The landscape of modern cryptography is currently witnessing a seismic shift as artificial intelligence transitions from a theoretical tool to a practical engine for cryptanalysis. The recent breakthrough involving the Claude Mythos Preview model has sent ripples through the security community, demonstrating that even sophisticated lattice-based schemes—once thought to be the bedrock of post-quantum security—contain hidden vulnerabilities that an AI can sniff out through persistent iteration. By uncovering symmetries in the HAWK signature scheme and optimizing attacks on the industry-standard AES, this development marks a turning point in how we evaluate the safety margins of our digital infrastructure. As a specialist who has spent years monitoring the National Institute of Standards and Technology’s standardization processes, I find the speed at which these results were achieved both exhilarating and a sober reminder of the work that remains to be done before we can fully trust our post-quantum future.
When a hidden symmetry in a lattice allows for the construction of a τ-cocycle lattice, how does that fundamentally change the difficulty of breaking a scheme like HAWK?
The discovery of a nontrivial automorphism within the HAWK lattice is essentially like finding a secret architectural flaw in a vault that was previously assumed to be solid steel. Traditionally, direct key recovery for HAWK is viewed as an instance of the search module Lattice Isomorphism Problem, or smLIP, where an attacker has to recover a hidden transformation between two complex lattices. By exploiting this newly identified symmetry, the AI was able to construct what we call a τ-cocycle lattice directly from the public key, which effectively reduces the problem’s complexity by cutting the lattice dimension roughly in half. To see this in action, you only have to look at the numbers: the expected work factor for a HAWK-256 key recovery plummeted from 2^64 all the way down to 2^38, turning a difficult computational task into something manageable. In a practical setting, Anthropic’s implementation proved this by running an end-to-end attack on a 96-core server in just about three hours and 42 minutes. It is a visceral experience to realize that a scheme which could have protected sensitive data for years can now be unraveled in less time than it takes to watch a long movie, even if the result currently produces a functionally equivalent 592-byte decoded key rather than the original 96-byte seed.
The development process for these attacks involved an AI that initially resisted the task; what does the human-led “push” reveal about the current limitations and capabilities of AI in high-level cryptanalysis?
One of the most fascinating aspects of this research wasn’t just the final math, but the sheer stubbornness of the AI model during the early phases of the project. Initially, the Mythos Preview model actually refused to engage with the AES challenge, insisting that it was impossible to improve upon current standards—a testament to how deeply ingrained the perceived security of AES is within the data the model was trained on. It took a human researcher, who wasn’t even a specialist in lattice cryptography, providing blunt prompts and project management guidance to force the model to look past its own “conclusions.” Over the course of the research, the model generated roughly one billion output tokens and cost approximately $100,000 in API usage, showing that while the AI has the “brawn” to perform massive explorations, it still requires human intuition to steer it toward a breakthrough. Even after the AI found the path, the human bottleneck became apparent, as two researchers spent nearly a month and several hundred hours meticulously checking the method to ensure the results were actually valid and reproducible.
Could you explain the significance of the “Möbius Bridge” in the context of the seven-round AES-128 attack and why it represents such a massive jump in efficiency?
The Möbius Bridge is an incredibly clever invariant fingerprint developed by the AI that addresses a specific bottleneck in existing meet-in-the-middle attacks on reduced-round AES. In previous iterations of these attacks, researchers had to perform a 256-way guessing step to find specific values before they could even begin searching their tables, which added a significant layer of computational overhead. The Möbius Bridge effectively removes that entire enumeration step because the fingerprint it creates does not change across those guessed values, allowing the attacker to bypass the guesswork entirely. This optimization results in a staggering 200- to 800-fold speedup for the attack on seven-round AES-128, depending on exactly how you measure the runtime. However, it’s important to keep a sense of perspective here: the attack still requires about 2^105 chosen plaintexts, which is a number so vast it remains purely in the realm of academic interest rather than a real-world threat to production systems. While we aren’t seeing 24-bit keys being cracked in the wild just yet, the fact that an AI could find such a specific mathematical invariant after three days of searching is a massive signal that our safety margins are thinner than we once believed.
Following the successful attack on the HAWK-256 parameter, the HAWK team withdrew the scheme from the NIST process; was this an overreaction, or was the scheme truly compromised beyond repair?
The withdrawal of HAWK from the NIST post-quantum digital-signature process on July 29, 2026, was a decisive and necessary move, even if it felt abrupt to some observers. Once the Anthropic team confirmed that their attack approximately halves the block size required in lattice reduction to recover a secret key, the writing was on the wall for the scheme’s viability. The HAWK team themselves admitted that the possible mitigations—such as doubling the parameters to regain security or moving to higher-rank modules—would have made the scheme far too slow and bulky to remain competitive against other candidates. Even though the gate-count estimates for the larger HAWK-512 and HAWK-1024 parameters only dropped from 2^150 to 2^108 and 2^288 to 2^182 respectively, the loss of confidence was total. In the high-stakes world of NIST standardization, once an attack path is proven to be exponential but significantly faster than expected, the scheme’s standing evaporates because you can no longer guarantee its long-term resistance to future computational leaps.
What is your forecast for the future of AI-driven cryptanalysis in the next few years?
I believe we are entering an era where AI will become the primary “fuzzer” for cryptographic primitives, uncovering subtle mathematical symmetries that have eluded human eyes for decades. We are already seeing models break between 65% and 86% of easier schemes in benchmarks like CryptanalysisBench, and as these models move from Mythos 5 to even more advanced versions, the “bottleneck” of human verification will be the only thing slowing us down. My forecast is that within the next three years, we will see at least one more major NIST candidate significantly altered or withdrawn due to an AI-discovered vulnerability, and the cost of these attacks will drop from $100,000 to just a few thousand dollars as models become more specialized. Cryptographers will be forced to use AI defensively, employing models to “red team” their own algorithms during the design phase to ensure that no “Möbius Bridges” or hidden automorphisms are left for an adversary to exploit. We are no longer just fighting against human ingenuity; we are competing against a billion-token-per-week discovery engine that doesn’t sleep and doesn’t get tired of checking the same lattice a million different ways.
