin than previously measured, because the S-box’s GF(2^8) inversion structure turned out to have unexploited implications for one class of meet-in-the-middle attack. Full 10-round AES absorbed the finding with room to spare.

Practical full-parameter breaks mean the complete specified scheme can be defeated at its intended parameters. SIKE was broken this way in 2022 by an attack that exploited SIDH’s auxiliary torsion-point exchange (the generic supersingular-isogeny problem itself was not shown to be easy, so other isogeny-based approaches survive). A polynomial-time factoring algorithm would be an even more extreme version: the mathematical assumption behind an entire family of schemes dying at once. Nothing this week is a tier-three event.

So when coverage says “AI broke post-quantum encryption,” that is wrong twice: no encryption was broken, and no deployed post-quantum standard was touched. When other coverage says “only implementation flaws,” that is also wrong: the attacks exploit the mathematics of the algorithm specifications, and no software patch can undo them. Getting the tier right determines whether you file this under “interesting research” (correct for AES), “important input to an ongoing standardization decision” (correct for HAWK), or “emergency” (correct for neither).

The practical takeaway is that tier-two findings are exactly what crypto-agility exists to handle, and exactly what most organizations are not prepared for. That argument is developed later in this piece after the technical details, but the economics of AI-assisted cryptanalysis, roughly USD 100,000 and a week per publishable result, mean tier-two findings are about to arrive faster and across a wider set of targets than the field has ever experienced.

What the two attacks actually do

The HAWK result comes from Zygimantas Straznickas and Stephen A. Weis. HAWK bases its security on the module Lattice Isomorphism Problem over power-of-two cyclotomic rings, and key recovery means finding any short basis whose Gram matrix equals the public key. Every prior module-LIP attack worked through complex conjugation. Mythos used a different order-2 Galois involution, the map that sends a root of unity to its negative, and showed that the associated cocycle sits as a shortest vector in a lattice of rank $$n$$ that anyone can compute from the public key. Run Ducas’s block reduction on it, then run the descent of van Gent and Pulles, and the whole problem reduces to exact-SVP calls in dimension $$n/2 + 1$$ instead of lattice reduction on the rank-$$2n$$ key lattice.

In the gate-count model the HAWK specification itself uses, that drops key-recovery cost for HAWK-512 from $$2^{150}$$ to at most $$2^{108}$$, and for HAWK-1024 from $$2^{288}$$ to at most $$2^{182}$$. Under the specification’s own heuristic methodology the paper puts the numbers near $$2^{81}$$ and $$2^{147}$$. Those are the figures to cite. (Anthropic’s blog post describes HAWK-256 recovery as moving from $$2^{64}$$ to $$2^{38}$$, and that pairing does not appear in the paper’s Table 1, which reports per-oracle-call costs of $$2^{62}$$ and $$2^{38}$$ under Core-SVP and $$2^{74}$$ and $$2^{52}$$ under the gate model. The blog is a summary; the paper is the citable source, and the secondary coverage has been copying the blog.)

None of this makes HAWK-512 attackable today. The proven oracle dimension there is 257 and the authors did not attempt it. The attack is exponential and stays exponential. The damage is to HAWK’s parameter claims and therefore to its appeal, because restoring the intended margin means roughly doubling key sizes, and doubling would erode one of HAWK’s central advantages. The construction does not transfer to Falcon, and it does not touch ML-KEM, ML-DSA, or SLH-DSA.

Milad Nasr and Nicholas Carlini produced the second paper, which attacks 7 of AES-128’s 10 rounds, extending the meet-in-the-middle line that runs from Demirci and Selçuk through Dunkelman, Keller and Shamir to Derbez, Fouque and Jean in 2013. The AES S-box is inversion in $$GF(2^8)$$ followed by an affine map. Mythos built a fingerprint invariant under that affine action, which removes one of the nine key bytes the 2013 attack had to guess, worth a factor of 256. Computing the invariant naively costs more than it saves, so the paper adds a packed power table, a Gray-code walk and an XOR-separable cache to bring per-entry cost from about $$2^{19}$$ lookups down to about $$2^{8.6}$$. Runtime at the same data budget falls from $$2^{99}$$ to between $$2^{89.3}$$ and $$2^{91.4}$$.

Here the honest number is smaller than the headline. The attack still needs $$2^{105}$$ chosen plaintexts, so under the standard balanced metric the attack’s time term improved substantially, but the balanced maximum complexity is unchanged because data still dominates. The paper says so directly and then builds a rebalanced variant that reaches $$2^{96.3}$$ against the 2013 attack’s $$2^{99}$$, or $$2^{96.9}$$ if you drop one fingerprint assumption. Call it a 2.7-bit improvement on a research target that had not moved since 2013. Real work, and the “200 to 800 times faster” framing describes the time column rather than the attack as a whole.

The follow-up results got less attention and deserve more. Mythos recovered a 13-round LEA key in under $$2^{30}$$ plaintexts and under an hour on a desktop, against a published best of $$2^{98}$$ plaintext pairs and $$2^{86}$$ work. LEA is standardized in ISO/IEC 29192-2 and built for constrained devices. Full LEA is 24 rounds, so nothing fielded is broken, but that attack runs end to end, which makes it far easier to trust than any complexity argument. Six rounds of Serpent-128 fell too, out of 32. Salsa20, Poseidon and SHA-1 each moved by less than 10x. (All of these are reported in Anthropic’s blog post; the full papers have not yet been released.)

The companion CryptanalysisBench paper adds two more results that deserve separate attention. Two Claude models independently found a full 128-bit key-recovery attack on the complete, unmodified SpoC authenticated-encryption design using just two oracle queries. A third model found an error in the published CCA-security proof of the KINDI key-encapsulation scheme and produced a working decryption-reaction attack. Neither SpoC nor KINDI became a deployed standard, but these are practical breaks of full-strength constructions rather than reduced-round exercises. They are the clearest evidence that AI-assisted cryptanalysis already reaches beyond optimizing known attacks into finding design flaws that human reviewers missed.

Both results extend published human work

For HAWK, van Gent and Pulles had already proved in 2025 that a suitable nontrivial automorphism would cut the problem to half rank. They said at the time that no such automorphism was known for HAWK. Mythos found it. More pointed still, NIST’s own second-round status report asked the community to look harder at the module-LIP assumption inside HAWK’s particular cyclotomic fields. The attack arrived precisely where NIST had pointed, roughly two months after HAWK advanced to round three as the only lattice-based candidate left in the additional-signatures track.

For AES, the contribution is one new invariant inside an 18-year-old attack lineage, plus the engineering to make computing it affordable. That is how a great deal of human cryptanalysis works: find the one missing bridge between results that are already published.

The capability trend is also not news. Gemini has resolved open Erdős problems, GPT disproved a discrete geometry conjecture, and Claude Fable 5 produced a counterexample disproving the Jacobian Conjecture in dimensions three and higher (the two-variable case remains open). Cryptanalysis is mathematics with an unusually good verification story attached, so it was always going to be an early application. Anyone tracking frontier model mathematics saw this coming.

My favorite detail in the whole release, per Anthropic’s blog account, is that Mythos initially declined the AES task, telling its operator that AES-128 at these round counts is hard and that there is nothing easy to find in the most-studied block cipher in existence. Which is the correct answer. The researcher reportedly spent three prompts over three days talking the model past its own well-founded pessimism before it produced anything. The published chain-of-thought document shows a different session where the model engaged immediately but predicted its own approach would cap at two rounds of structure, then pivoted to the Möbius Bridge when that prediction held.

What made the difference was the setup rather than raw intelligence: a Claude Code-style scaffold, multiple worker agents in a sandbox, Python and Sage, the published literature, and permission to run experiments. On HAWK the decisive idea came from two agents disagreeing, where the first rejected it as infeasible and the second found the exploit. Human research groups lose promising avenues that way all the time. Each result cost roughly USD 100,000 in API spend.

The standardization process worked exactly as designed

HAWK is a candidate. Candidates exist to be attacked in public, before anyone builds on them, and HAWK is not the first late-stage casualty. SIKE reached the fourth round in 2022 before Castryck and Decru broke it at full parameters (a tier-three event, unlike HAWK). That was worse, and the correct reading then was the same as now. A public competition found a flaw in a scheme nobody had deployed, before standardization and with no known production impact.

Disclosure followed the norms too. Anthropic notified the HAWK team in June, the HAWK authors helped verify the result, and Weis posted the announcement to the NIST pqc-forum the same day the papers went up. Daniel Apon replied within hours that the result checked out independently for him. That is the process working.

The forum thread is worth reading for what came next, because the cryptographers turned immediately to governance rather than to the attack. Markku-Juhani Saarinen argued that AI-assisted cryptanalysis should always ship machine-checkable proofs or working demonstrations against scaled-down targets. Then he mentioned, in passing, that he has new McEliece structural key-recovery records including a break of TII-252, obtained with HOVER, a variant of Hemmert’s higher-order-vanishing attack (ePrint 2026/1339). Saarinen described it in the forum as AI-assisted; the public repository does not specify the model. Code-based cryptography, a different family of post-quantum schemes entirely.

Daniel Apon called for a community standard for adjudicating AI-generated cryptanalytic claims, modeled on Scott Aaronson’s ten signs a claimed mathematical breakthrough is wrong, because human reviewers will otherwise be overwhelmed.

And Hengyi Luo posted an independent HAWK attack produced by GPT-5.6 with minimal human guidance, reducing to $$\gamma$$-SVP in dimension $$3n/4 + 1$$ through a different mechanism (adjoint lattice reduction on the HAWK Gram factor problem). The preprint itself is anonymous, dated July 17; the GPT-5.6 attribution and Luo’s authorship appeared in the forum post. The result is weaker than Anthropic’s but arrives at a separate mathematical path, and a follow-up preprint generalizes the geometric idea to rank-4 module-LIP. The HAWK team is verifying both.

Step back from the individual findings and count. Between July 17 and July 28: Anthropic’s Mythos Preview attacked HAWK through a $$\tau$$-cocycle lattice, an anonymous preprint (attributed in the forum to GPT-5.6) attacked HAWK through adjoint lattice reduction, and Saarinen’s HOVER recovered previously unsolved McEliece challenge keys. Three independent efforts, three cipher families (lattice signatures, block ciphers, code-based schemes). The single-vendor-announcement objection did not survive the week, and the capability is clearly distributed across the frontier.

Where this gets dangerous is the long tail

HAWK and AES are the wrong things to worry about. They received attention because their names are recognizable.

The exposure sits in everything that never got this treatment: proprietary ciphers in industrial and defense products, national algorithms outside the main standards bodies, lightweight crypto in embedded devices and IoT, homegrown protocol designs, and the accumulated legacy of “we rolled our own but it’s fine, it’s obfuscated.” LEA is the demonstration. A standardized, reviewed, published cipher designed for constrained devices, and 13 of its 24 rounds went from a theoretical $$2^{98}$$ attack to an hour on a desktop, in a preliminary run that Anthropic has not even fully written up yet.

The economics are what should concentrate minds. A publishable cryptanalytic result now costs on the order of USD 100,000 and a week. Three independent efforts produced attacks on three cipher families in the same period, using different frontier models. Every algorithm whose security rested on the fact that nobody important had bothered to look at it just lost that protection. The gap between “unbroken” and “unexamined” is about to become visible across a very large number of products.

This is the strongest available argument for something boring that I have repeated to every board that would listen. Use standardized, heavily reviewed cryptography. Not because standards bodies are infallible, and HAWK is proof they are not, but because long, open, adversarial public review remains the strongest practical evidence we have that a cryptographic design will hold up. That correlation just got stronger, because standardized algorithms are the ones every new frontier model will be pointed at first, and the ones whose flaws will be found by researchers who publish rather than by people who do not.

Crypto-agility was always the point

One response to the HAWK attack would be to roughly double key sizes; another would be to change the underlying ring to a conductor that evades the construction. Until the HAWK team and NIST publish revised parameters, the remedy is not settled. But the general pattern of a tier-two finding is clear: change a parameter, or change the algorithm. The question that decides whether such an advance is an inconvenience or a crisis has never been the mathematics. It is whether your organization can change a cryptographic parameter across its estate in weeks or in years.

For most organizations I work with, the honest answer is years, and for some of the fielded hardware the answer is never. That is a design failure rather than a cryptography problem.

Which is why I keep saying that crypto-agility cannot be an afterthought bolted on once PQC migration is done. It has to be built during the migration, because the migration is the one time you have executive attention, budget, and a mandate to touch every certificate, every library, every protocol endpoint and every embedded device in the estate. Discovering your crypto inventory, centralizing policy, abstracting algorithm choice away from application code, and building the ability to rotate: those are migration activities. Do them separately later and you pay the full cost twice.

Budget it as its own workstream, with its own owner and its own line item. Crypto-agility is a large organizational change program wearing a technical name, and treating it as a design principle rather than a funded project is how it ends up in a slide deck and nowhere else. My PQC Migration Framework puts inventory and agility in the early phases for exactly this reason, and the practical steps guide sequences them.

This development does not move the quantum timeline. The attack is classical, it targets a signature scheme, and forging signatures is a forward risk rather than a retroactive one. There is no harvest now, decrypt later exposure here, though the signature analog I call trust now, forge later is the right frame for thinking about long-lived signing infrastructure. Nothing in these papers moves Q-Day or changes any assumption in my CRQC analysis. If anything it is a story about the durability of the destination, not the timing of the threat, and the deadlines driving your migration were never set by Q-Day predictions anyway.

On what I wrote last year, and what needs updating

In June 2025 I published Why AI Cannot Break Modern Encryption. The obvious question is whether these results prove the thesis wrong.

The thesis holds. Nothing in these papers breaks modern deployed encryption. AES-128 is untouched at 10 rounds, the best full-cipher attack still beats brute force by about two bits, and the reduced-round result requires $$2^{105}$$ chosen plaintexts. No key was recovered from any production system. The mechanism argument in that article also holds completely: I argued that neural networks cannot learn a pseudorandom permutation from ciphertext because the loss surface is flat everywhere except at the exact key, and nobody has refuted that, because nobody tried it. No model was trained on ciphertext-plaintext pairs here.

The article even anticipated this specific attack. It named the AES S-box, inversion in $$GF(2^8)$$ plus a linear map, as the structure cryptanalysts had been probing for years. It said an AI might automate parts of that search. And it said that even a hypothetical algebraic attack bringing AES to $$2^{100}$$ would remain completely infeasible. The Möbius Bridge is that attack, at $$2^{89.3}$$ on 7 rounds, and it remains completely infeasible. I would rather be right for the stated reason than right by luck.

Now the part where I was too narrow.

That article treated “AI” as machine learning models applied to ciphertext, and organized its entire case around that channel. The channel that produced these results is a different one: the model as a mathematical research agent, reading the full literature, generating and discarding hypotheses, deriving symbolically, running its own experiments in Sage, and writing its own verification pipeline. I covered that possibility in two sentences and one hedge. It deserved a section. My taxonomy of AI-versus-cryptography had a category that was too small, and the past year filled it.

More than one line needs correcting. I wrote that the best 7-round AES attacks are not AI-based; one now is. I wrote that AI attacks “implementations and the people using them, never the math”; this week’s results attack the math of the algorithm specifications directly. The narrow mechanism argument (neural networks cannot learn a pseudorandom permutation from ciphertext) still holds. The broader claim that AI would leave cryptographic mathematics out of reach was wrong. I will publish an update to that article with a dated correction box, an expanded section on models as research agents, and the results described here. The framing was built for the wrong threat channel, and I would rather say so plainly than quietly edit the page.

There is a broader lesson in that for anyone writing about this field, myself included. I spend a lot of energy pushing back on quantum FUD, and the discipline that requires is the same discipline that can make you slow to update when a capability actually arrives. Argue against the hype, keep the argument narrow enough to be falsifiable, and then check it when the evidence moves.

What to do about this quarter

Concretely, for a CISO or a head of platform security:

• Inventory your non-standard cryptography first. Proprietary algorithms, vendor-specific protocols, anything in embedded or OT products where the cipher was chosen by a supplier. That is the population at risk from this development, and most organizations cannot currently enumerate it.
• Add a contractual question to vendor due diligence: which standardized algorithms does this product use, and what is the field-update path if a parameter has to change? A vendor that cannot answer the second half is selling you a future incident.
• Fund crypto-agility as a named workstream inside your PQC program. Give it an owner, a budget, and milestones separate from the migration itself.
• Leave your algorithm roadmap alone. ML-KEM, ML-DSA and SLH-DSA are unaffected, Falcon is unaffected, and if you were considering HAWK for anything ahead of standardization, stop.
• If you run a standards or assurance function, start thinking now about how you will adjudicate AI-generated cryptanalytic claims, because the volume is coming and Apon is right that human review is the bottleneck.

The verification problem is the one to watch

The AES paper states it plainly: the core idea took tens of hours of model time, while human validation took hundreds of hours across two researchers. That ratio is the thing I would put on a watch list.

We have built a discovery engine that outruns the review capacity of the field it discovers in. In cryptography that asymmetry is survivable while the findings arrive in ones and twos against candidates and reduced-round variants, disclosed responsibly, with runnable code attached. It becomes a different problem the first time a model produces a credible attack on something deployed, in a paper nobody can check quickly, and the discoverer is not a lab with a disclosure policy.

Anthropic asks that question in its own conclusion without answering it, which is fair enough, because it is not theirs to answer alone. The cryptographic community has about one release cycle to work out its norms before it needs them. Saarinen’s proposal is the right starting point: require machine-checkable proofs and scaled-down demonstrations, so that verification cost scales with the volume of claims instead of with the patience of the dozen people qualified to referee them.

That is a solvable problem, and solving it is more urgent than anything in the two papers. I would start now.