Sixty Hours: AI Cryptanalysis Came for HAWK, and the Buried Result Matters More

Anthropic’s disclosure on 28 July says two things loudly and one thing quietly. The loud parts: a model called Claude Mythos Preview halved the effective key strength of HAWK, a post-quantum signature candidate, and sped up an attack on seven-round AES-128 by a factor of 200 to 800. Neither touches a production system, and both were said so plainly that most coverage stopped there.

The quiet part sits under a heading called “Further work”, and it is the one I read twice. A 13-round attack on LEA that recovers a key in under an hour on an ordinary desktop.

What was actually found

HAWK is one of the third-round candidates in NIST’s call for additional digital signatures. Its security rests on the Lattice Isomorphism Problem: recover a hidden transformation between two lattices and you recover the key. A 2025 paper by van Gent and Pulles proved that a nontrivial automorphism, a symmetry preserving the lattice, would collapse the problem to roughly half the dimension. What it could not say was whether such a symmetry existed in the lattice HAWK actually uses.

Mythos found one. That is the whole result, and it is a real one. HAWK had survived two years and two rounds of expert human review.

HAWK is not broken. It may still be finished.

This is the distinction most of the coverage missed, and it matters more than the numbers.

The attack is exponential. It is not a polynomial-time break, it does not generalise to other NIST candidates, and it does not touch lattice cryptography as a family. HAWK-1024 at an estimated 2^182 gates remains comfortably out of reach. If your only question is “can someone forge a HAWK signature tomorrow”, the answer is no.

But that was never the question a standardisation process asks. The question is whether a scheme still earns its place. HAWK’s appeal was never raw security margin; it was that it delivered lattice-based signatures with attractive sizes and speed, avoiding the awkward floating-point Gaussian sampling that makes Falcon painful to implement safely. Compactness was the pitch.

Anthropic’s own summary makes the consequence explicit: you now need to double HAWK’s key size to restore the intended security level, and doing that eliminates much of what made the scheme attractive in the first place. A signature scheme whose whole argument is “smaller and faster” does not survive being told to double its keys. It becomes a scheme with ML-DSA’s footprint and less scrutiny behind it.

So the interesting outcome is not a break. It is a candidate quietly losing its reason to exist, three rounds into a decade-long process. That has happened before, and the process is designed to let it happen: SIKE was cracked on a laptop in an hour late in the previous competition. What is new is the reviewer. If you are tracking which primitives to build on, this belongs alongside the finalised NIST standards rather than in the news pile.

The AES result measures margin, not risk

The second finding attacks AES-128 reduced from ten rounds to seven, in a chosen-plaintext model requiring roughly 2^105 chosen plaintexts under a single fixed key. That is not an attack anyone will ever mount. It is a measurement.

Reduced-round cryptanalysis is how the field tracks safety margin. Prior meet-in-the-middle attacks trade memory for time by precomputing intermediate states and matching from both ends of the cipher. One stage of the previous best attack had to enumerate 256 candidate values before each table lookup. Mythos built a fingerprint it named the Mobius Bridge that stays invariant across that guess, deleting the enumeration outright. The transform costs more to compute, so the net gain lands between 200 and 800 times depending on how you measure.

What that buys you is a slightly better view of how much room AES-128 has left. Seven of ten rounds, still astronomically expensive. AES is fine. Nothing in your stack changes.

The result that should worry you is LEA

Buried under “Further work” is the finding with the shortest path to real consequences.

LEA is a lightweight block cipher standardised in ISO/IEC 29192-2:2019 and deployed in constrained environments. The full cipher has 24 rounds. The best published cryptanalysis of 13 rounds needed roughly 2^98 plaintext pairs and 2^86 work. Mythos produced a 13-round attack requiring under 2^30 plaintexts that runs to completion in under an hour on a modern desktop.

That is not a paper attack. It runs.

The margin is still large. Thirteen of 24 rounds leaves plenty of headroom, and Anthropic is explicit that the full cipher is untouched. But note what changed: the gap between the published state of the art and what a model found in a few days, on a cipher that is standardised and shipping, is enormous. LEA got a fraction of the scrutiny AES has had. So did Serpent, where a practical six-round key recovery also fell out. So did Poseidon, the hash sitting inside a great many zero-knowledge circuits, where Anthropic reports smaller gains for now.

That is the actual thesis of the disclosure, and Anthropic states it: the long tail of ciphers protecting real systems has received far less review than it deserves, and that tail is now searchable. If you build on consensus and signature families assembled from lightweight or specialty primitives, this is the paragraph to read.

Verification became the bottleneck

The timings are the most quietly radical part of the whole thing.

HAWK took about 60 hours of model work and around $100,000 in API cost, with a human operator who was not a lattice specialist providing project management rather than mathematics. The AES result took roughly a week and about a billion output tokens, after the model initially refused the task on the grounds that improving on AES was impossible and had to be argued out of that position with three blunt prompts.

Then two researchers spent close to a month convincing themselves the AES method was correct.

Notice which of the two was easy to check. The HAWK attack is implementable end to end: generate a key, run the attack, sign a message, verify it against the reference implementation. It either works or it does not. The AES attack is projected to full scale from component measurements, and that projection is what consumed a month of human attention.

That asymmetry is the practical lesson for anyone reviewing this class of work. A runnable artifact is worth an enormous amount, because it converts a claim into an experiment. A projection, however careful, still has to be read line by line by someone qualified, and that someone is now the scarce resource.

The results, sorted by how much you should care

The headline named HAWK and AES. The rows worth watching are the second and third.

What actually changes

Not your TLS configuration. Not your migration plan. The two clocks driving post-quantum timelines are regulation and data shelf life, and neither moved this week.

Three things did change, and they are all about process.

Candidate selection now has a faster adversary than it was designed for. NIST’s model assumes years of distributed human review will surface flaws before deployment. That model still works, as HAWK demonstrates, but the review clock and the standardisation clock have decoupled. A candidate can now be materially reassessed in the interval between rounds.

Reproducibility artifacts become the unit of trust. Anthropic released papers, code and test vectors. That is why the HAWK result was credible within days and the AES result took a month. Any future disclosure in this genre should be judged first on whether it runs.

And the case for crypto-agility gets stronger, for a reason that has nothing to do with quantum computers. The risk is no longer only that a distant machine breaks your algorithm. It is that a cipher you picked five years ago, which nobody has seriously examined since, gets examined thoroughly next quarter. Being able to swap a primitive without re-architecting is now a hedge against review velocity, not just against qubits.

What I am watching

Whether the HAWK team or NIST revise the parameter sets, the security claims, or the scheme’s standing. At the time of writing the public forum thread had no replies and HAWK was still listed as a third-round candidate. That silence will not last.

Whether anyone reproduces the HAWK-256 recovery independently. The code is public, the parameter is small, and this should take a competent lattice group very little time. If a week passes without a reproduction, that says something about the field’s capacity, not about the result.

And whether the LEA and Serpent findings get full write-ups. Those are the ones aimed at ciphers people actually ship.

Primary sources: Anthropic’s research post, the HAWK paper, the AES paper, and CryptanalysisBench.