Mythos ended HAWK's NIST bid; it did not break AES

What we checked

• The Cryptography Engineering post is commentary on a specific Anthropic cryptanalysis paper or post, not a standalone primary result. confirmed. Matthew Green's 29 July 2026 post comments on Anthropic's 28 July Frontier Red Team announcement that Claude Mythos Preview produced two results: a HAWK key-recovery paper by Straznickas and Weis, and a 7-round AES paper by Nasr and Carlini. [10][1][2][4]
• Anthropic achieved a concrete cryptanalytic advance, and expert commentary qualifies how far that advance goes. confirmed. The HAWK result is a dimension-halving key-recovery reduction with a few-hour HAWK-256 demo; the AES result is a 7-round meet-in-the-middle speedup that still needs 2^105 chosen plaintexts. Green treats HAWK as the meaningful result and AES as a modest paper increment, with verification as the bottleneck. [3][4][10]
• HAWK was withdrawn from NIST after the submitters confirmed the attack. confirmed. On 29 July 2026 Leo Ducas, writing for the HAWK team on the NIST pqc-forum, confirmed that the attack approximately halves the lattice-reduction block size and withdrew HAWK because naive parameter increases would make it uncompetitive. NIST recorded the withdrawal on its Round 3 page. [5][7][8][9]
• The attacks break deployed production cryptography such as full AES, Falcon, or other NIST PQC standards. refuted. Anthropic, Green, the HAWK paper, and the AES paper all state that HAWK was undeployed, full AES is not attacked, and the construction does not transfer to Falcon. No production software change is required. [1][3][4][10]

What we found

• The originating source is Anthropic's 28 July 2026 post Discovering cryptographic weaknesses with Claude, not Green's commentary. The HAWK paper is HAWK-n Key Recovery Reduces to SVP in Dimension n/2+1 by Zygimantas Straznickas and Stephen A. Weis. The AES paper is Cryptanalysis of 7-Round AES via the Algebraic Structure of its S-box by Milad Nasr and Nicholas Carlini. Both are attributed to Claude Mythos Preview, then still unreleased, working in an agentic harness. [1][2][3][4]
• The HAWK attack is an unconditional, deterministic reduction from HAWK-n key recovery over power-of-two cyclotomics to polynomially many exact SVP calls in dimension n/2+1. It uses a Galois involution tau: zeta maps to -zeta to recover a nontrivial lattice automorphism, then applies Ducas block reduction and the van Gent–Pulles descent. In the AGPS20 gate-count model the paper lowers HAWK-512 from 2^150 to at most 2^108 gates and HAWK-1024 from 2^288 to at most 2^182. The authors recovered two HAWK-256 keys end-to-end in a few hours on a 96-core Sapphire Rapids server. The construction does not transfer to Falcon. [3][2][5]
• HAWK had advanced to the third round of NIST's additional signatures process in May 2026, listed in NIST IR 8610 as the only lattice candidate among nine. After Steve Weis announced the attack on the pqc-forum on 28 July, Leo Ducas wrote for the HAWK team on 29 July that the attack approximately halves the block size required in lattice reduction, that doubling parameters or moving to higher-rank modules would make HAWK uncompetitive, and that the team therefore withdrew. NIST confirmed the Round 3 page update. The official HAWK site now states Hawk is insecure and should not be used. [6][7][5][8][9]
• The AES result extends the 2013 Derbez–Fouque–Jean attack on 7-round AES-128, which used 2^105 chosen plaintexts and 2^99 time. Nasr and Carlini introduce a Möbius Bridge fingerprint that exploits the invert-then-affine AES S-box to eliminate one guessed key byte. Depending on accounting, they claim time 2^89.3 to 2^91.4 at the same data complexity, matching Anthropic's 200–800× speedup claim. Green notes the attack still requires 2^89 cipher operations after 2^105 chosen-plaintext encryptions, cannot be run, and does not break 10-, 12-, or 14-round AES. The authors verify components on the small-scale cipher SR(7,2,2,6) and a known-key harness, not a full end-to-end 2^89 run. [4][1][10]
• Anthropic says the HAWK result took about 60 hours and each result cost roughly $100,000 in API spend, with a non-lattice-expert operator giving mostly project-management guidance. The AES run was nearly autonomous after a few steering prompts and about one billion output tokens; humans then spent weeks validating. Weis told the pqc-forum the attack was found by Claude with minimal technical guidance. Daniel Apon wrote that it checks out independently for him. The HAWK paper's acknowledgements state that the majority of mathematical discoveries were AI-assisted and that humans mainly directed, organized, and verified. [1][5][3]
• Green's qualification is that the two results differ sharply in quality. HAWK matters because it recombines known tools rather than inventing new mathematics, and because efficiency was HAWK's reason to exist; doubling keys would erase that reason. AES is a small increment on a long line of reduced-round attacks. His central builder-facing claim is that verifiability is now the bottleneck: a few-hour HAWK-256 recovery is easy to check, while paper speedups that cannot be run need expert review and are sensitive to how the theorem is stated. A comment on his post by Tim Ruffing agrees and argues for machine-checkable proofs as the scalable check. Markku-Juhani O. Saarinen made the same point on the pqc-forum. [10][5][11]

What it means

Builders should not rotate AES, TLS, Falcon, or ML-DSA because of this episode. They should treat undeployed and lightly analyzed public-key candidates as the first place AI cryptanalysis will bite, and should require a runnable challenge-instance attack or a machine-checkable artifact before acting on a model-generated crypto claim. Use agents as pre-standardization reviewers now, the role NIST's process is designed for, and budget human cryptographers for verification, which Anthropic itself says is already the scarce step. Do not equate a model producing a paper with a production primitive being broken. When a claim cannot be executed, treat claimed constant-factor speedups as provisional until independent cryptanalysts reconstruct the accounting.

Still open

• Independent wall-clock confirmation of the AES 2^89 accounting versus DFJ13, which cannot be run at full scale.
• How much of the HAWK idea is new recombination versus work already circulating in module-LIP papers, including parallel dimension-reduction attacks posted on the pqc-forum after disclosure.
• Status of Anthropic's unpublished follow-ups on 13-round LEA and 6-round Serpent, which the blog flags as preliminary.
• Whether remaining NIST additional-signature candidates have been similarly audited with frontier agents.