On July 28, 2026, the Anthropic Frontier Red Team research team published findings on two encryption algorithms, HAWK and AES, revealing previously unknown vulnerabilities. These discoveries were made using an internal preview of Mythos, a cutting-edge AI model not yet publicly available. Despite the sensational headlines circulating, the impact of these findings is far less catastrophic than some reports suggest.
HAWK’s quantum-resistant ambitions derailed
HAWK was a leading candidate in the NIST’s post-quantum cryptography standardization process, designed to withstand attacks from quantum computers. After passing two rigorous rounds of human-led evaluations over two years, the algorithm now faces a significant setback.
The breakthrough came from identifying a geometric symmetry in the mathematical structure of HAWK, which exploits the Module Lattice Isomorphism Problem. This vulnerability reduces the effective security of the algorithm by half. For example, on the HAWK-256 variant, the computational complexity to recover a secret key dropped from 2⁶⁴ to 2³⁸ operations. In a practical test, researchers extracted a secret key in just 3 hours and 42 minutes using a standard 96-core server.
The consequences are immediate: the HAWK team officially withdrew the algorithm from the NIST selection process on July 29, as it is no longer considered viable for quantum-resistant security. The primary advantage of HAWK—its lightweight computation—has been undermined by the need to double key and signature sizes to restore security, which would negate its efficiency benefits.
Mythos and the subtle cracks in AES
The second focus of the research was AES, a globally adopted encryption standard used in banking transactions and the TLS protocol. While the findings do not apply to the full AES implementation, they target a deliberately weakened version of AES-128, reduced to 7 transformation rounds (instead of the standard 10).
The innovation lies in a technique called the Möbius Bridge, an invariant fingerprinting method integrated into a meet-in-the-middle attack. This approach eliminates a computationally intensive search phase that previously required 256 iterations, accelerating the attack by a factor of 200 to 800 compared to prior work from 2013.
Anthropic emphasizes that this vulnerability remains purely theoretical. The additional three rounds in the full AES standard render the attack impractical in real-world scenarios. Even for the weakened version, the computational effort remains prohibitive without significant resources.
Lessons from the AI-driven cryptanalysis
The research underscores the growing role of AI in cryptanalysis, particularly in identifying novel attack vectors. The Mythos model initially refused to engage with the weakened AES version, asserting that no improvements were possible on such a well-studied algorithm. After refining the prompts—a process Anthropic calls “scaffolding”—the model autonomously redesigned the attack framework, generating approximately one billion tokens over several days to develop a new method. The computational cost of this process would have amounted to $100,000 if conducted using standard commercial AI tools.
While the findings do not threaten current cryptographic systems, they highlight a critical challenge: validating the mathematical rigor of AI-generated cryptanalysis. Before publishing, the results were scrutinized by two independent researchers over a month to ensure the correctness of equations, algebraic transformations, and complexity reductions—effectively eliminating potential hallucinations or errors.
Shifting bottlenecks in cybersecurity
The Anthropic research also sheds light on the evolving dynamics of cybersecurity research. The bottleneck is no longer the ability to discover vulnerabilities but the capacity to verify and validate findings. The HAWK discovery required 60 hours of autonomous computation and a month of human review, raising questions about whether a human researcher could have arrived at the same conclusions given sufficient time and persistence.
The implications extend beyond cryptography. The rise of AI-driven vulnerabilities is outpacing traditional validation processes, as evidenced by the surge in security patches across major software platforms like Firefox, Windows, and Apple systems. The research team suggests that further discoveries are on the horizon, with preliminary findings on other algorithms already in progress.
