Mythos Just Found Flaws Human Experts Missed.

I pay $200 a month for Claude Max, and I run Claude agents on my own projects pretty much every day. So when Anthropic published a research post yesterday saying its restricted Mythos model found weaknesses in real encryption algorithms, I read the whole thing twice.

Back in March I wrote about Anthropic accidentally leaking Mythos onto the internet. Since then it has mostly shown up in stories about finding software bugs. This is different. Per Anthropic's Frontier Red Team blog, Mythos found flaws in the math of the algorithms themselves, not just mistakes in how programmers used them.

The HAWK result

HAWK is a digital signature scheme in the running to become a US government standard for the post-quantum era. NIST put out a call in 2022 for signatures that could survive quantum computers, and HAWK made it to the third round of candidates. It sat through two rounds of expert human review over two years. Nobody found what Mythos found.

Working with one Anthropic researcher over about 60 hours, Mythos spotted a hidden symmetry in the math HAWK relies on and turned it into a much faster attack, per the Anthropic post. The practical effect: HAWK keys would need to be twice as big to deliver the security everyone thought they had. For the smallest version, HAWK-256, the cost of a full key recovery was believed to be 2^64. Mythos showed it is actually 2^38, and Anthropic's paper describes recovering a HAWK-256 secret key end to end in a few hours on a single server.

Two things keep this from being a five-alarm fire. HAWK is a candidate, not a deployed standard, so nothing in production uses it. And the larger key sizes NIST is actually weighing remain impractical to attack, per Anthropic and per CSO Online's coverage. But doubling the key size wipes out most of what made HAWK attractive in the first place, so this is a real problem for the scheme.

The AES result

The second result involves AES, the cipher that protects basically everything: your banking, your messages, this website. The real thing runs 10 rounds of scrambling. Cryptographers study a weakened 7-round version to measure the safety margin, and the best attack on that version had barely moved since 2013, per a technical writeup on postquantum.com.

Mythos, working almost entirely on its own inside a testing scaffold one researcher built, invented a technique it named the Möbius Bridge. It eliminated a step where attackers had to check 256 separate values, and the result is an attack on 7-round AES that runs 200 to 800 times faster than the previous best, depending on how you measure runtime, per Anthropic.

My favorite detail: at first the model refused the assignment. Anthropic published the actual messages. Claude told its operator that AES at those round counts "is just genuinely hard" and that there is "nothing easy to find" in "the most-studied block cipher in existence." A researcher nudged it with a single message, it rewrote its own testing setup, and three days later it had the key idea. It burned through about a billion output tokens getting the attack polished.

And to be clear, per Anthropic, per CyberScoop, per CSO Online: full 10-round AES is not broken. The attack needs 2^105 chosen plaintexts, a number 32 digits long, so it is purely theoretical. Nobody's bank account got less safe this week.

What it cost, and who checked the work

Each result cost roughly $100,000 in API spend, per Anthropic. The AES attack took Mythos about a week to find. It then took two human researchers nearly a month to verify the method was correct. On the HAWK side, the human steering the model had a theoretical computer science background but was not a lattice cryptography expert.

Anthropic says it told HAWK's designers back in June, coordinated the public release with the NIST mailing list, and briefed US government and industry partners before publishing. It also released a benchmark called CryptanalysisBench, built with academics at ETH Zurich, Tel Aviv University, and TU Berlin, so other labs can measure their own models against the same ciphers.

One more data point, per postquantum.com: a separate anonymous preprint, attributed to GPT-5.6, independently attacked HAWK through a completely different mathematical path in the same two-week window. Weaker result, different route. Two frontier models finding holes in the same scheme within days of each other is a different situation than one lab announcing one result.

Why this one landed for me

I am not a cryptographer. Most of what I know about AES I learned reading this stuff last night. But I pay for Claude every month, and the setup Anthropic describes, a Claude Code style harness with multiple worker agents passing notes to each other, is the same basic pattern I run on my own projects, just pointed at my code instead of at ciphers. The bit where one worker agent rejected the key idea as infeasible and a second one figured out how to make it work? I have watched that exact dynamic in my own agent runs.

There is also a process point worth having on record. Anthropic notes this is what the NIST review process exists for, and it has happened before: a previous candidate called SIKE was broken completely, in an hour, on a laptop. Catching HAWK's weakness now, before it becomes a standard, is the system working the way it is supposed to. The harder question Anthropic raises at the end is what the playbook looks like when a model finds something like this in a system already deployed everywhere. Per CyberScoop, Five Eyes intelligence agencies warned in June that AI models capable of serious damage in the cyber domain are "months away."

Anthropic says it has already started auditing other schemes and plans to host an academic workshop in the coming weeks. The model found the AES attack in a week. The humans needed a month to confirm it. That ratio is the number I'm going to remember.