Claude Weakens a Quantum Lock: Anthropic engineers used Claude Mythos to identify cryptographic weaknesses in HAWK and AES

The U.S. National Institute of Standards and Technology (NIST) has been testing quantum-proof replacements for today’s encryption algorithms. Claude Mythos Preview, currently under restricted release, found a weakness in one of the candidates, a signature scheme called HAWK. HAWK’s designers subsequently withdrew it from the competition, ending a bid that had survived two rounds and approximately two years of expert review.

What’s new: Anthropic reported that Claude Mythos Preview produced two new attacks on cryptographic algorithms, HAWK and AES. HAWK is a proposed spec not currently in use, and the attack on AES applies only to a deliberately weakened seven-round version researchers attack as a practice target, not the ten-round AES-128 in actual use. So, no patch or fix is needed, and the attack does not threaten production code.

How it works: The first attack targets HAWK, a proposed method for producing digital signatures, the mechanism a browser uses to confirm a website is genuine. The second attack targets AES, the cipher that encrypts most internet traffic. In both cases, when prompted to crack the signature, one agent initially responded that such an attack was impossible, while another discovered a possible exploit.

• For the HAWK attack, Anthropic says the model worked under human steering in a harness running several agents at once. The researcher who directed it had a background in theoretical computer science but no expertise in this particular form of cryptography, and Anthropic describes that contribution as project management.
• The key idea came from a pair of agents that worked on the same problem. The first dismissed it as infeasible, and the second found a way to exploit it.
• For HAWK-512, the smaller of its two proposed security levels, Claude’s attack lowers the estimated cost of stealing a secret key from 2 to the 150th power down to at most 2 to the 108th. Each step down halves the work, so the drop is a factor in the trillions. Both numbers stay far beyond the capabilities of any machine that exists to crack them. But the new figure falls well below the security level HAWK’s designers claimed.
• On the afternoon of July 28, Anthropic researcher Stephen Weis posted the attack to pqc-forum, the public mailing list NIST uses to run the competition, together with working code that recovers a key. Anthropic had shared it privately with HAWK’s designers in June. Cryptographer Daniel Apon replied the same evening to say he had checked the reduction independently and it held up.
• The next morning, Léo Ducas, a lead designer of HAWK, wrote on the team’s behalf that straightforward fixes, such as doubling parameters or moving to higher-rank modules, would make HAWK uncompetitive, and that the team would therefore withdraw it. He thanked Anthropic for the work and wished the remaining candidates well. The withdrawal is recorded on NIST’s round-three page.

Behind the news: Candidates failing late in these competitions is not new. In 2022, an earlier NIST candidate called SIKE was broken in about an hour on a single-core computer (for its lowest security level), with higher security levels taking up to a day. In fact, HAWK was itself under attack from three directions, and only one of them was Anthropic’s. Within a few days, three separate attacks on the scheme reached the same mailing list. Hengyi Luo contributed one produced with OpenAI’s Codex, drafted eleven days before Anthropic’s disclosure. Academic cryptographers Guilhem Mureau and Alice Pellet-Mary sent a third, derived by hand with some LLM assistance. However, Ducas’s withdrawal notice cites Anthropic’s attack as the deciding factor.

Why it matters: Johns Hopkins cryptographer Matthew Green judged the HAWK attack to be significant and the AES attack far less so. He notes that the HAWK attack invented no “fundamentally new” mathematics. It combined tools that were already available, which means the weakness was reachable all along, but nobody had been thorough enough to reach it. At the same time, the models were able to research, discover, and direct such an attack in a short amount of time and with minimal human intervention. Finding the weakness took about 60 hours and roughly $100,000 in API costs, according to Anthropic. The HAWK attack shipped with working code, so a cryptographer could confirm the reduction the same evening.

We’re thinking: This is an encouraging result for the future of AI and security: AI has a positive role to play in cryptography and other forms of cybersecurity by revealing the limits of the systems we rely on. Open standards and open research ultimately help ensure trust in our information security. When someone builds a better lockpick, it helps show the way to build a better lock.