Claude Independently Derived an Attack on the Post-Quantum HAWK Signature and Sped Up the Cracking of 7-Round AES

Anthropic has published two cryptanalysis results that, by its own account, were obtained largely by the Claude Mythos Preview model itself — humans set the direction, provided the computing resources and, above all, verified the derivations.

The symmetry hidden in the HAWK lattice

HAWK is the only lattice-based scheme among the nine candidates that NIST advanced to the third round of its additional post-quantum digital signature competition in May 2026. The security-level parameter sets are HAWK-512 and HAWK-1024, while HAWK-256 exists as a “target” for cryptanalysts.

Recovering a HAWK key comes down to finding a hidden transformation between two lattices. Earlier work by Daniël van Gent and Ludo Pulles showed that a nontrivial lattice automorphism would cut the problem nearly in half in terms of dimension, but at the time this posed no threat to HAWK. According to Anthropic, Mythos Preview found the missing automorphism needed to make that approach work.

The published implementation builds a so-called τ-cobounded lattice from the public key, applies reduction and sieving, and then recovers functionally equivalent secret material for signing (a 592-byte key rather than the original 96-byte seed). The code works only with HAWK-256 and rejects any other input. The expected end-to-end recovery time is about three hours and 42 minutes on a 96-core server.

Anthropic estimates that the effort required for HAWK-256 drops from 2⁶⁴ to 2³⁸. For the larger parameters the gate-count estimates fall as well (for HAWK-1024, from 2²⁸⁸ to 2¹⁸²), but a break remains practically impossible. The attack is still exponential and does not carry over to the other candidates. The model, the company says, spent about 60 hours of work in a multi-agent environment and roughly $100,000 on API calls.

Faster, but still impractical

The second result concerns AES-128 cut down from ten rounds to seven. Studying round-reduced ciphers is standard practice: this is how the security margin is measured. The attack requires about 2¹⁰⁵ chosen plaintexts, which on its own puts it beyond any real-world use.

Mythos built an invariant “fingerprint,” which it called the “Möbius bridge”: it does not change as one of the intermediate values is enumerated, which makes it possible to remove a 256-fold enumeration from the known “meet-in-the-middle” attack. The result is a speedup of 200–800 times, depending on how it is measured.

A curious detail: at first the model refused to work, insisting that improving the attack on AES was impossible. Anthropic published the researcher’s blunt follow-up prompts — typos and all — that were used to force the model to keep searching. The “Möbius bridge” turned up after about three days and several hundred million tokens; around a billion were generated in all.

The main cost turned out to be human: two researchers spent almost a month satisfying themselves that the method was correct. It was verification, not generation, that became the bottleneck.

As of July 29, 2026, NIST still lists HAWK as a third-round candidate. The Hacker News found no independent reproduction of the attack on HAWK-256 at the time of its review.

Source: The Hacker News