Anthropic announced on July 28, 2026 that Claude Mythos Preview discovered improved attacks against two cryptographic algorithms. The first targets HAWK, a third-round candidate in NIST's post-quantum signature call: Mythos found a previously unexploited nontrivial automorphism in HAWK's lattice, cutting the expected cost of a full key recovery attack on HAWK-256 from 2^64 to 2^38. The second targets AES-128 reduced to 7 of its 10 rounds, where a fingerprinting algorithm the model named the Möbius Bridge made the best known meet-in-the-middle attack 200 to 800 times faster. Neither result affects any system in production today. ASAP works from Anthropic's official research post as the primary source to separate what was demonstrated from what remains open.

This time the flaw was in the math, not the code

One sentence in the introduction sets this announcement apart from the last one. When Anthropic launched Claude Mythos Preview, the model found vulnerabilities in several major cryptographic libraries, but those were implementation errors: mistakes programmers made translating an algorithm into code. This time the company reports that Claude can find mathematical flaws in the algorithms themselves.

That distinction changes how a defender responds. Implementation bugs are closed with a patch. A mathematical flaw in an algorithm has no code to patch; the specification has to be rewritten, the parameters enlarged, or the scheme retired. In HAWK's case Anthropic states that preserving the original security level requires doubling key sizes, and that doubling them eliminates many of the reasons HAWK was an attractive post-quantum signature candidate in the first place. For a scheme whose selling point was efficiency, a parameter increase is close to a loss of purpose.

HAWK: two years of expert review, then 60 hours

HAWK is a surviving third-round candidate from the additional digital signature call NIST issued in 2022. Its security rests on the hardness of the Lattice Isomorphism Problem. What Mythos found is a nontrivial automorphism in the lattice HAWK uses. Prior work had already proved that efficiently finding such an automorphism would enable an attack, but had not answered whether one was accessible in HAWK's specific lattice. Mythos filled that gap.

In numbers: the expected cost of a full key recovery attack against the small HAWK-256 parameter set was thought to be 2^64 and was demonstrated by Mythos to be 2^38. Anthropic is explicit about the limits. The attack is still exponential-time rather than polynomial-time, HAWK remains impractical to attack at larger key sizes, and the result is specific to HAWK and does not impact other NIST post-quantum signature candidates or lattice-based cryptography in general. Finding, developing and verifying the attack took about 60 hours in total, at roughly $100,000 in API cost.

The working setup is worth recording. A Claude Code-like harness ran multiple worker agents collaborating in a sandbox with Python, Sage, and access to published cryptographic literature. The human operator had a theoretical computer science background but was not a lattice cryptography expert, and their input was limited to project management: how to track ideas, which libraries to use for computational verification. The key insight emerged from a pair of workers exchanging messages, where the first prematurely rejected the idea as infeasible and the second found a way to exploit it.

On AES, the bottleneck was verification, not discovery

The second result attacks AES-128 cut down to 7 of its 10 rounds. The research line it extends uses meet-in-the-middle attacks, which trade time for space by storing intermediate computations and reusing them. Mythos added a more sophisticated fingerprinting step. One stage of the prior attack had to enumerate 256 values and look each of them up in a precomputed table; Mythos designed a fingerprint invariant to that guess, cutting the work of that stage by a factor of 256. Computing the transform is more expensive, so the model found several further optimizations to compensate, producing an attack between 200 and 800 times faster depending on how the runtime is measured.

The assumptions matter as much as the speedup. The prior work being extended assumes an attacker can request the encryption of 2^105 chosen plaintexts. Anthropic calls the attack completely impractical on those terms, useful mainly for quantifying attack cost under a standard threat model, and a footnote estimates that implementing it would cost hundreds of millions of dollars.

The most telling detail here is not the speedup but the allocation of time. Mythos spent about a week conceiving the idea, working autonomously for three days while producing several hundred million tokens, and refined the attack after a total of one billion output tokens. Two Anthropic researchers then needed nearly a month, several hundred hours, to gain confidence the method was correct. The post says the vast majority of the team's time over the past few months went into verifying Claude's results, and that they are reaching the limits of their own knowledge.

The new bottleneck is the gap between generation and verification

Anthropic's own prediction is the most consequential claim in the July 28, 2026 post: the cybersecurity community is already grappling with language models finding more bugs than human triage, verification and remediation processes can absorb, and the same will soon be true in academic cryptography research.

Put in cost terms, the shape of the problem is clear. Discovery on the AES result cost roughly $100,000 in API spend. Verification cost a month of two researchers who were not cryptography experts. Discovery cost keeps falling as models get cheaper and faster; verification cost is anchored to how long a human takes to learn a field, and does not fall at the same rate. The wider those curves diverge, the more unverified claims accumulate. That is exactly why Anthropic stresses higher confidence in the HAWK and LEA attacks, which run end to end: you can pick a random key and watch the attack recover it, whereas a purely analytical result has to be followed by hand.

There is a practical reading rule in this for practitioners. Future "AI found a vulnerability" claims should be sorted by the form of their verifiability rather than by the drama of the finding. A result shipped with reproduction code that recovers random inputs sits in a different trust tier than a result that exists only as analysis on paper. This announcement is unusual in that it draws that line inside a single document.

LEA, designed in South Korea, appears in the follow-up work

Among the preliminary follow-up results, LEA is the one Korean readers should look at first. Anthropic describes LEA as an efficient cipher designed for low-power, resource-constrained environments and codified into international standards such as ISO/IEC 29192-2:2019. LEA was developed in South Korea in 2013 and is carried both as Korean national standard KS X 3246 and in that ISO/IEC standard.

The numbers: the best published cryptanalysis of 13-round LEA requires 2^98 plaintext pairs and 2^86 work. Mythos Preview developed a practical attack that recovers a 13-round LEA key in under 2^30 encrypted plaintexts and runs in under an hour on a modern desktop computer. Anthropic notes the attack does not apply to the full 24-round cipher and carries no immediate practical consequence, and that the exact bounds on required plaintext pairs, the existence of harder keys, and any extension to 14 rounds still need work. A practical full key-recovery attack on 6 rounds of Serpent-128 is mentioned alongside it; the full cipher has 32 rounds.

The significance for Korea sits elsewhere. The post's conclusion argues that many ciphers protecting modern systems have received less scrutiny than they deserve and may still hold dormant weaknesses. That description points less at AES, with its accumulated tens of thousands of expert hours, and more at algorithms adopted as a national or industry standard where the reviewing population is thin. For any organization operating a standardized cipher domestically, the accurate reading of this result is not "our algorithm is broken" but "the assumption that review volume equals safety margin is under pressure."

What is still unanswered

Three things remain unsettled after Anthropic's disclosure of the HAWK and AES results: reproducibility, disclosure rules for high-impact findings, and how far reduced-round progress generalizes. First, reproducibility. A Mythos Preview-class model, roughly $100,000 in API cost, and a purpose-built harness is not a combination most academic labs can match immediately. CryptanalysisBench, built with academics at ETH Zurich, Tel Aviv University and the University of Haifa, is now public, but it packages ciphers for evaluating LLM capability and does not address the cost of reproducing a discovery.

Second, disclosure rules. Anthropic shared the HAWK attack with the scheme's authors in June, coordinated disclosure to the public NIST mailing list, and gave advance copies to US government and industry partners. But the question the post itself raises, how researchers should react if a language model finds a vulnerability in a cryptosystem where the impact is immediate and real, is answered only with a call for input from academia, government and industry. Disclosure is easy when the honest headline is "no impact." The rule for the hard case does not exist yet.

Third, generalization. The 7-round attack does not break full AES, and nothing here guarantees that reduced-round progress carries to the full cipher. Anthropic describes both headline results as expected: NIST's process exists precisely to surface weaknesses before deployment, and reduced-round AES attacks extend a long-running research line. The measurable test comes next, in how far the round count can be pushed on heavily reviewed algorithms, and in how much of the human verification burden can be removed.

Source: ASAP analysis based on Anthropic's official research post "Discovering cryptographic weaknesses with Claude" (July 28, 2026), the accompanying HAWK and AES technical papers, and the CryptanalysisBench release