David Brooks
Every few weeks, an AI lab drops a result that gets flattened into a headline the underlying paper never actually supports. This is one of those cycles — with an asterisk, because there's a real, uncomfortable story underneath the noise that almost nobody is telling straight.
On July 28, 2026, Anthropic announced that its Claude Mythos Preview model, working semi-autonomously, had found a mathematical weakness in HAWK, one of the third-round candidates in NIST's post-quantum digital signature standardization process. By the next day half the tech press was writing about HAWK as if it were already dead and buried. That's a clean, shareable headline for a 24-hour news cycle. Let's be real: no, Claude did not crack post-quantum cryptography. But what it actually did is messier and more uncomfortable than the headline suggests, and almost nobody is reporting it that way.
What Claude Mythos Actually Broke — and What NIST Did About It
The numbers matter here, because without them this is just noise:
| HAWK parameter | Original cost | Cost after Claude's attack |
|---|---|---|
| HAWK-256 (challenge) | 2^64 operations | 2^38 operations |
| HAWK-512 | 2^150 operations | 2^108 operations |
| HAWK-1024 | 2^288 operations | 2^182 operations |
The weakness is a non-trivial automorphism in the lattice structure HAWK is built on — a mathematical symmetry that two full years of expert review had missed, and one that guts the scheme's security margin (not unlike the nginx CVE that took 18 years to surface: the most dangerous flaws are rarely the new ones — they're the ones that have been sitting in plain sight for years). Daniel Apon, a cryptographer who worked on NIST's own standardization process, confirmed the math held up within an hour of reading the thread Anthropic's Stephen Weis posted to the public pqc-forum mailing list. That's fast, even by academic cryptography standards.
Here's what it actually means if you're evaluating post-quantum schemes today: HAWK-256 as a challenge parameter is dead, and the real-world deployment parameters — HAWK-512, HAWK-1024 — remain impractical to break, but with half the security margin they had last week. If your team had HAWK anywhere near a production shortlist, this news just made the call for you.
CryptanalysisBench: This Was Never a One-Model Story
This didn't come out of nowhere. Eight days earlier, on July 20, Anthropic had already published CryptanalysisBench alongside ETH Zurich, the University of Haifa, TU Berlin, and Tel Aviv University: a 191-task benchmark built to measure how well frontier models reason through problems that have been the exclusive turf of human mathematicians for decades. It's the same pattern we saw with GPT-5.2's jump on the ARC-AGI benchmark: a number shows up in a paper first, then a real-world case confirms it days or weeks later.
The result should have made more people uncomfortable than it did: five frontier models — Claude Opus 4.8, Sonnet 5, Mythos 5, GPT-5.5, and GLM-5.2 — solved between 65% and 86% of the level-1 tasks.
Not just Claude.
That's the part worth sitting with. The ability to find cryptographic weaknesses is now a trait shared across the entire language model industry, not a party trick from one lab. If this keeps moving at the pace it's shown over roughly a week — academic benchmark to a NIST candidate taking a serious hit — the question the industry needs to answer isn't whether models will keep finding flaws. It's how anyone verifies them at the speed they're about to get produced.
The AES-128 Attack: Mobius Bridge and the Gap Between Lab and Reality
This is where the marketing peels away from the substance. Claude developed a technique called "Mobius Bridge" that speeds up a meet-in-the-middle attack against AES-128 reduced to 7 of its 10 rounds by 200 to 800 times, eliminating a 2^56-value guessing step. It sounds like a cryptographic apocalypse — exactly the kind of headline that gets shared without anyone reading past the second paragraph.
It isn't one.
Anthropic itself admits the attack needs roughly 2^105 chosen plaintexts under a single fixed key — a requirement no real-world attacker will ever satisfy against a production system, and one that rules out anyone running full 10-round AES-128. Matthew Green, one of the most respected cryptographers working outside the AI-lab bubble, put it plainly: this is "a modest constant-factor improvement" on academic work from 2013, not a fundamental breakthrough. So why did half the internet start talking about an AI that "broke" AES? Because "constant-factor speedup against a reduced-round variant, under lab conditions nobody will ever replicate" doesn't fit in a headline.
The elephant in the room is that this pattern — real result, reduced-round scope, headline that drops every qualifier along the way — is exactly how AI cryptanalysis claims are going to keep getting reported unless outlets start reading past the abstract.
Nobody Outside Anthropic Has Run the HAWK Attack End to End
Here's the part almost no outlet is reporting. Every piece I've read — The Hacker News, Cyber Security News, even Schneier on Security — repeats Anthropic's own numbers and closes with the reassuring line that "this doesn't affect production systems."
That's true. It's also the easy part of the story.
The uncomfortable part is that full key recovery on HAWK-256, start to finish, hasn't been independently reproduced by anyone outside Anthropic. Apon confirmed the automorphism's math — he didn't execute the complete attack. And on the very forum where the disclosure was coordinated, Markku-Juhani Saarinen asked for something concrete: that any AI-assisted cryptanalysis result come bundled with machine-verifiable proofs or working demonstrations against reduced versions of the target. Translation: even NIST's own experts aren't ready to take "trust me, it works" from a language model at face value.
Confirming the automorphism isn't the same as running the full attack, and that distinction is exactly what's getting lost in most of the coverage. After years covering the enterprise sector, it genuinely bothers me that no major outlet has stopped to ask this out loud: if nobody outside Anthropic has run this attack start to finish, what exactly are we basing "case closed" on? Green says it better than I could: a model spitting out a result doesn't make the result real — a line that belongs pinned to the wall of every security team using AI to audit its own code.
The repository Anthropic published on GitHub under Apache 2.0 sits, as of this writing, at 46 stars and 5 forks. For a finding that supposedly rewrites the rules, the outside cryptography community is treating it with a calm that doesn't match the panic in the headlines.
What This Means for Your Security Team Right Now
Should you panic if your stack runs AES or post-quantum schemes? No. Should you write this off as "just another AI lab announcement"? Also no — and that's the exact mistake I've seen a few teams make this week.
One team I talked to had already paused its HAWK evaluation for an internal document-signing project before anything was even confirmed, purely off the headline. Neither panic nor indifference is the right call here. Read the table instead:
| If you're running... | Affected | What to do |
|---|---|---|
| ML-KEM / ML-DSA / SLH-DSA (FIPS 203/204/205) | No | Nothing — these are NIST's official recommendation since 2024, and the compliance baseline for FedRAMP and FIPS 140-3 |
| HAWK (any parameter) | Yes, partially | Watch NIST's follow-up guidance and drop HAWK from any new deployment |
| Full 10-round AES-128 in production | No | That volume of ciphertext under a single key doesn't exist in practice |
For US enterprise and federal-adjacent shops, this matters beyond the pure math: FIPS 203/204/205 are already the standard agencies and contractors are expected to be moving toward, and HAWK taking this hit just confirms that betting on a non-finalized candidate over the finalized standards was always the riskier bet.
Here's my take: the real headline out of this episode isn't "an AI broke post-quantum encryption." It's that the security industry now produces cryptanalysis at inference speed and still verifies it at human-peer-review speed, and that mismatch — not HAWK, not AES-128 — is what should actually keep you up this week.
If your team is migrating toward post-quantum standards, this is a good moment to revisit how you're structuring that transition — we covered the real cost of migrating off RSA-2048 under the quantum threat and it's worth rereading with this in mind. I haven't had access to Anthropic's internal validation data beyond what's been published, so I can't confirm how much of those "months of follow-up human validation" amounted to exhaustive review versus a partial confirmation like Apon's. That's a distinction Anthropic ought to spell out in more detail than it has so far — and as of now, it hasn't.
