Anthropic reports Claude finding novel cryptographic weaknesses

Anthropic’s Frontier Red Team reported that its Claude Mythos Preview model, working largely autonomously, had discovered genuine mathematical weaknesses in two cryptographic schemes rather than merely finding bugs in specific implementations of them. Against HAWK, a post-quantum digital-signature scheme under consideration by NIST for standardisation, the model found an improved attack exploiting what Anthropic described as “a nontrivial automorphism in the lattice used by HAWK,” which effectively halves the scheme’s key strength — meaning, in Anthropic’s words, that HAWK’s key sizes would need to double to preserve the intended level of security. The discovery took roughly 60 hours of autonomous work at an API cost of about $100,000, guided by a researcher with a theoretical computer science background who provided occasional project-management input rather than technical direction.

Separately, using a technique it called the “Möbius Bridge” fingerprinting algorithm, the model developed an improved attack against a round-reduced version of AES — seven of the cipher’s ten rounds rather than the full algorithm — that cut the computational cost of the best previously known attack by a factor of 200 to 800, after three days of autonomous work following minimal prompting to pursue genuinely novel results.

Anthropic framed both results as expected outcomes of NIST-style standardisation scrutiny rather than as breaks of deployed systems, and said it had followed responsible-disclosure practice. It also used the results to raise a broader concern: that language models were becoming capable of finding cryptographic weaknesses fast enough that the human processes built to triage and respond to such findings might struggle to keep pace, a dual-use dynamic that cuts toward both stronger defensive auditing and, in less careful hands, offensive use.