Listen to this article
Anthropic announced on July 28 that Claude Mythos Preview found mathematical weaknesses in two cryptographic algorithms. These were not coding mistakes in cryptographic libraries. They were new ways to attack the underlying math, including one weakness in a post-quantum signature candidate that had already survived two rounds of expert review.
No production system needs to change because of either result. HAWK, the signature scheme, is still a candidate in a NIST standardization process and is not deployed. The AES result applies to a deliberately reduced 7-round version of AES-128, not the full 10-round cipher used in production. That distinction is not a footnote. It is what makes this a governance warning instead of a breach report: the review process caught the findings before they could become an emergency.
This comparison concerns a research variant with 7 of AES-128's 10 rounds. It does not represent a break of full AES.
The important caveat is also the point
HAWK is designed for a future in which quantum computers can defeat signature schemes used today. NIST has been reviewing it as a third-round candidate for additional post-quantum digital signatures. Mythos found a previously unexploited symmetry in HAWK's lattice structure. That enables a faster enumeration attack and means keys would need to double in size to provide the intended security. In the small HAWK-256 example, Anthropic says the expected work for full key recovery fell from 2^64 to 2^38.
The attack remains exponential, larger HAWK keys remain impractical to attack, and the result is specific to HAWK. It does not weaken other NIST candidates or lattice cryptography generally. This is the standardization process doing its job, but with a new kind of reviewer: Mythos found the attack in about 60 hours after HAWK had received two years of expert scrutiny.
| Target | What Mythos changed | Production impact | Validation status |
|---|---|---|---|
| HAWK | Effectively cut key strength in half | None; candidate is not deployed | End-to-end implementation and coordinated disclosure |
| AES-128 | Made a 7-round research attack 200-800x faster | None; full AES-128 uses 10 rounds | Paper reviewed after hundreds of human research hours |
The AES work followed a different path. Anthropic gave Claude a scaffold for forming hypotheses, running experiments, and challenging its own ideas. Claude initially resisted the assignment, saying the most-studied block cipher had nothing easy left to find. A researcher kept the target fixed with three substantive prompts over three days. Mythos eventually invented a fingerprinting technique it called the "Mobius Bridge," then refined it across roughly one billion output tokens.
In just one year, language models have gone from being unable to perform cryptanalysis of even the most basic ciphers to being capable of finding flaws in cryptographic designs that have escaped discovery despite years of human expert review.
Discovery moved faster than verification
Autonomy did not remove people from the process. In the HAWK work, a human with a theoretical computer science background supplied project-management direction, such as how to track ideas and which verification libraries to use, rather than cryptographic guidance. The AES search was almost fully autonomous after its scaffold and prompts were in place. But Anthropic researchers then spent several hundred hours learning enough cryptography to validate the claim. Two researchers needed nearly a month to gain confidence in a discovery the model made in about a week.
That asymmetry is the governance story. A model can now produce novel technical claims faster than qualified people can check them. Cost does not solve the confidence problem either. Anthropic estimates about $100,000 in API cost for each primary result, yet compute spend is not evidence that an answer is correct, new, safe to publish, or ready to affect a standard.
Anthropic treated the output as a proposal, not an authority. It built end-to-end verification for HAWK, consulted academics, shared the attack with HAWK's authors in June, and coordinated with NIST, US government officials, and industry partners before publication. It also partnered with ETH Zurich, Tel Aviv University, and University of Haifa on CryptanalysisBench so AI cryptanalytic capability can be measured repeatedly rather than inferred from one headline.
The validation layer has to scale with the model
Anthropic had separately reported that Mythos found 10,000 critical software vulnerabilities in one month. Moving from implementation bugs to mathematical weaknesses changes the class of output an AI governance program must handle. The artifact is no longer only a suggested code change or tool call. It can be a research claim whose premature release creates security risk, whose rejection could leave a real weakness unaddressed, and whose correctness may take experts weeks to establish.
The control pattern is still recognizable. Preserve the model's claim, assumptions, experiments, and failed paths. Route it to reviewers with the right domain authority. Reproduce the result in an environment independent of the model. Assess whether disclosure itself changes risk. Separate approval to continue research from approval to notify affected parties, publish details, change a standard, or alter production systems. The model may discover the evidence. It should not decide what the evidence authorizes.
Follow-up work makes that infrastructure urgent. Anthropic says Mythos also developed a practical attack on 13-round LEA that recovers a key in under an hour on a modern desktop, while the full cipher uses 24 rounds. It reported additional attacks on reduced Serpent-128, Salsa20, Poseidon, and SHA-1. The Next Web notes that the White House's Gold Eagle program coordinates AI-powered cyber defense, but there is no equivalent effort for AI-assisted cryptographic review.
The AuthorityGate take
The central risk is not that Claude broke production encryption. It did not. The risk is that frontier models can now create consequential evidence at a speed and volume that outruns the people qualified to validate it. "Human in the loop" is inadequate if the loop has no defined evidence standard, reviewer authority, disclosure path, or decision record.
AuthorityGate's validation-layer principle applies before an AI output becomes an authorized action: verify identity and scope, test the evidence independently, calculate the risk of acting or waiting, preserve the record, and require a named human for consequential decisions. A model capable of finding what experts missed makes that separation more important, not less.
Today, the answer is reassuring: an undeployed candidate can be revised, and a reduced-round AES result can strengthen research without forcing emergency remediation. Anthropic's harder question remains open. What happens when a model finds a flaw in a cipher already protecting production systems? The organizations that can answer will be the ones that built a validation and disclosure path before the model produces the result.
Sources
Go deeper
Every agent action, validated before it takes effect
AuthorityGate's newsletter breaks down real AI incidents and the governance failures behind them. Our configurable 8-gate validation model is how organizations keep a named human accountable for what their AI actually does.