Claude Discovered a Novel AES Cryptographic Attack in a Week—Then Human Experts Spent a Month Verifying the Math

When an artificial intelligence model takes seven days to devise a novel mathematical attack against a core encryption algorithm and human experts spend nearly a month just to confirm the math works, the primary bottleneck in cybersecurity shifts. Anthropic’s Claude Mythos Preview spent 60 hours and approximately $100,000 in API compute costs to halve the effective key strength of the HAWK post-quantum signature scheme—a candidate scheme that had survived two years of expert review. Yet as Claude moved on to analyze the Advanced Encryption Standard (AES), the scarce resource in security ceased to be automated discovery and became human verification.

Operating semi-autonomously using a Claude Code agentic harness with Python and Sage execution tools, Claude Mythos Preview discovered novel mathematical attacks against both HAWK and a 7-round version of AES-128. Anthropic states that Claude Mythos Preview improved the best-known attack on HAWK by identifying a previously unexploited symmetry known as a nontrivial automorphism within the lattice. This attack reduced HAWK-256 key recovery attack complexity from 2^64 to 2^38, effectively cutting its security margin in half without impacting other post-quantum algorithms or general lattice cryptography.

The workflow demonstrates how AI research tools operate at extreme scale. Before refining its findings to publication quality, Claude produced one billion tokens of output, including several hundred million tokens over a three-day stretch. While neither attack impacts production systems today—full 10-round AES-128 and 24-round LEA remain completely unbroken—the ability of language models to formulate valid mathematical cryptanalysis marks an expansion of automated research from pure mathematics into applied security.

From Model Refusal to the Mobius Bridge Breakthrough

The breakthrough against 7-round AES-128 required human intervention after the model initially refused the task. Claude insisted that improving existing research was impossible, generating output stating that “AES-128 r5/r6 is just genuinely hard” and “there is nothing easy to find; this is the most-studied block cipher in existence”. Human operators unblocked the model using three substantive prompts over three days, published verbatim with their original typos by Anthropic. Once directed past its initial refusal, Claude produced a novel meet-in-the-middle attack that Anthropic states speeds up prior best attacks by 200x to 800x.

Mythos named its AES finding the Mobius Bridge. The attack operates under a chosen plaintext threat model assuming an attacker can request 2^105 chosen plaintexts, using a fingerprinting algorithm invariant to a guess that prior literature had to enumerate over 2^56 values. Anthropic states that the attack eliminates one required guess for an attacker, reducing complexity on a 7-round version of AES-128 while leaving full 10-round AES-128 and AES-256 entirely intact.

Beyond AES and HAWK, Claude Mythos Preview generated tangible execution scripts against other ciphers. The model developed a practical key recovery attack against 13-round LEA (a cipher with 24 total rounds) requiring fewer than 2^30 ciphertexts, executing on a modern desktop computer in under an hour where prior cryptanalysis required 2^98 plaintext pairs and 2^86 work. Mythos also devised a full key recovery attack on 6-round Serpent-128 (a 32-round cipher) improving upon published work requiring 2^70 plaintext pairs and 2^90 decryptions, along with limited improvements below 10x against Salsa20, the Poseidon hash function, and SHA-1.

The Human Bottleneck and Post-Quantum Governance

The setup relied on a pair of worker agents running inside a sandboxed harness. The key insight for the HAWK attack emerged from worker disagreement: the first worker agent dismissed the approach as infeasible prematurely, while the second worker agent identified a method to exploit the lattice symmetry. The human operator possessed a background in theoretical computer science but was not an expert in lattice cryptography, highlighting how semi-autonomous agentic scaffolds amplify non-specialist oversight.

This dynamic created a severe verification delay. While Mythos needed about a week to discover the 7-round AES attack, two Anthropic researchers spent almost a month to gain confidence in the proof, investing several hundred hours learning specialized cryptography to validate the math. Anthropic writes that human researchers “may become bottlenecked on studying and validating these results”. To help the broader community measure LLM cryptanalytic progress, Anthropic partnered with academics at ETH Zurich, Tel Aviv University, and University of Haifa to release CryptanalysisBench (arXiv:2607.18538).

Late structural discoveries in cryptographic standards are a known element of the evaluation process. HAWK is currently a third-round candidate in NIST’s call for Additional Digital Signatures, part of a decade-long effort to standardize Post-Quantum Cryptography (PQC). During earlier NIST evaluations, the SIKE candidate scheme was found to be completely broken in one hour on a laptop. Anthropic responsibly disclosed the HAWK attack to its original authors in June 2026 and to the public NIST mailing list simultaneously with publication, confirming that HAWK would require doubling key sizes to maintain its targeted security level, rendering the design less attractive.

Anthropic states that it would be prudent to consider how researchers should react if a language model discovered vulnerabilities in cryptosystems where attacks do have immediate real-world impact, noting that answering this governance question requires input from academia, government, and industry. To address this, Anthropic shared advance copies with US government and industry partners and plans to host an academic workshop on AI-driven cryptanalysis.

Editorial note: This article summarizes Anthropic’s own product material, not independent reporting. Time-to-value, speed, and ROI statements reflect the publisher unless outside evidence is cited. Original post.

Analysis based on reporting by Anthropic. Original article here.