Anthropic Claude Mythos Preview Finds Mathematical Flaws in HAWK and AES-128 Algorithms

Anthropic’s Claude Mythos Preview model has autonomously discovered mathematical flaws in two major cryptographic algorithms, HAWK and 7-round AES-128, during separate automated research projects that each cost approximately $100,000 in API compute. The findings, which halved the key strength of the HAWK post-quantum signature candidate and accelerated attacks on reduced-round AES by up to 800x, have been published with proof-of-concept code on GitHub.

The Cryptanalysis Research Runs and Human Verification

Anthropic performed separate automated cryptanalysis projects utilizing its Claude Mythos Preview model, incurring roughly $100,000 in API compute costs for each discovery (bringing the total compute cost to approximately $200,000). Historically, AI-driven security tools targeted implementation-level software vulnerabilities like buffer overflows, side-channel leaks, or validation errors. These research runs mark a shift toward identifying theoretical mathematical flaws within the design of core cryptographic algorithms.

The model completed the core discovery work for the HAWK key-recovery attack in 60 hours of multi-agent execution. In contrast, the AES-128 attack took about a week to complete, which included three days of active token generation. Following these automated runs, human researchers spent nearly a month manually reviewing and validating the resulting mathematical proofs. The discovered vulnerabilities do not break current production systems, but they demonstrate the model’s ability to identify fundamental algebraic properties missed during human standardization reviews.

Halving the Security Claims of the HAWK Signature Scheme

HAWK is a lattice-based digital signature scheme submitted to the National Institute of Standards and Technology (NIST) standardization call for post-quantum signatures. Its core security relies on the mathematical difficulty of the Search Module Lattice Isomorphism Problem (smLIP). Although the algorithm had already passed two years of peer review by human experts, Claude Mythos identified an unexploited lattice symmetry within HAWK.

This vulnerability builds on theoretical work by researchers van Gent and Pulles. They previously demonstrated that a nontrivial automorphism in HAWK’s lattice would reduce key recovery to locating a short vector in roughly half the original dimension. The model identified this specific automorphism and constructed a $\tau$-cocycle lattice from a target public key.

Using lattice reduction and sieving techniques, the model extracted short vectors to compile a 592-byte functionally equivalent signing key. This process completely bypasses the requirement to recover the original 96-byte secret seed.

According to the published findings, the work factors and gate-count security claims for all major HAWK variants were degraded:

• HAWK-256: The key recovery work factor fell from $2^64$ to $2^38$. The published proof-of-concept code successfully recovers a HAWK-256 key in 3 hours and 42 minutes on a 96-core server.
• HAWK-512: Gate-count security claims dropped from $2^150$ to $2^108$ under the paper’s gate-count model.
• HAWK-1024: Gate-count security claims fell from $2^288$ to $2^182$ under the paper’s gate-count model.

While HAWK-512 remains computationally secure against immediate practical extraction, doubling the key size to compensate for the vulnerability would remove HAWK’s primary advantage, which is its lightweight signature and key footprints.

Accelerating Reduced-Round AES-128 via the Möbius Bridge

The Advanced Encryption Standard (AES-128) utilizes 10 rounds of substitution-permutation operations. Cryptanalysts routinely evaluate reduced-round variants, such as 7-round AES-128, under chosen-plaintext models with $2^105$ plaintexts to test theoretical security margins. Traditional meet-in-the-middle (MitM) attacks trade memory for speed by precomputing lookups, but still require an attacker to guess and test 256 candidate values before querying the lookup table.

Claude Mythos designed a custom mathematical fingerprinting transform called the Möbius Bridge to optimize this process. Because this transform remains invariant across all 256 potential guesses, the attack completely bypasses the guessing stage. Combined with minor runtime optimizations generated by the model, the technique speeds up the attack on 7-round AES-128 by 200x to 800x compared to previously published academic literature.

The model initially resisted analyzing the block cipher, outputting logs indicating that because AES-128 was highly studied, nothing easy would be found.

“AES-128 r5/r6/r7 found nothing because there’s nothing easy to find; this is the most-studied block cipher in existence.”

Human supervisors prompted the agent harness to look past obvious vulnerabilities and target novel mathematical transforms instead. Over a three-day period of active token generation yielding approximately 1 billion output tokens, the model developed, mathematically validated, and compiled Python and Rust verification code for the Möbius Bridge.

The Multi-Agent Harness Architecture

Anthropic conducted the research using a multi-agent harness similar to Claude Code. The system ran worker agents within sandboxed computing environments. The agents had direct access to standard tools, including Python, SageMath, and published academic cryptanalysis literature.

During the HAWK analysis, the agents demonstrated peer review and self-correction. One worker agent initially abandoned a potential attack vector, declaring it mathematically infeasible. A second worker agent analyzed the first agent’s execution logs, identified a logical bypass to the roadblock, and collaborated with the first agent to finish building the exploit code.

Verification Bottlenecks and Accelerated Attacks on Other Ciphers

The research runs also exposed a shifting dynamic in cryptographic verification. While the model completed the HAWK key-recovery attack in 60 hours and the AES-128 attack in about a week, human computer scientists and auditors required nearly a month to manually verify the resulting mathematical proofs. This indicates that human-led verification, rather than vulnerability discovery, has become the primary bottleneck in contemporary cryptanalysis.

Additionally, the researchers observed rapid degradation in other ciphers with thin security margins. The testing suite successfully executed a 13-round recovery attack on the LEA cipher in less than one hour, alongside attacks on Serpent-128. These outcomes suggest that automated, multi-agent cryptanalysis can rapidly erode the safety margins of post-quantum and classical candidates alike.

GitHub Proof-of-Concept Code and Parameters

Anthropic has published the C, Python, and Rust verification harnesses on GitHub under the repository anthropics/cryptography-research-demo. The public repository is structured to prevent misuse, restricting key recovery capabilities strictly to the HAWK-256 challenge parameters, reduced-round variants of AES, and a third component focusing on the 13-round recovery attack on the LEA algorithm.

To test the HAWK-256 key recovery implementation locally, users can run the following commands:

git clone https://github.com/anthropics/cryptography-research-demo.git
cd cryptography-research-demo/HAWK
make
./hawk_attack --pubkey samples/hawk256_pk.bin