Reading Anthropic's Report on Claude Finding Weaknesses in Cryptographic Algorithms
I read "Discovering cryptographic weaknesses with Claude," published by Anthropic's Frontier Red Team in July 2026. Claude Mythos Preview improved the best-known attacks on HAWK, a post-quantum signature candidate, and on a round-reduced version of AES. Here are four insights from it.
Before we start — key terms
Round-reduced — Block ciphers like AES and LEA encrypt by repeating the same computation, a round, many times. AES-128 has 10 rounds and LEA-128 has 24. To estimate how well a full cipher holds up, researchers attack versions with fewer rounds. The 7-round AES in Insight 3 and the 13-round LEA in Insight 4 are such versions, and the AES and LEA in actual use are not broken.
Post-quantum cryptography (PQC) — If quantum computers are built, today's widely used public-key schemes like RSA and ECDSA could be broken. So new schemes based on math problems that stay hard even for quantum computers are being standardized ahead of time. NIST has run this standardization for close to a decade, and HAWK in Insight 1 is one of its signature candidates.
Insight 1: Two years of review, then HAWK's key strength halved in 60 hours
Despite HAWK having survived two rounds of expert human review over a period of two years, Mythos was able to improve the best-known attack on it in just 60 hours of work—effectively cutting its key strength in half. (...) The automorphism discovered by Mythos allows a faster enumeration attack that, while still exponential, means that one needs to double the size of HAWK keys to achieve the same level of security.
The expected cost of recovering a HAWK-256 key was thought to be 2⁶⁴ and came down to 2³⁸. The flaws Mythos found earlier in cryptographic libraries were implementation mistakes; this one came out of a literature review, mathematical reasoning and repeated computational experiments. The authors state that the attack is specific to HAWK and does not affect other NIST candidates or lattice-based cryptography in general. Korea ran its own national post-quantum competition, KpqC, selecting AIMer and HAETAE for signatures and NTRU+ and SMAUG-T for key exchange in January 2025 (KpqC), and those algorithms are going through the same public review on their way to standardization.
Seeing a model find, through that kind of math, a symmetry that experts missed for two years made me think AI models have to be good at math, too, to be truly useful. Getting closer to AGI isn't only about handling text well. It also takes mathematical intelligence and logical reasoning.
Insight 2: Claude said it was impossible, then found a new attack after a few short prompts
Initially, Claude would not engage with the problem, because it claimed that it was impossible to improve cryptanalysis of AES. (...) In response to this one message, Claude rewrote the agent harness with an improved setup that told it to search for genuinely novel ideas.
The message the researcher sent was "the models tend to think it is impossible to solve so they don't try they [sic] need a good amount of prompting." Over the next three days on 7-round AES, the researcher sent just three substantive prompts: don't settle for simple attacks, don't change the target, and go for genuinely hard findings rather than low-hanging fruit. The post publishes them as written, typos included. At the end of those three days came the Möbius Bridge idea.
What got a model moving again, after it had stopped on "the most-studied block cipher in existence," was a few short sentences with typos in them. Whether it's Claude or any other AI, when it gets fixated like this, a small sentence can change how well it performs. I think that's something worth taking away.
Insight 3: A week for the model to find the AES attack, a month for people to verify it
The HAWK attack is implementable end-to-end and thus much easier to verify. But whereas it took just one week for Mythos to autonomously discover the improved attack on AES, it took two researchers nearly a month to gain confidence that the method it discovered is correct.
The attack uses a technique Mythos called a Möbius Bridge and runs 200 to 800 times faster than the previous best attack on 7-round AES. It is a chosen-plaintext attack, though, which assumes the attacker can ask for arbitrary inputs to be encrypted, and the prior work it builds on already assumes 2¹⁰⁵ chosen plaintexts, so it can't actually be run. The researchers had to check it by following the reasoning step by step, and since they weren't cryptography experts, they spent several hundred hours learning enough of the field to validate it.
The post's conclusion predicts that people won't be able to keep up with verifying the volume of results models produce. But among Mythos's own results, HAWK, which could be run end to end, was easy to verify, while AES, which couldn't, took a month. So my guess is it took that long less because of the volume and more because it was a new approach.
Insight 4: A 13-round version of Korea's standard cipher LEA, broken in under an hour on a desktop
At present, the best cryptanalysis of 13 rounds of LEA requires 2⁹⁸ plaintext pairs and 2⁸⁶ work. Mythos Preview developed a practical attack that can recover a 13-round LEA key in under 2³⁰ encrypted plaintexts, and that runs in under an hour on a modern desktop computer. Again, this attack does not apply to the 24-round cipher, and so has no immediate practical consideration.
LEA is a block cipher Korea developed in 2013. It is a Korean national standard (KS X 3246), one of the algorithms covered by Korea's cryptographic module validation program (KCMVP), and became the international standard ISO/IEC 29192-2 in 2019 (Wikipedia, Korean). The attack only works on a 13-round version, so the LEA in use today isn't at risk, and the authors plan to publish the full results after more investigation.
Still, a reduced version of a cipher listed in Korea's own validation program fell in under an hour on one desktop, and the post's conclusion says many ciphers have received less scrutiny than they deserve. Looks like cryptographic algorithms are now due for a major round of verification.
At the end, the post says that how researchers should respond if a language model finds vulnerabilities in cryptosystems with real-world impact is a question for academia, government, and industry to answer together. I don't have an answer to it either. Should we accept that perfect security no longer exists and move to zero trust, or strengthen security even if it means adding more friction? I honestly don't know yet.
