Anthropic published two cryptanalysis results on July 28 that its restricted Claude Mythos Preview model produced, and the gap between what they actually show and how they are being reported is wide enough to matter. One result is genuinely significant and probably ends a NIST post-quantum candidate's competitive case. The other is an incremental speedup against a deliberately weakened research cipher, and it is the one carrying most of the "AI cracked encryption" headlines.

The real finding is in HAWK, a lattice-based digital signature scheme still under review in NIST's post-quantum selection process. Claude Mythos Preview identified a nontrivial automorphism in the lattice HAWK uses, which lets an attacker enumerate candidate keys far faster than the previous best approach. For the smallest parameter set, HAWK-256, that drops the expected attack cost from about 2^64 operations to about 2^38. Anthropic frames it as halving effective key strength. The work took roughly 60 hours and around $100,000 in API spend, and the company describes it as semi-autonomous, with occasional human guidance and nontechnical direction rather than a mathematician steering each step.

RelatedOne Open API Exposed 676,000 Eicher Trucks to Takeover

What Claude Mythos attacked versus what is actually deployed Both targets are research artifacts: HAWK is an undeployed NIST candidate, and the AES result hits a 7-round variant. Deployed AES, standardized post-quantum algorithms and TLS are unaffected. ATTACKED DEPLOYED AND UNAFFECTED HAWK-256AES-128, 7 of 10 rounds NIST candidate, never shipped anywherereduced-round research variant only AES-128 and AES-256, full roundsML-KEM and ML-DSA (standardized)TLS 1.3 in every browserLattice cryptography generally no change requirednot implicated by either resultno change requiredno broad weakness demonstrated Neither result touches a cipher protecting live traffic. The HAWK finding is about a standards candidate's future, not a system anyone has to patch today. genztech.blog
Fig 1 Both targets sit on the research side of the line. HAWK has never been deployed, and the AES work stops at 7 of the 10 rounds the real cipher uses.

Why is the AES headline misleading?

The second result is a new fingerprinting technique the model named the Möbius Bridge, which improves meet-in-the-middle attacks against 7-round AES-128. Anthropic says it runs between 200 and 800 times faster than the previous best known attack, and that Claude produced it almost entirely on its own inside a researcher-built scaffold, burning several hundred million tokens across three focused prompts over three days and about a billion output tokens in total. There is a good story in there about persistence: the model initially argued the task was impossible, writing that "AES-128 r5/r6 is just genuinely hard" and that the target would have to change.

What the speedup does not do is threaten AES. Cryptographer Matthew Green, who published an independent read on July 29, points out the attack still needs roughly 2^89 cipher operations and 2^105 chosen plaintexts. Both numbers put it far outside anything physically achievable, and comparable 7-round results date back to 2013, which makes this a modest constant-factor improvement on an already impractical attack. Real AES-128 runs 10 rounds. AES-256 runs 14.

Expected attack cost, measured as log2 of operations HAWK-256 falls from 2 to the 64 down to 2 to the 38 after the Mythos finding. The 7-round AES attack still needs 2 to the 89 operations, and full AES-128 remains at 2 to the 128. HAWK-256, beforeHAWK-256, afterAES-128, 7 roundsAES-128, full 2^642^382^892^128 Bar length is proportional to the log2 exponent, not to the operation count itself. The gap between 2^38 and 2^89 is roughly a thousand trillion times. genztech.blog
Fig 2 · benchmark Only the orange bar represents a meaningful move. HAWK-256 dropping to 2^38 is inside the range where hardware and patience start to matter; 2^89 is not.
 HAWK resultAES result
Target statusNIST candidate under reviewReduced-round research variant
What changed2^64 to 2^38 for HAWK-256200x to 800x faster attack
Still costs2^38 operations2^89 ops, 2^105 chosen plaintexts
Model autonomySemi-autonomous, ~60 hoursAlmost fully autonomous, 3 days
Novel mathematicsNo, existing tools applied wellNew fingerprinting technique
Practical impactLikely fatal to HAWK's pitchNone on deployed systems

Who actually verified any of this?

This is the part worth dwelling on, because it is where the story stops being about cryptography and starts being about how research gets checked. Anthropic worked with ETH Zurich, Tel Aviv University and TU Berlin, who co-developed a benchmark called CryptanalysisBench. Researchers spent several hundred hours validating the AES claims. HAWK was easier to confirm because the finding came with an end-to-end implementation that either recovers keys or does not. The HAWK authors were told in June, ahead of publication, and Anthropic says it coordinated with US government and industry partners.

Green's sharpest observation is that verification is now the bottleneck. A model that can generate a billion tokens of plausible-looking cryptanalysis can also generate results that look real and are quietly wrong, and separating the two still takes expert humans and hundreds of hours. That cost does not scale the way generation does. If AI-assisted cryptanalysis submissions multiply from here, the field's review capacity becomes the constraint on progress, not the ideas.

What does this do to the post-quantum standards process?

HAWK's entire argument was efficiency. It offered smaller signatures and faster operations than the alternatives already standardized, and that tradeoff was the reason to consider it at all. Green notes the new attack could in principle be fixed by doubling key sizes, which is exactly the move that erases the advantage HAWK was competing on. A scheme that has to give up its selling point to stay secure has a hard time surviving a selection process, even without anything approaching a practical break.

What is embarrassing for the field, in Green's framing, is that none of the ingredients were exotic. The automorphism was findable with existing tools by someone thorough enough to look, which is a fair description of what these models are good at. Two years of human review did not surface it. Sixty hours of machine attention did.

RelatedMicrosoft's First Cyber Model Cuts Its Own AI Bill in Half

  1. June 2026HAWK authors privately notified Responsible disclosure ahead of publication, alongside government and industry coordination.
  2. Jul 28, 2026Anthropic publishes both results HAWK lattice automorphism and the Möbius Bridge technique for 7-round AES-128.
  3. Jul 29, 2026Independent assessment lands Matthew Green separates the meaningful HAWK finding from the impractical AES speedup.
  4. Next NIST roundHAWK's case gets reweighed A parameter increase to restore margin would cost the efficiency HAWK competes on.

What should a security team do on Monday?

Nothing, in patching terms, and that is worth stating plainly because the coverage implies otherwise. There is no CVE here, no vendor advisory, no configuration to change. HAWK is not in your stack. Your TLS termination still uses full-round AES with hardware acceleration, and the standardized post-quantum algorithms, ML-KEM and ML-DSA, are not implicated by either finding.

The thing to actually absorb is a shift in where cryptographic risk gets discovered. If a frontier model plus $100,000 of inference can surface a lattice symmetry that survived two years of expert review, the assumption that an unbroken scheme is a well-reviewed scheme gets weaker. That argues for conservative parameter choices and for algorithm agility in anything you are designing now, not for panic about what is already running.

What to watch · late 2026
  • Whether HAWK survives. A parameter bump restores security and destroys the efficiency case. Watch for the authors to argue the automorphism is narrower than claimed.
  • Verification capacity. If more AI-generated cryptanalysis arrives, expect the community to formalize validation requirements before anyone reviews a submission.
  • Whether the technique generalizes. The interesting question is not HAWK. It is whether the same automorphism hunt finds anything in schemes that are already standardized.
  • Restricted-model access. Mythos remains gated. How Anthropic handles dual-use cryptanalysis capability is a policy question that has not been settled.

Our take

Strip out the headlines and this is a good result reported badly. The HAWK finding deserves attention on its own terms: it is the first case we can point to where a model's thoroughness, not its cleverness, produced a cryptanalytic advance that credentialed humans had missed, and it did so in days against a scheme that had absorbed years of scrutiny. That is a real capability claim, and Anthropic supported it with an implementation and outside collaborators rather than a benchmark number.

The AES framing is the problem. Publishing a 200x speedup on an attack that needs 2^105 chosen plaintexts, in the same post as a legitimate finding, guarantees the two get blended into "AI broke encryption." They did not. If anything, the pairing undercuts the stronger result. Anthropic's earlier gated rollout of Mythos to 150 organizations was justified partly on capability like this, and the honest version of the case is narrower and more interesting than the one that traveled.

Primary sources

Original analysis by GenZTech, based on Anthropic's published research and Matthew Green's independent review. Attack costs and parameter details current as of July 30, 2026.