On July 28, 2026, Anthropic’s Frontier Red Team published research outlining cryptographic weaknesses discovered using an internal preview version of the Mythos model, not yet available to the public. The findings target two security algorithms: HAWK, a post-quantum digital signature scheme, and a reduced version of AES, commonly used in academic research to evaluate cryptographic robustness.

Anthropic emphasizes that these discoveries have no immediate impact on current computing systems. However, they do carry implications—albeit far less severe than some sensationalized reports suggest.

HAWK’s brief flight: a post-quantum falcon falls

HAWK was a leading candidate in the NIST’s ongoing post-quantum cryptography standardization process, aiming to complement the four algorithms selected in 2022. The scheme had successfully passed two rounds of human expert reviews over two years. Yet, this isn’t the first time a promising post-quantum algorithm has been compromised. Recall SIKE, broken in under an hour on a standard PC, or Rainbow, whose secret key could be recovered after an average of 53 hours.

The Mythos model identified a geometric symmetry in HAWK’s security foundation—the Modular Lattice Isomorphism Problem—reducing the effective key size by half. For the HAWK-256 variant, the attack complexity dropped from 2⁶⁴ to 2³⁸ operations, enabling key extraction in just 3 hours and 42 minutes on a 96-core server. This undermined HAWK’s practical viability, forcing designers to double key and signature sizes, negating its computational efficiency advantages.

Consequently, HAWK’s development team officially withdrew the algorithm from NIST’s selection process on July 29, rendering it obsolete in its current form.

While AES uses symmetric keys, the coincidence that doubling key sizes is also required for quantum resistance in symmetric algorithms like AES is noteworthy, though unrelated.

What’s really happening with AES?

AES, the widely deployed encryption standard, powers secure communications from banking to TLS. Processors from Intel and AMD include dedicated instructions to accelerate AES operations. To test AES’s resilience, researchers often use weakened versions with fewer transformation rounds. Mythos cracked one such reduced variant by eliminating a critical search step, accelerating prior best-known attacks by a factor of 200 to 800.

The innovation lies in the “Möbius Bridge,” an invariant fingerprinting technique integrated into a meet-in-the-middle attack. This approach removed an exhaustive search requiring 256 iterations, drastically reducing computation time. However, Anthropic stresses this vulnerability remains purely theoretical and confined to academic settings. The full AES standard, with three additional transformation rounds, remains secure against such attacks.

France’s ANSSI recommends 192-bit keys for symmetric algorithms aiming for post-quantum security, noting minimal performance overhead compared to 128-bit keys. AES-192 and AES-256 offer viable alternatives for organizations prioritizing long-term cryptographic resilience.

Work that sparks reflection

While these findings don’t disrupt today’s systems, they underscore broader trends. The cybersecurity community faces unprecedented pressure as AI-driven tools like Mythos uncover vulnerabilities at a pace that outstrips human verification and remediation capabilities. Firefox, Windows, and Apple systems have seen a surge in security patches, highlighting the bottleneck shift from discovery to validation.

Anthropic’s research required approximately 60 hours of autonomous computation, costing around $100,000 via their commercial API. Notably, the Mythos preview initially refused to execute tasks on the reduced AES variant, citing a lack of room for improvement in a well-established algorithm. After refining the model’s scaffolding, it rewrote its own execution framework, generating roughly a billion tokens over several days to devise the new attack method. This underscores AI’s dual role as both a powerful tool and a catalyst for rethinking traditional cryptographic assumptions.

Before publishing the results, Anthropic subjected them to rigorous peer review by two researchers over a month. This formal verification ensured mathematical rigor, eliminating potential hallucinations and validating the AI-generated equations, transformations, and complexity reductions.

The bottleneck shifts, but challenges remain

These discoveries highlight a critical imbalance: AI models can rapidly uncover weaknesses, but human experts struggle to validate findings in time. The reduced AES attack took about a week to conceptualize and a month for two researchers to verify. While AI demonstrates remarkable efficiency, human persistence remains irreplaceable. Anthropic’s work also hints at more vulnerabilities to come, with “preliminary experiments” already underway on additional algorithms.

The journey of Mythos—from initial resistance to groundbreaking insights—reflects AI’s evolving role in cryptography. It challenges the assumption that well-vetted algorithms are immune to innovation, proving that even the most established systems can benefit from fresh perspectives.