Innovative research from Anthropic’s Frontier Red Team has unveiled previously unknown vulnerabilities in two critical cryptographic algorithms: HAWK and a simplified variant of AES. While these discoveries mark significant milestones in post-quantum cryptography, they pose no immediate threat to existing systems.
Post-quantum falcon falters under scrutiny
HAWK, a digital signature scheme designed to withstand quantum computing threats, had been a strong contender in the NIST’s post-quantum cryptography standardization process. After successfully passing two rigorous evaluation rounds over two years, the algorithm’s resilience has now been compromised by a breakthrough analysis conducted using Anthropic’s internal Mythos Preview model.
The attack leveraged a geometric symmetry within HAWK’s security foundation—the module Lattice Isomorphism Problem. By identifying an automorphism, researchers reduced the key recovery process from 2⁶⁴ to 2³⁸ operations, enabling the extraction of a secret key in just 3 hours and 42 minutes using a standard 96-core server. This vulnerability effectively nullifies HAWK’s practical advantages, as doubling key sizes to restore security would negate its computational efficiency.
Consequently, HAWK’s development team withdrew the algorithm from NIST’s selection process on July 29, 2026, acknowledging the discovery’s impact on its viability.
What’s really happening with AES?
The Advanced Encryption Standard (AES), a globally adopted symmetric encryption algorithm, remains unaffected by these findings. The vulnerabilities uncovered pertain exclusively to a deliberately weakened version of AES-128, reduced to just 7 transformation rounds instead of the standard 10. This modified version is used solely for academic research to test cryptographic robustness.
The innovative attack method, dubbed the “Möbius Bridge,” employs an invariant fingerprinting technique within a meet-in-the-middle framework. This approach eliminates an exhaustive search phase previously requiring 256 iterations, accelerating the attack by a factor of 200 to 800 compared to 2013 benchmark studies. However, the additional three transformation rounds in the official AES standard render this vulnerability purely theoretical and operationally irrelevant.
ANSSI’s latest cryptographic guidelines continue to recommend AES-128 as a minimum standard, with 192-bit keys advised for post-quantum security scenarios, maintaining optimal performance balance.
Research insights and future implications
While these discoveries don’t compromise current cryptographic implementations, they underscore the evolving landscape of cybersecurity research. The HAWK vulnerability required approximately 60 hours of autonomous computation, costing an estimated $100,000 in API fees if conducted through commercial Anthropic services. Notably, the Mythos Preview model initially resisted executing the attack on the weakened AES variant, asserting that no improvements could be made to such a well-established algorithm. Only after refining the model’s scaffolding did it generate roughly one billion tokens over several days to develop the novel attack methodology.
The research process involved rigorous validation by two researchers over a month, examining every mathematical equation, algebraic transformation, and complexity reduction proposed by the AI model to eliminate potential hallucinations and ensure mathematical rigor before public disclosure.
Shifting bottlenecks in cryptographic research
The rapid pace of AI-driven cryptographic discoveries is reshaping the cybersecurity research landscape. While AI models excel at identifying vulnerabilities, human expertise remains crucial for validation and contextual analysis. The HAWK analysis required a week for conceptualization and a month for formal verification by human researchers, highlighting the irreplaceable role of human insight in cryptographic research.
These findings represent just the beginning of Anthropic’s ongoing investigations into cryptographic algorithms. With preliminary results already pointing to additional vulnerabilities, the cybersecurity community must prepare for a new era of AI-augmented cryptanalysis, where computational power and human expertise must work in tandem to maintain security standards.
