Anthropic AI Model Finds Flaw in Post-Quantum Algorithm, Developer Withdraws It From NIST Contest

An AI Found What Years of Human Review Missed

Anthropic announced Monday, July 27, that an unreleased version of its AI model, called Claude Mythos Preview, discovered a previously unknown mathematical weakness in HAWK, a digital signature algorithm competing to become an official U.S. post-quantum cryptography standard, according to Ars Technica and Decrypt.

HAWK's developer withdrew it from the National Institute of Standards and Technology's standardization process on Tuesday, one day after Anthropic published the results.

HAWK had already survived two rounds of NIST's post-quantum cryptography competition and was the last lattice-based candidate standing in the third round, according to Decrypt. It's now dead.

The Math, in Plain English

HAWK's security rests on something called the Lattice Isomorphism Problem, a mathematical puzzle believed to be hard even for quantum computers to solve. According to CyberScoop, Claude Mythos Preview, working with a human researcher, found a mathematical shortcut known as a "nontrivial automorphism" buried in HAWK's lattice structure. No human researcher had spotted it.

The practical effect: the cost of recovering a secret key on HAWK's smallest configuration dropped from 2^64 operations to 2^38, a reduction Decrypt calculated at roughly 67 million times less work. Cut that way, HAWK's effective key strength was sliced in half.

Fixing it would mean doubling HAWK's key sizes. Anthropic wrote in its post that doing so "eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate," according to Decrypt. Compact keys and fast signing were HAWK's whole selling point. Double the keys, and you've lost the pitch.

Ars Technica reported that an Anthropic researcher with no cryptography background prompted the Mythos model to improve the best-known existing attack on HAWK, and the whole exercise took about 60 hours and roughly $100,000 in compute.

A Second Attack, on AES

Anthropic also said Mythos found a new attack against a deliberately weakened, seven-round version of AES, the encryption standard NIST adopted in 2001 and the backbone of HTTPS traffic and encrypted drives worldwide, according to CyberScoop.

Working largely on its own, the model invented a shortcut CyberScoop reported was dubbed the "Möbius Bridge," eliminating a lookup process that previous theoretical attacks depended on. Combined with other tweaks, CyberScoop said this made the strongest known theoretical attack against seven-round AES somewhere between 200 and 800 times faster.

That sounds alarming until you read the fine print. Full AES-128 runs through 10 rounds, not seven, and the attack Decrypt described requires over 400 octillion messages of target data, an amount that doesn't exist and isn't coming into existence. Even the model itself pushed back on being oversold: Decrypt published a transcript in which Claude told researchers, "On AES-128 r5/r6/r7 it found nothing because there's nothing easy to find; this is the most-studied block cipher in existence."

The Caveats Matter

None of this touches anything currently protecting your bank account, your email, or your Bitcoin wallet. HAWK was never deployed anywhere in production, according to Decrypt, and Bitcoin still runs on ECDSA, an entirely different, pre-quantum signature scheme.

Both challenge problems the AI attacked were deliberately weakened versions of the real specifications, provided specifically for adversarial testing, not the production-strength systems anyone actually relies on, according to Ars Technica.

Anthropic said it disclosed both findings to the algorithm authors and to U.S. government and industry partners before publishing, and coordinated the HAWK result directly with NIST, according to Decrypt.

Who's Cheering, and Why That's Worth Watching

Ellen Boehm, senior vice president of strategy and AI innovation at Keyfactor, a digital identity and cryptography management company, told CyberScoop that research like this "proves that the NIST PQC evaluation process is working." She's not wrong that catching a flaw before deployment beats catching it after. She also has a business incentive: Keyfactor sells cryptography-readiness tools, and she told CyberScoop the finding "elevates the importance" for companies to know where their cryptography lives and to build a post-quantum transition plan. Her assessment is directionally sound, but it's also a sales pitch.

Ars Technica raised the fair skeptical point directly: "it's hard to know how much of the company's reporting is marketing hype." Anthropic is a commercial AI lab announcing that its own restricted-access model just outperformed years of human cryptanalysis. That's a genuinely notable technical result and also, unmistakably, a marketing moment for a company competing against OpenAI and others to prove its models are the sharpest tools in the shed.

Mythos remains unavailable to the public, limited to what Anthropic calls a select group of trusted users, according to Ars Technica. NIST's post-quantum signature competition continues with