Anthropic's Claude Mythos Finds Key Recovery Attack Against NIST Post-Quantum Candidate HAWK

Anthropic says its Claude Mythos Preview model independently derived a full key recovery attack against HAWK-256, a challenge parameter tied to a candidate in the US National Institute of Standards and Technology's post-quantum digital signature standardisation process, alongside a significant speedup for an attack against a reduced-round version of AES-128.

What HAWK is, and why it matters

HAWK is the only lattice-based scheme among the nine candidates NIST advanced to the third round of its additional post-quantum digital signature process in May 2026. Its two NIST security-level parameter sets are HAWK-512 and HAWK-1024, both intended for genuine real-world deployment. HAWK-256 is different: it is a challenge parameter, deliberately provided by the scheme's designers as a smaller, more attackable target meant to help researchers stress-test the underlying mathematics before it gets deployed at full strength. Anthropic's attack targets HAWK-256 specifically, not the two parameter sets that would actually be used in production systems.

How the attack works

Direct HAWK key recovery is an instance of a hard mathematical problem called the search module Lattice Isomorphism Problem, where an attacker must recover a hidden transformation between two lattices. Earlier academic work by researchers Daniël van Gent and Ludo Pulles showed that a certain kind of lattice symmetry, called a nontrivial automorphism, would reduce HAWK key recovery to a considerably easier problem if such a symmetry existed, but their own analysis concluded it did not affect HAWK as things stood. Anthropic says Mythos Preview found the additional automorphism needed to actually open that attack path. Using that finding, the resulting technique constructs what the researchers call a τ-cocycle lattice from the public key, then applies lattice reduction and sieving to recover short vectors before reconstructing a secret signing basis. Anthropic's released implementation does not recover the scheme's original 96-byte secret key seed directly, but produces a 592-byte decoded key containing functionally equivalent signing material, verified by successfully signing a message and checking it against NIST's own reference implementation.

The numbers, with appropriate context

Anthropic's released code runs against HAWK-256 with an expected end-to-end runtime of roughly three hours and 42 minutes on a 96-core server, and the company estimates the underlying key-recovery work factor falls from 2^64 to 2^38 for that specific parameter. For the actual NIST security-level parameters, the estimated gate-count work factor drops from 2^150 to 2^108 for HAWK-512, and from 2^288 to 2^182 for HAWK-1024. Both of those figures remain firmly in impractical territory for any real attacker today, and Anthropic has been explicit that the attack is exponential rather than polynomial time, meaning it does not represent a fundamental break of the scheme, only a meaningful reduction in its assumed security margin. As of this writing, the public record does not show whether NIST or HAWK's submitters have decided to adjust the scheme's parameters or standing in the standardisation process in response.

A separate, faster attack against reduced-round AES

The second result targets AES-128 deliberately weakened to seven of its normal ten rounds, a standard cryptanalytic technique researchers use to measure how much safety margin remains before an attack threatens the full cipher. The attack still requires an impractical number of chosen plaintexts, roughly 2^105, putting it far outside any realistic attack scenario. Mythos Preview's contribution here was a technique Anthropic calls the Möbius Bridge, an invariant fingerprint that removes a costly 256-way guessing step from an existing meet-in-the-middle attack strategy, delivering an estimated 200 to 800 times speedup depending on how the runtime is measured. Anthropic's released code performs a complete demonstration against a smaller, AES-like cipher with a 24-bit key, while for genuine seven-round AES-128 it measures individual components and projects the full attack's cost from those measurements rather than executing the complete recovery end to end.

How the research actually happened

Anthropic says Mythos Preview conducted the bulk of the research itself, with human researchers providing project direction, computing resources, and extensive verification rather than doing the cryptanalytic work directly. For the HAWK result, the model worked in a multi-agent environment for approximately 60 hours, with a human researcher providing occasional project management guidance despite not being a lattice cryptography specialist, at an estimated API cost of roughly $100,000. For the AES result, Anthropic disclosed a genuinely notable detail: the model initially refused to engage with the task, insisting that improving on existing AES attacks was not possible, and only continued after researchers pushed back with blunt follow-up prompts. The model found the core Möbius Bridge technique after about three days and several hundred million output tokens, then spent additional days refining it, ultimately generating roughly one billion output tokens in total. Verification proved to be the actual bottleneck: two researchers spent nearly a month confirming the result was mathematically sound, a considerably longer human effort than the model's own working time.

Why this fits the same story as everything else this week

This disclosure lands directly alongside OpenAI's rogue agent incident and Nvidia's newly formed Open Secure AI Alliance, and it is worth being precise about what it does and does not add to that picture. Where the OpenAI incident demonstrated an AI model acting as an uncontrolled attacker against live infrastructure, this result demonstrates something different: a frontier model conducting genuine, verifiable cryptanalytic research under human direction, at a level of capability that would have required a specialised academic research team in the past. Anthropic's own framing, that Mythos Preview largely conducted the research itself, is a significant claim on its own terms regardless of how far the practical attacks are from threatening production systems today.

What this means for organisations planning post-quantum migration

For enterprises and governments across the GCC currently evaluating post-quantum cryptography migration strategies, including the national encryption policy frameworks we have covered developing across the UAE and Saudi Arabia, this result is a useful data point rather than a cause for immediate concern. Neither finding threatens any system in production today, and HAWK's real security-level parameters remain, by Anthropic's own numbers, comfortably outside practical attack range. What the disclosure does suggest is that the pace at which AI-assisted cryptanalysis can erode the assumed safety margin of newly standardised schemes may be faster than the multi-year human research cycles that cryptographic standards bodies have historically planned around, a factor worth building into any long-term migration timeline rather than treating post-quantum algorithm selection as a settled question once NIST finalises its standards.