AI research firm **Anthropic** has revealed that its **Claude Mythos Preview** AI system has identified notable vulnerabilities in cryptographic schemes. The AI successfully derived an end-to-end key-recovery attack against **HAWK-256** and achieved a 200- to 800-fold speedup for an attack on seven-round **AES-128**. Anthropic emphasized that neither result affects production systems. **HAWK** remains a candidate in the **National Institute of Standards and Technology (NIST)** post-quantum standardization process, and the public recovery code specifically targets the smaller **HAWK-256** parameter, not the more robust security-level versions. Similarly, the **Advanced Encryption Standard (AES)** result applies to only seven of **AES-128**'s ten rounds and still necessitates an impractical number of chosen plaintexts, making real-world exploitation infeasible. Anthropic published its findings, accompanied by two technical papers and reproducibility artifacts. The company stated that **Mythos Preview** largely conducted the research autonomously, with human researchers providing only project direction, computing resources, and extensive verification.  ## Unearthing Symmetry in HAWK's Lattice **HAWK** is a lattice-based scheme, one of nine candidates advanced by **NIST** to the third round of its post-quantum digital-signature process. While **HAWK-512** and **HAWK-1024** are **NIST** security-level parameter sets, **HAWK-256** serves as a cryptanalytic challenge target. Direct **HAWK** key recovery involves solving an instance of the search module Lattice Isomorphism Problem (smLIP), where an attacker aims to uncover a hidden transformation between two lattices. Previous research by **Daniël van Gent** and **Ludo Pulles** demonstrated that a non-trivial automorphism (a symmetry preserving the lattice) could reduce **HAWK** key recovery to finding a short vector in a lattice of roughly half the original dimension. While their work opened the attack path, they noted it did not then affect **HAWK**. **Anthropic** claims that **Mythos Preview** independently discovered the additional automorphism required to exploit this path. The resulting **HAWK-n attack** constructs a τ-cocycle lattice from the public key, then uses lattice reduction and sieving to recover short vectors, ultimately reconstructing a secret basis capable of signing messages for the original public key. **Anthropic**'s released implementation verifies the recovered key by signing a message and checking it against the **NIST** reference implementation. It produces a 592-byte decoded key containing functionally equivalent signing material, rather than the original 96-byte secret-key seed. This code specifically supports **HAWK-256** and rejects other inputs. **Anthropic** estimates that the expected **HAWK-256** key-recovery work factor decreases from 2^64 to 2^38. For **HAWK-512** and **HAWK-1024**, gate-count estimates fall from 2^150 to 2^108 and 2^288 to 2^182, respectively. Despite these reductions, both larger parameters remain impractical to attack. At the time of this report, it is unclear whether **NIST** or the **HAWK** submitters will alter the scheme's parameters, security claims, or standing in the standardization process due to these revised estimates. The attack remains exponential and is not a polynomial-time break of **HAWK**, nor does it extend to other **NIST** signature candidates or lattice cryptography generally. **Anthropic** reported that **Mythos Preview** developed and verified the result over approximately 60 hours in a multi-agent environment, with a human researcher providing only high-level guidance. The estimated API cost for the model's work was about $100,000. ## Faster, Yet Still Impractical AES-128 Attack The second finding targets **AES-128** reduced from ten rounds to seven. Analyzing reduced-round ciphers is a standard cryptanalytic practice to gauge the safety margin before an attack can impact the full construction. This attack assumes an adversary can obtain approximately 2^105 chosen plaintexts encrypted under a single, fixed, unknown key—a requirement that places it far outside the realm of practical, real-world use. Previous meet-in-the-middle attacks typically trade memory for computation by storing intermediate cipher states and matching calculations from opposite ends of the cipher. A prior attack on seven-round **AES-128** necessitated testing 2^56 possible values before searching a table. **Mythos** developed an invariant fingerprint, dubbed the **Möbius Bridge**, which remains constant across the guessed value. This innovation eliminates the 2^56-way enumeration step. After accounting for transformation costs and other optimizations, **Anthropic** estimates the seven-round **AES-128** attack to be 200 to 800 times faster, depending on the measurement metric. The accompanying **AES paper** details the mathematical construction, while a released artifact provides code for the cited experiments. **Anthropic**'s code performs complete black-box key recovery against a smaller, **AES**-like cipher with a 24-bit key. For real seven-round **AES-128**, it measures individual table entries and online candidates, projecting these measurements to the complete attack rather than executing the full recovery end-to-end. The practical implications are limited: the full **HAWK** recovery targets **HAWK-256**, a challenge parameter, not the secure **NIST** parameters. For seven-round **AES-128**, the projected attack remains infeasible at realistic scales. Interestingly, **Anthropic** noted that the model initially resisted the task, insisting that improving on **AES** was impossible. Researchers had to provide blunt, persistent prompts to encourage the model to continue its search. **Mythos Preview** discovered the **Möbius Bridge** after approximately three days and several hundred million output tokens, refining the method over subsequent days, ultimately generating around one billion output tokens. While the model run cost approximately $100,000 in API usage, human researchers spent several hundred hours verifying the method, taking nearly a month to achieve confidence in its correctness, highlighting verification as the primary bottleneck. These disclosures follow the July 20 release of **CryptanalysisBench**, a 191-task benchmark developed by researchers from **ETH Zurich**, **Anthropic**, the **University of Haifa**, **Technische Universität Berlin**, and **Tel Aviv University**. This benchmark evaluated **Mythos 5**, an updated version of **Mythos Preview**, which broke between 65% and 86% of its easier first-tier schemes and six to 12 full-strength schemes in its second tier. As of July 29, 2026, **NIST** continues to list **HAWK** as a third-round candidate. **Anthropic**'s **NIST**-forum announcement thanked the **HAWK** team for their assistance in verifying the results and providing feedback, though the specifics of their involvement were not detailed.