2026-07-30

Anthropic’s cryptanalysis win is a real signal, but not all “AI found an attack” headlines are equal

If you build with Claude or Claude Code, this story is interesting for a simple reason: it shows the model doing something that looks a lot less like chat and a lot more like research labor. Anthropic’s unreleased model, Claude Mythos, helped produce two cryptanalysis results, and one of them is the kind of result that can actually matter in the real world. The catch is that the other one sounds scarier than it is, which is a good reminder that model-generated “breakthroughs” need a very skeptical eye.

Key Points

Anthropic published two cryptanalysis results produced by Claude Mythos, its still-unreleased advanced model.
One result attacks HAWK, a proposed post-quantum signature scheme based on module-LIP.
HAWK is not deployed or standards-adopted, but it was far enough along in evaluation that the result matters.
The HAWK attack is still exponential-time, but it roughly halves the security level, which could in theory be countered by larger keys.
The attack is notable because it does not invent new mathematics; it extends existing tools in a more thorough way.
Anthropic also produced an improved attack on reduced-round AES, specifically a 7-round variant.
That AES result is much less dramatic than it sounds: AES itself has 10, 12, or 14 rounds depending on key size, and full AES remains unbroken.
The new AES result is only a modest constant-factor improvement over older work from 2013, and it still depends on an absurdly impractical chosen-plaintext setup.
The Anthropic post suggests the team did not carefully hand-tune domain experts around the model; they mostly pushed the model hard with prompts until it found something useful.
The bigger theme is verifiability: models can generate plausible-looking results that are wrong, so human checking becomes the bottleneck.
For the stronger “full attack” style result like HAWK, verification is easy because the code can be tested directly.
For subtler analytical improvements like the AES work, verification is much harder and may require formal methods.

My Take

What strikes me is that this is exactly the kind of task where a strong model might become genuinely useful before it becomes “smart” in any grand sense. Cryptanalysis is full of grinding through known techniques, recombining ideas, and testing whether a line of attack actually closes. That is very Claude-shaped work. I think that’s the real story here, not the hypey “AI discovered a new era of math” framing.

The HAWK result feels meaningfully important. Not because it’s a clean, devastating break of a deployed system, but because it hit something that was plausibly on a standards path. That matters. If a proposed post-quantum scheme turns out to be weaker than hoped, catching that early is exactly what cryptanalysis is for. Honestly, I’d rather see an AI help burn down bad candidate standards than generate glossy benchmark demos.

The AES result is the one people will misread. “Attack on AES” still works as clickbait, but the substance here is much narrower: reduced-round AES, old lineage, impractical assumptions, modest improvement. I think that’s useful as a technical increment, but not something normal developers should translate into “AES is in danger.” It isn’t. This is the sort of nuance the internet is bad at, and AI headlines make it worse.

What I find most interesting for Claude users is the workflow, not the domain. Anthropic appears to have treated the model like a tireless research assistant and kept iterating until it produced something checkable. That’s a pattern I’d actually expect to spread. Not “ask Claude to invent science,” which sounds silly, but “use Claude to widen the search space, then verify the interesting corners yourself.” That feels much more real.

The warning label is just as important. A model can spit out something that looks like a result and still be wrong. In cryptography, that’s not a minor annoyance; it’s the whole game. So yes, the model may be getting better at discovering things, but the human work doesn’t disappear. If anything, the burden shifts toward validation, and I think that will become the main bottleneck in a lot of technical workflows.

If you build with Claude, the practical takeaway is pretty simple: use it aggressively for exploration, not blindly for truth. Let it search, synthesize, and extend. Then verify like your reputation depends on it, because in a field like this, it does.