Anthropic's Mythos Found Flaws in AES and HAWK Cryptography — at $100,000 Per Attack

When Anthropic published its latest frontier red team findings on July 28, the headline was surgical: Claude Mythos Preview had found mathematical weaknesses in cryptographic algorithms — not implementation bugs, but flaws in the core mathematical design. The two targets were HAWK, a post-quantum digital signature scheme in NIST's third-round standardization process, and AES-128, the block cipher that secures HTTPS connections, encrypted messaging, and financial transactions worldwide.

The timing matters. Just this year, Google DeepMind used Gemini to resolve open Erdős problems, OpenAI's GPT disproved the unit distance conjecture, and Anthropic's own Fable 5 resolved the Jacobian Conjecture. Cryptography is the next frontier — and unlike pure mathematics, the stakes here are practical because the algorithms under scrutiny protect real data.

HAWK: two years of human review, 60 hours of AI

HAWK is one of the remaining candidates in NIST's search for post-quantum digital signatures — algorithms designed to remain secure even against cryptographically relevant quantum computers. It survived two rounds of expert review over two years. Mythos found an improved attack in roughly 60 hours.

The attack exploits a previously undetected symmetry — a nontrivial automorphism — in the mathematical lattice that HAWK's security relies on. Prior academic work had proven that finding such an automorphism would enable an attack, but nobody had found one in HAWK's specific lattice. Mythos did, and it effectively halved the scheme's key strength: the expected cost of a full key recovery against the small HAWK-256 parameter dropped from 2⁶⁴ to 2³⁸.

The multi-agent workflow produced an interesting dynamic. One worker agent initially dismissed the idea as infeasible, but a second agent found a way to fully exploit the symmetry. The pair kept exchanging messages until both agreed they had a viable attack. The human researcher — who had a background in theoretical computer science but was not a lattice cryptography expert — mostly handled project management.

AES and the Möbius Bridge

The second result targets AES-128, the cipher adopted by NIST in 2001 that has been scrutinised more intensively than almost any encryption algorithm in existence. Mythos attacked a reduced-round variant — 7 rounds instead of the full 10 — which is a standard academic technique for probing a cipher's security margins.

Mythos developed a novel fingerprinting method Anthropic named "Möbius Bridge." It works by making a certain mathematical transformation invariant to one of the guesses an attacker normally has to enumerate, directly removing a factor of 256 from the workload. Combined with several additional optimisations Mythos discovered, the attack improves on the best previously known meet-in-the-middle attacks on 7-round AES by a factor of 200 to 800.

There is a darkly funny detail in the paper: Mythos initially refused to work on the problem. It told the researcher: "If you want a different outcome, the target has to change … AES-128 r5/r6 is just genuinely hard." It only began pursuing creative approaches after the researcher pushed back with messages like "again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings." Three days and a billion output tokens later, the Möbius Bridge idea emerged.

What it cost, what it means

Let's put the numbers in perspective:

The ~1 billion output tokens Mythos generated for the AES attack cost approximately $100,000 — roughly $0.10 per thousand tokens for Mythos output. That may sound steep, but compare it to the alternative: two human researchers spending several hundred hours just to validate what the model produced. The researchers who verified the AES result were not cryptography experts and had to learn enough of the field to check the work — it took them nearly a month.

Anthropic also disclosed additional findings that are still being analysed: a practical key-recovery attack on 13-round LEA (a lightweight cipher standardised in ISO/IEC 29192-2:2019) that runs in under an hour on a desktop, and attacks on round-reduced variants of Serpent-128, Salsa20, Poseidon, and SHA-1. Most are marginal improvements, but the LEA attack is notable because it is end-to-end verifiable: you pick a random key, run the attack, and recover it.

The European dimension

This research has concrete implications for Europe. Anthropic Ireland Limited is the legal entity providing Claude services in the EU — the company is already operating under EU jurisdiction and supports all EU member states. Services marketed in the EU must comply with the GDPR and, increasingly, the EU AI Act. Cryptographic security underpins GDPR's data protection requirements — if the algorithms that protect personal data turn out to have mathematical weaknesses, that becomes a compliance issue.

The AI Act classifies AI systems used in critical infrastructure as high-risk. Cryptographic libraries certainly qualify. The question Anthropic's research raises is whether an AI model that can find vulnerabilities in those libraries — or in the algorithms themselves — should be treated differently under the Act, especially if it is restricted from public access (Mythos Preview remains unavailable to the public).

European research institutions are also directly involved. ETH Zurich co-developed CryptanalysisBench alongside researchers from Tel Aviv University and the University of Haifa. The benchmark packages 191 cryptanalysis tasks across six primitive families — block ciphers, hash functions, stream ciphers, AEAD schemes, MACs, and public-key encryption — drawn primarily from NIST standardisation competitions. Five frontier models (Claude Opus 4.8, Sonnet 5, Mythos 5, GPT 5.5, and the open-weights GLM 5.2) already break 65–86 % of tier-1 schemes, and models are producing novel cryptanalysis, including a previously unknown key-recovery attack against the SpoC AEAD scheme.

This is an early warning for European cybersecurity agencies. ENISA, the EU Agency for Cybersecurity, already coordinates vulnerability disclosure across member states. If frontier AI models can autonomously discover flaws in the mathematical design of cryptographic primitives, the volume of findings could overwhelm the existing disclosure pipeline. Anthropic itself notes that the bottleneck has shifted: it took one week for Mythos to discover the AES attack, but a month for humans to confirm it.

What changes today — and what doesn't

Anthropic was careful to state that neither finding affects production systems. HAWK is only a NIST candidate, not deployed anywhere. The AES attack applies to a reduced-round variant — breaking the full 10-round cipher remains out of reach, and even if it were possible, the attack would cost hundreds of millions of dollars to execute under its theoretical model.

But the trajectory is clear. In the past year, language models went from being unable to perform cryptanalysis of even basic ciphers to finding weaknesses that escaped years of expert review. Anthropic followed responsible disclosure: it shared findings in advance with the US government and industry partners, coordinated with the HAWK authors in June, and released the results publicly alongside full technical papers and demonstration code.

For the rest of us — developers, companies, power users — the practical takeaway is this: AI-assisted cryptanalysis is no longer theoretical. It works, it is getting faster, and it costs roughly €90,500 per research-grade attack today. That price will keep dropping. If you maintain software that depends on cryptographic primitives, you should assume that AI models will be auditing them sooner rather than later — and the results may arrive faster than your team can verify them.