AI Cryptography: Did Claude Break Encryption? The Truth About HAWK And AES

The latest cryptography news arrived with the kind of headline that makes security teams reach for coffee and everyone else check their bank balance: Claude had found new ways to attack encryption. The less cinematic truth is that your online banking is still safe, Bitcoin has not become readable, and full AES remains unbroken.

The more important truth is still remarkable. Using Claude Mythos Preview, Anthropic researchers produced two serious advances in AI cryptography. One exposed a damaging structural weakness in HAWK, a proposed post-quantum signature system. The other improved the best known attack on a seven-round version of AES-128, not the full ten-round cipher. Neither result compromises deployed systems today, but both show that frontier models can do more than find coding mistakes. They can help discover new mathematical cryptanalysis.

This isn’t a chatbot guessing passwords. It’s an AI system reading literature, testing mathematical ideas, rejecting dead ends, and producing claims that survived weeks of human validation.

1. AI Cryptography At A Glance: What Broke And What Did Not

“`html

AI Cryptography Research: Claude’s HAWK and AES Findings Compared

Research Result	What Claude Helped Find	Measured Effect	Real-World Status
HAWK Key Recovery	A previously unexploited symmetry in HAWK’s cryptographic lattice structure.	Anthropic reported that the estimated HAWK-256 key-recovery cost fell from roughly 264 to 238. The paper also lowers the estimated costs for HAWK-512 from 2150 to 2108, and for HAWK-1024 from 2288 to 2182.	HAWK was not deployed as a standardized signature scheme. Its team withdrew it from NIST’s evaluation process on July 29, 2026.
Reduced-Round AES-128	A “Möbius Bridge” fingerprint that removes one key-byte guess from a meet-in-the-middle attack.	Previous work required about 299 time. The new estimates range from 289.3 to 291.4, while retaining the same 2105 chosen-plaintext requirement.	The result applies only to seven-round AES. Standard AES-128 uses ten rounds and remains unbroken by this research.
Research Workflow	Multi-agent literature review, mathematical reasoning, Python and Sage experiments, formal verification, and scaled computational checks.	Each major result reportedly cost roughly $100,000 in API usage. The HAWK research effort took about 60 hours.	This was a controlled research process, not a public exploit tool or practical attack service.

“`

The HAWK result became more consequential within a day of Anthropic’s post. NIST’s Round 3 page now records that the HAWK team withdrew the candidate. The team said the attack roughly halves the required lattice-reduction block size and that straightforward fixes, such as doubling parameters, would make HAWK uncompetitive.

The AES paper is more reassuring for current systems. Its attack still needs an absurd (2^{105}) chosen plaintexts, plus computation far beyond practical reach. It is a meaningful academic improvement, not a usable way to decrypt today’s traffic.

2. What Is Cryptography, And Why This Cryptographic Weakness Is Different

“`html

AI Cryptography Weaknesses: Implementation Bugs vs Mathematical Flaws

Common Failure Type	Typical Cause	Example Consequence	What Happened Here
Implementation Bug	A developer exposes a key, repeats a nonce, or writes unsafe verification logic.	A mathematically secure algorithm fails when used in a real application.	Not the main discovery in Anthropic’s research.
Protocol Design Flaw	Secure components are combined in an unsafe sequence or applied under the wrong threat model.	An attacker may perform an authentication bypass, replay attack, or downgrade attack.	Not the weakness identified in the AES research.
Parameter Weakness	Security parameters are too small for the cost of the strongest available attack.	Key recovery or forgery becomes significantly cheaper than the designers intended.	Part of the problem identified in HAWK.
Structural Mathematical Weakness	An attacker exploits an unexpected algebraic property, symmetry, or invariant inside the cryptographic construction.	The best known attack improves even though the software implementation contains no programming error.	Central to both the HAWK and AES findings.

“`

What is cryptography? It is the use of mathematical methods to protect confidentiality, authenticity, and integrity. Encryption keeps information private. Digital signatures prove who signed a message and whether it was altered. Hash functions create compact fingerprints of data. Real systems combine these tools with protocols, key management, and careful software engineering.

Most public cryptographic failures are less glamorous than a broken equation. A key is committed to a repository, a random-number generator fails, or a library is used incorrectly. Anthropic’s earlier Claude security work found vulnerabilities in cryptographic software, but those were implementation problems.

The new work crosses a different line. Claude Mythos Preview helped identify a cryptographic weakness in the mathematics and structure of the targets. That does not mean either algorithm was totally destroyed. Cryptanalysis often advances through partial results, narrow threat models, reduced-round variants, or lower attack exponents. A drop from (2^{99}) to roughly (2^{90}) is still hopelessly expensive, yet scientifically large because powers of two punish every lost bit.

This is why cryptographers study impractical attacks. The goal is often to map the security margin, uncover hidden assumptions, and learn which structures may support stronger attacks later.

3. HAWK And The Post-Quantum Warning

HAWK was designed as a post-quantum digital signature scheme. Unlike RSA and elliptic-curve signatures, which could become vulnerable to a sufficiently capable quantum computer, HAWK relied on a lattice problem believed to resist classical and quantum attacks. NIST advanced it to the third round of its Additional Digital Signatures process in May 2026, alongside eight other candidates.

3.1 How The HAWK Attack Works

A HAWK public key is derived from a secret lattice basis. Recovering an equivalent secret key should require solving a difficult lattice isomorphism problem. The Anthropic paper finds a way to extract a useful hidden symmetry from public information.

The key object is a Galois involution, a transformation that maps (\zeta) to (-\zeta). From it, the researchers construct a public rank-(n) “cocycle lattice” containing a special vector tied to the secret key. Instead of attacking the original rank-(2n) key lattice directly, the method reduces key recovery to repeated exact Shortest Vector Problem calls in dimension (n/2 + 1). A descent procedure then reconstructs an equivalent signing key.

The practical demonstration matters. The team recovered HAWK-256 secret keys end to end in a few hours on a single server. The construction does not transfer to Falcon, and Anthropic states that it does not affect ML-DSA or lattice cryptography in general. This is a targeted break of HAWK’s structure, not a collapse of post-quantum cryptography.

3.2 Why HAWK Was Withdrawn

Cryptographic competitions exist to surface this kind of problem before deployment. The new attack changed HAWK’s security and efficiency trade-off. Raising parameters enough to restore the intended security would enlarge keys or signatures and erase the qualities that made the proposal attractive.

On July 29, the HAWK team confirmed the result and withdrew from NIST’s standardization process. That is not evidence that public review failed. It is evidence that review worked, now with an AI research system added to the reviewer pool.

4. The Möbius Bridge And Reduced-Round AES

AES-128 transforms a 128-bit block through ten rounds. Each round combines nonlinear substitution, byte rearrangement, linear mixing, and key addition. Cryptographers study versions with fewer rounds because weaknesses are easier to observe there. The distance between the best reduced-round attack and a full-round attack helps describe the cipher’s safety margin.

Anthropic’s work targets seven-round AES-128 in a chosen-plaintext setting. The attacker may request encryptions of selected inputs under one fixed, unknown key. The attack family uses a meet-in-the-middle strategy, trading huge memory requirements for less computation.

4.1 Why One Missing Guess Matters

The previous best result guessed groups of key bytes, worked partly forward from plaintexts and backward from ciphertexts, then compared fingerprints against an enormous precomputed table. One stage still had to try 256 possibilities for a key byte.

The Möbius Bridge removes that guess. AES’s S-box is not a random lookup table. It is built from inversion in a finite field followed by an affine transformation. Claude’s approach exploits that structure to construct a fingerprint that stays unchanged under the unknown transformation. In plain English, it compares the right shape of the data without first learning one nuisance byte.

Skipping 256 guesses sounds like a clean 256-fold gain, but the new fingerprint also costs time. The paper adds packed power tables, a Gray-code walk through difference-distribution choices, an XOR-separable S-box cache, and a second canonicalization method. Together, these ideas reduce estimated runtime from (2^{99}) to between (2^{89.3}) and (2^{91.4}), which Anthropic summarizes as roughly 200 to 800 times faster under different accounting methods.

4.2 Why Full AES Is Still Safe

Three limits prevent sensational conclusions.

• First, the attack covers seven rounds, not ten. Extra rounds rapidly spread dependencies across the internal state and can destroy the structure an attack needs.
• Second, the data requirement is (2^{105}) chosen plaintexts. Even at billions of selected blocks per second, collecting that amount would be fantastical.
• Third, the remaining computation is still about (2^{90}) AES-like operations. Anthropic notes that even this reduced-round attack would cost hundreds of millions of dollars to attempt.

Claude did not break AES. It improved the map of where AES begins to weaken when researchers deliberately remove three rounds.

5. Claude Mythos Preview Initially Said The Problem Was Too Hard

The discovery story is almost as revealing as the cryptanalysis. Early runs did not charge heroically into AES. Claude argued that the target was too studied, the easy ideas were exhausted, and the researchers should change the problem.

The human intervention was not a mathematical hint. It was research management: stop looking for low-hanging fruit, keep the target fixed, and search for something worthy of publication. Over the next three days, the system generated several hundred million tokens. After refinement, the AES project had consumed about one billion output tokens.

That episode offers a lesson for builders. Advanced models can still optimize for a safe, plausible stopping point rather than genuine discovery. The scaffold had to reward sustained exploration, preserve failed attempts, expose critiques from other agents, and prevent the system from quietly redefining success. The breakthrough followed multiple rejected transforms, not a magic one-line prompt.

6. Inside Anthropic’s Multi-Agent Research Harness

Calling this a “$100,000 prompt” is catchy but inaccurate. Anthropic used a Claude Code-like harness with multiple workers, access to papers, message passing, and sandboxed Python and Sage environments.

For HAWK, workers reviewed literature, proposed attacks, tested ideas, and debated one another. One agent rejected the key direction as infeasible while another kept pushing and found a way to exploit it. The human operator mainly helped with organization and verification tools. The full HAWK process took about 60 hours and an estimated $100,000 in API usage.

The AES workflow was more autonomous, but verification became the bottleneck. The paper proves the invariance property, formalizes a rejection argument in Lean, tests smaller instances, runs the complete attack on a reduced toy cipher, and benchmarks the components behind the claimed speedup. Researchers could not run the full (2^{90})-scale attack, so confidence came from proofs, experiments, and scaled validation.

This is the emerging pattern in AI-assisted science: generating hypotheses becomes cheap, but trusted knowledge does not. The scarce resource shifts from ideas to verification.

7. The Real Security Risk Is Capability Scaling

The immediate threat is limited. HAWK was a candidate, and reduced-round AES is an academic target. The strategic risk is the curve.

Each main result cost roughly $100,000, which is expensive for an experiment but trivial for a state-backed program or major technology company. More money will not automatically break deployed encryption. Still, larger budgets can support more agents, longer searches, better tools, broader literature review, and expert validation.

That changes the economics of examining obscure algorithms. A scheme no human team has time to study deeply may become an attractive target for automated research. The same machinery can help defenders review standards, test proofs, generate reduced models, and search for counterexamples before deployment.

The answer is not panic or secrecy. It is reproducible code, machine-checkable proofs where possible, independent review, and a strict separation between a model’s claim and a validated result.

8. CryptanalysisBench And Better AI Cryptography Measurement

Anthropic partnered with researchers at ETH Zurich, Tel Aviv University, and TU Berlin to create CryptanalysisBench, a benchmark that packages cryptographic targets for evaluating language models.

Ordinary coding benchmarks cannot capture this capability. A model may implement AES perfectly yet fail to discover an invariant. It may reproduce a known differential attack but miss a new algebraic symmetry. A useful benchmark must test literature synthesis, hypothesis generation, formal reasoning, experiment design, and the discipline to reject attractive but false ideas.

It also needs contamination controls. Repeating a known method is not new research, so evaluation should distinguish retrieval, reconstruction, extension, and original discovery.

Most importantly, scores should reward reproducible attacks, formal proofs, successful scaled demonstrations, and accurate statements of scope. In cryptography, a confident false theorem is worse than no answer.

9. What Developers, Researchers, And Security Teams Should Do

Most developers do not need to replace AES or change production libraries because of this work. They should keep using maintained implementations of standardized algorithms, avoid custom cryptography, protect keys, rotate secrets, and follow post-quantum migration guidance.

Researchers and standards bodies should assume serious proposals will soon be reviewed by fleets of frontier models. Submissions may need machine-readable specifications, executable reference implementations, formalized lemmas, and reproducible reduced instances so independent teams can audit AI-generated claims quickly.

AI builders should study the harness, not just the model. The result depended on long-running search, tool access, critique, memory, and incentives that discouraged easy exits. For technical research, orchestration may matter as much as raw benchmark intelligence.

Decision-makers should avoid two errors. “AI broke encryption” is false. “Nothing practical broke, so nothing changed” is also false. The first invites panic. The second ignores a real jump in automated scientific capability.

10. AI Cryptography Is Now A Research Discipline, Not A Demo

Anthropic’s findings do not end modern encryption. They do mark a new phase in AI cryptography.

Claude Mythos Preview helped find a structural attack that contributed to HAWK’s withdrawal from NIST’s process. It also produced a Möbius-based technique that materially improves cryptanalysis of seven-round AES while leaving full AES untouched. The work is narrow, expensive, and dependent on human verification. It is also original enough to change the security assessment of a serious post-quantum proposal.

The right takeaway is preparation. Security teams need AI-assisted review before deployment, cryptographers need better verification infrastructure, and AI labs need responsible disclosure practices that scale with model capability.

Binary Verse AI will continue separating real technical progress from viral shorthand. Follow our coverage for clear analysis of frontier models, AI security, post-quantum cryptography, and the research systems changing how discoveries are made.