Anthropic's Claude Mythos AI Model Discovers Vulnerabilities in Post-Quantum Cryptography and AES Encryption

Jul 28, 2026

Anthropic's unreleased Claude Mythos Preview AI model has discovered significant mathematical vulnerabilities in cryptographic algorithms, marking a major shift from finding simple coding bugs to exposing flaws in underlying mathematics. The model halved the security margin of the HAWK post-quantum signature candidate, prompting its developers to withdraw it from the NIST standardization process on July 29, 2026. Mythos also developed the 'Möbius Bridge' attack, speeding up theoretical attacks on a seven-round version of AES by 200 to 800 times. While current production systems remain secure, the findings highlight how frontier AI could challenge core internet security assumptions.

Claude Mythos cryptanalysis discoveries

▪Anthropic's unreleased Claude Mythos Preview AI model discovered improved mathematical attacks against the HAWK post-quantum digital signature candidate and a reduced-round version of the Advanced Encryption Standard.
▪Claude Mythos Preview identified smaller cryptanalytic improvements involving Salsa20, the Poseidon hash function, and SHA-1, as well as attacks against reduced-round versions of the Lightweight Encryption Algorithm and Serpent-128.

HAWK post-quantum signature vulnerability

▪Following the discovery of the vulnerability, the HAWK development team withdrew the algorithm from the National Institute of Standards and Technology post-quantum signature standardization process on July 29, 2026.
▪The mathematical attack developed by Claude Mythos Preview reduced the expected cost of recovering a HAWK-256 key from 2^64 operations to 2^38 operations.
▪Claude Mythos Preview discovered a previously unexploited mathematical symmetry within HAWK's underlying lattice structure, reducing HAWK's effective key strength in half.

AES reduced-round attack improvement

▪The Möbius Bridge attack eliminates a 256-way guessing step from previous meet-in-the-middle attacks, making the theoretical attack against seven-round AES 200 to 800 times faster.
▪The seven-round AES attack remains purely theoretical and impractical for real-world use because it requires an adversary to obtain approximately 2^105 chosen plaintext encryptions.
▪Claude Mythos Preview developed a new fingerprinting method called "Möbius Bridge" that targets a seven-round research version of the AES-128 algorithm.

AI-assisted cryptography research methodology

▪The HAWK attack was developed by Claude Mythos Preview over approximately 60 hours in a multi-agent environment, costing roughly $100,000 in API usage.
▪Claude Mythos Preview initially refused to work on the AES cryptanalysis task, stating that further improvements were impossible, before being prompted by researchers to seek novel ideas.

Responsible disclosure validation process

▪Anthropic shared its cryptographic findings with the United States government, industry partners, and the authors of the HAWK algorithm prior to public disclosure.
▪Two Anthropic human researchers spent nearly a month and several hundred hours verifying the mathematical correctness of the AES attack developed by Claude Mythos Preview.

CryptanalysisBench benchmark release

▪Anthropic partnered with researchers from ETH Zurich, Tel Aviv University, and the University of Haifa to create CryptanalysisBench, a benchmark designed to evaluate language models against cryptographic challenges.
▪On the CryptanalysisBench benchmark, the Mythos 5 model successfully broke 85.7% of the tasks with known solutions, compared to 65.3% for the weakest model tested.