AI-powered cryptanalysis has uncovered vulnerabilities in two widely discussed encryption algorithms, HAWK and a reduced version of AES, but experts urge calm. The findings, published by Anthropic’s Frontier Red Team, reveal theoretical flaws that don’t immediately threaten current systems but highlight the growing role of artificial intelligence in cybersecurity research.
Post-quantum HAWK: A brief flight before landing
HAWK, a digital signature scheme designed to resist quantum computing threats, was a strong contender in the NIST’s post-quantum cryptography standardization process. After passing two rounds of human expert evaluation over two years, the algorithm now faces a significant setback.
The breakthrough came from Anthropic’s Mythos Preview model, which identified a geometric symmetry in HAWK’s underlying mathematical structure. By exploiting this automorphism, researchers reduced the key recovery problem to a short vector search in a lattice with halved dimensions. For the HAWK-256 variant, this translated to a complexity drop from 2⁶⁴ to 2³⁸ operations, enabling key extraction in just 3 hours and 42 minutes on a standard 96-core server.
This vulnerability effectively nullifies HAWK’s practical advantages. To restore adequate security, developers would need to double key and signature sizes, compromising the algorithm’s lightweight computation benefits that made it attractive initially.
Consequently, HAWK’s designers officially withdrew the algorithm from the NIST selection process on July 29, 2026, rendering it obsolete before deployment.
Reduced AES: A theoretical breach with no immediate impact
The Advanced Encryption Standard (AES), the gold standard for symmetric encryption used globally in banking, TLS, and hardware acceleration, remains unaffected by these discoveries. The vulnerabilities identified concern only a deliberately weakened version of AES-128, reduced to 7 transformation rounds instead of the standard 10.
Anthropic’s team developed a novel attack technique called the Möbius Bridge, an invariant fingerprint incorporated into a meet-in-the-middle attack. This innovation eliminates an exhaustive search step previously requiring 256 iterations, accelerating the attack by factors of 200 to 800 compared to 2013 benchmark results.
Crucially, this vulnerability remains confined to academic research. The additional three transformation rounds in the official AES standard make such attacks computationally infeasible in real-world scenarios. The French National Agency for Information Systems Security (ANSSI) continues to recommend 128-bit keys as minimum, with 192-bit keys advised for post-quantum security scenarios.
AI’s double-edged sword in cryptanalysis
While these discoveries don’t threaten existing systems, they underscore a critical shift in cybersecurity research. The volume of vulnerabilities identified by AI models is outpacing human verification capabilities, creating a new bottleneck in the security analysis pipeline.
The HAWK vulnerability required approximately 60 hours of autonomous computation, with an estimated $100,000 API cost through commercial Anthropic services. Equally remarkable, the Mythos Preview model initially refused to analyze the reduced AES version, asserting that no improvements could be made to such a well-established algorithm. After prompting adjustments, the model rewrote its own execution framework, generating about a billion tokens over several days to devise the new attack method—again at an estimated $100,000 cost.
These findings, while not operationally critical today, serve as a wake-up call for the cybersecurity community. The results were subjected to rigorous verification by two researchers over a month, validating the mathematical rigor and eliminating potential hallucinations from the AI-generated analysis.
The discoveries on HAWK have already led to its removal from the NIST process, while the reduced AES vulnerability remains a theoretical concern confined to academic exploration. However, the episode demonstrates how AI is reshaping cryptanalysis, with implications for both security research and the future of encryption standards.
Reflecting on the future of cryptographic security
The Anthropic publication serves as both a testament to AI’s capabilities and a reminder of its limitations. While the technology excels at pattern recognition and brute-force optimization, human expertise remains essential for validating results and ensuring mathematical rigor.
As AI continues to uncover vulnerabilities at an unprecedented pace, the cybersecurity community faces a growing challenge: how to process and verify findings without becoming overwhelmed. The episode highlights the need for improved collaboration between AI systems and human experts to maintain the integrity of cryptographic standards in an era of rapidly advancing computational power.