Anthropic Mythos Finds Crypto Flaws Without Real-World Impact

Anthropic researchers used Claude Mythos Preview to attack two cryptographic test targets, but neither finding affects software currently in use.

CyberScoop reported that the experiments covered HAWK, a post-quantum signature candidate, and a reduced version of AES.

The result shows an AI system contributing to cryptanalysis without establishing an immediate threat to deployed encryption.

HAWK Finding Tests A Post-Quantum Candidate

The HAWK weakness sits inside a scheme being reviewed by the National Institute of Standards and Technology for encryption that could withstand future quantum-computing attacks.

Working with a human researcher, Claude Mythos found a nontrivial automorphism in the lattice structure that underpins HAWK's security.

The Anthropic paper stated that the shortcut reduces HAWK's effective key strength by half.

Keeping the same security level would require key sizes to double, and this change would remove much of HAWK's appeal as a candidate.

NIST evaluation is designed to expose weaknesses before standards and procurement paths harden.

In Boehm's CyberScoop interview, the research became evidence that the NIST evaluation process is working and that enterprises need maps of where cryptography sits across their business systems.

Reduced AES Test Shows A Faster Theoretical Attack

The second result involved the Advanced Encryption Standard.

NIST adopted AES in 2001, and the cipher is widely used to protect data in transit.

Mythos worked largely on its own and produced a mathematical shortcut called the Möbius Bridge.

Anthropic said real-world AES uses 10 rounds.

The same paper stated that the research target was a simplified seven-round version used to study security margins.

The previous theoretical path required codebreakers to check 256 separate values against a memory table; Mythos eliminated that lookup process.

The Anthropic paper reported that the seven-round attack became 200 to 800 times faster than the prior strongest known theoretical path after the Möbius Bridge was combined with other optimisations.

Anthropic's safety caveat said the attack would require more than 400 octillion target messages and cannot reach the full 10-round encryption protecting everyday systems.

Disclosure Path Keeps The Work In Research Channels

Anthropic's disclosure timeline included notifying HAWK's designers in June, coordinating public release with a NIST mailing list, and briefing government and industry partners before publication.

CryptanalysisBench came from collaboration with ETH Zurich, Tel Aviv University and University of Haifa researchers, creating a shared tool for measuring how AI systems perform against different ciphers.

The disclosure path gives the research an institutional boundary.

HAWK remains a candidate under review, while the AES result applies to a deliberately weakened benchmark used by researchers rather than to production encryption.

Security Teams Get A Cryptography Inventory Problem

Boehm's comments shift the enterprise implication from panic about broken encryption to operational readiness.

Her interview tied AI-driven cryptanalysis to visibility over where cryptography is deployed, which business systems depend on it, and whether companies have a post-quantum readiness plan.

The threat picture stayed cautious.

Five Eyes intelligence agencies warned in June that advanced AI models capable of major cyber disruption were months away, while recent reporting cited by CyberScoop found that AI-assisted bug discoveries have not materially changed the internet-wide threat level.

Government and company response procedures for an AI-discovered critical-infrastructure cryptography flaw remain unresolved in Anthropic's published answer.