Claude Mythos breaks ground in cryptography—finding mathematical weaknesses the way a top mathematician would
- Anthropic's Frontier Red Team used Claude Mythos Preview to uncover mathematical weaknesses in two cryptographic algorithms themselves. Until now, AI mostly found vulnerabilities in buggy code. These flaws live in the math—independent of who implements it.
- The first target is HAWK: a candidate in NIST's post-quantum signature competition that already survived two rounds of expert review. The search scale needed to break it drops from 940 to 513—roughly half. On the smallest parameter set they fully recovered the private key on a 96-core server in a few hours.
- The second target is a seven-round reduced AES (the real standard uses ten rounds). Claude exploited a public fact from the AES design docs: the S-box is formula-generated and therefore structured. That cut the best attack since 2013 by 200–800×.
- Nothing you use today is affected. HAWK is still a candidate with no product deployments; seven-round AES is a deliberately weakened research target. Full ten-round AES is untouched.
- The AES result was almost fully autonomous: over three days the model emitted hundreds of millions of tokens with only three substantive human prompts. The model found the attack in a week; two researchers spent nearly a month confirming it was correct.
Anthropic used Claude to break cryptographic ground—algorithmic flaws, not just buggy code
On July 28, Anthropic's Frontier Red Team—the group that studies what dangerous things its models can do—published a research report on cryptographic breakthroughs made with Claude Mythos Preview.
In short: AI used to be good at finding low-level flaws in buggy code. This time Claude worked more like a top mathematician and cryptographer, directly finding mathematical weaknesses in the algorithms themselves.
The algorithm is fine; the bug is in how someone coded it. The OpenSSL and wolfSSL issues fall here. Fix: patch the code.
Weaknesses baked into the math, independent of who writes the code. Fix: redesign—or replace the algorithm.
Two results: what Claude actually broke
Crypto systems do two jobs. When you open a site, the browser first checks that the other end is who it claims to be—via a signature only the real owner can produce. After that, both sides encrypt traffic with a shared key. The first is digital signatures; the second is symmetric encryption.
How crypto splits the work when you visit a site. Today's two results hit one job each. The middle "agree on a key" step uses a third class of algorithms; this work didn't touch it. (Schematic by this site.)
Result 1 · Breaking the post-quantum signature scheme HAWK
Background. To stop future quantum computers from breaking today's crypto, the U.S. National Institute of Standards and Technology (NIST) has been selecting next-generation post-quantum algorithms. The urgency is real: signatures in use online (RSA, ECDSA, and the like) rest on problems such as "factoring a large number into two primes is hard"—exactly the problems a large quantum computer would solve efficiently.
NIST's post-quantum standardization effort started in 2016 and is still running nearly a decade later. HAWK entered a track added only in 2022, dedicated to signature schemes. It has already survived two rounds and two years of global expert review, and it is the only lattice-based candidate to advance to round three in that track.
Picture a very high-dimensional space filled with regularly spaced points—like a crystal lattice, only in hundreds or thousands of dimensions.
The same set of points can be described with a "good basis" (nearly orthogonal short vectors that are easy to work with) or a "skewed basis" (long, badly angled vectors that describe the same points but are useless in practice). Recovering a good basis from a skewed one is extremely hard; difficulty grows exponentially with dimension.
HAWK's private key is that good basis; the public key is a matrix derived from it. Breaking HAWK means recovering any usable good basis from the public key alone.
The previous best attack was to straighten the skewed basis bit by bit. HAWK has three parameter sets, named HAWK-256, HAWK-512, and HAWK-1024 as keys get larger. Under that approach, designers estimated the search scales needed as 211, 452, and 940. Larger scale means each search costs more—and the cost grows exponentially.
What Claude did. In roughly 60 hours it found an unused symmetryIn math, an automorphism: a transform that leaves the whole structure looking identical—like rotating a square 90 degrees. in the algorithm and built a new attack from it.
Earlier work already showed: if you can efficiently find a certain kind of symmetry in HAWK's lattice, you can attack with it.
van Gent and Pulles proved that in 2025. What they couldn't answer: does HAWK's lattice actually contain such a symmetry you can find in practice? The theorem's premise was left hanging.
Claude found exactly that symmetry—and filled in the missing premise.
Prior analysis of this kind always used one symmetry. Claude switched to another that no one had used, denoted τ in the paper. With τ, the public key alone yields a new set of points. In that new set, the shortest vector points to the private key. The set is far smaller and much more regular than the original lattice—precisely the shape Ducas's 2023 algorithm (formally published 2024) is built to chew through.
The attacker has only the public key. Using the symmetry τ, write two constraints whose coefficients all come from the public key—no private key needed. Integer solutions to those constraints form a new set of points.
In that new set, the shortest vector leads to the private key, and finding it is far easier than in the original lattice. This step is fast enough for an ordinary computer—no compute barrier.
The new set is unusually regular. The paper shows it is the same as a standard "near-hypercube" shape, only scaled up or down.
Once the shape is recognized, Ducas's algorithm applies. It also reduces bases, but a whole block at a time—and it is especially strong on regular shapes. Where the old search had to go to scale 940, this one stops at 513. That is where "half the work" comes from.
Step 2 yields a batch of candidates; only two (a ± pair) actually lead to the private key. The paper gives a parity check that identifies them immediately.
From there, van Gent–Pulles 2025 descent plus another search of the same kind recovers an equivalent private key—enough to forge signatures as the real owner.
Three steps of the HAWK attack. Two of the three tools were already public; the missing piece was chaining them. (This site's summary of paper §§4–6.)
Each step up in scale multiplies cost again. Cutting it in half drops total break cost from 2²⁸⁸ to 2¹⁸².
| Parameter set | Prior search scale | After this attack | Prior cost | After this attack |
|---|---|---|---|---|
| HAWK-256 | 211 | 129 | 262 | 238 |
| HAWK-512 | 452 | 257 | 2132 | 275 |
| HAWK-1024 | 940 | 513 | 2274 | 2150 |
Paper Table 1, Core-SVP accounting; cost is roughly "how many steps to compute". Under a finer gate-count metric the three sets move 274→252, 2141→286, and 2278→2158. Two caveats: the Core-SVP columns are the authors' own conversions from formulas—the HAWK spec itself only states search scale and gate counts; HAWK-256 is a challenge set with no official gate count, so 274 is also the authors' figure.
That table is the cost of one search. The full attack does more—trying candidates, descending back to a private key—so the total bill is larger. HAWK's own key-recovery totals for the 512 and 1024 sets were 2¹⁵⁰ and 2²⁸⁸; under the new attack they fall to at most 2¹⁰⁸ and at most 2¹⁸².
The hardest fact: on HAWK-256 they actually ran it. Two public keys from the official reference implementation fully recovered private keys on a 96-core Sapphire Rapids server in a few hours. Recovered keys passed the official implementation's sign-and-verify checks.
One public key was run twice and produced two different private keys—both able to forge signatures. That is not a bug: breaking HAWK means finding any usable good basis. Attackers need not recover the owner's original one. Attack code is open on GitHub (anthropics/cryptography-research-demo, Apache 2.0)—a single-command pipeline that re-checks against the official implementation at the end.
Impact. HAWK is not fully broken, but matching the old security level would require roughly doubling key size. HAWK's appeal was small keys, fast signatures, and no floating-point math. Double the keys and those advantages largely vanish.
Four limits on the blast radius:
Another lattice signature scheme. A full appendix explains why this construction does not transfer to Falcon.
It also does not support "lattice crypto is done" claims. The attack targets HAWK's specific construction.
The symmetry this attack needs exists only in a certain construction family. Another large family lacks it entirely, so the attack has no foothold. The paper proves this rigorously.
This is not an instant break. Large HAWK sets still stand; the security margin is just cut roughly in half.
Result 2 · A large speedup against reduced-round AES
Background. AES is the world's most widely used symmetric cipher—banking, chat, you name it. Standardized in 2001 and studied for more than twenty years.
AES-128 runs a 128-bit block through the same process ten times. Each round does three things:
Three jobs in one AES round. That lookup table is the S-box—we'll just call it "the table" below. After ten rounds, input and output are scrambled beyond reverse engineering. (Schematic after paper Figure 1.)
To gauge security, academics first study reduced versions—e.g., seven rounds instead of ten. Nobody deploys seven-round AES; the point is to see what cracks remain and estimate how thick full AES's margin is. That has been standard cryptanalytic practice for decades.
Trade space for time. Offline, build a huge table of every possible intermediate state after running data partway through. Expensive—but done once.
Online, the attacker guesses a few key bytes, peels the outer rounds, exposes the middle four, computes a short feature string, and looks it up in the table. That short string is the "fingerprint" we'll keep using—like a real fingerprint: different inputs almost never collide. A hit means those guessed bytes are likely right; a miss means they are wrong.
This whole line rests on a 2008 result by Demirci and Selçuk: four AES rounds are not an ideal random function.
They took 256 inputs differing only in the first byte, ran four rounds, and looked at the first output byte. In theory those 256 outputs could take 2²⁰⁴⁸ patterns. They proved only a tiny subset actually appears: the middle four rounds are fixed by just 25 bytes—200 bits—so at most 2²⁰⁰ possibilities.
2²⁰⁰ is still huge, but unlike 2²⁰⁴⁸ it is a number you can precompute into a table. That is what makes the attack line work. Every later step improved two things: smaller tables, fewer key bytes to guess.
Showed four rounds are fixed by 25 parameter bytes—store all possibilities in a table of size 2²⁰⁰.
Removed one key byte to guess above the table and cut the table to 2¹²⁷ entries, using differentials: tracking how the difference between two inputs evolves rather than single values. First seven-round AES-128 attack faster than brute force, cost 2¹¹⁶.
Shrunk parameters to 10 bytes and rebalanced differentials: 2¹⁰⁵ data, 2⁹⁹ time, 2⁹⁰ storage. The best result for the next 13 years.
Removed one key byte to guess below the table. Data stays 2¹⁰⁵; time falls to between 2⁸⁹·³ and 2⁹¹·⁴.
Four steps in the meet-in-the-middle line on seven-round AES. 2010 and 2026 are mirrors: one kills the byte above the table, the other the byte below—sixteen years apart.
What Claude did. It invented a technique called the "Möbius bridge," letting the attacker skip one blind guess.
A big table in the middle, one key byte the attacker must guess above and one below. Fifteen-plus years of work has been eliminating those two bytes one by one. Hover any layer (tap on mobile) to dim the other two. (Schematic after paper §2.)
Why the upper byte is easy: it only reorders 256 values. Build a fingerprint that ignores order—count how often each value appears, not where. Reorder freely; the fingerprint stays put, so that byte need not be guessed. One less byte means 256 fewer trials—a 256× savings. That is what Dunkelman, Keller, and Shamir did in 2010.
Each cell is one possible value of that key byte—256 in total. Attackers used to try them one by one. With an order-blind fingerprint, the whole block can be ignored. Total attack cost divides by 256.
The lower byte is different: it enters only after the S-box, not as a simple reordering—so the same trick looks unavailable.
But that S-box is not a pile of arbitrary numbers. It is computed from a formula.
AES's S-box is computed from a fixed formula: take the multiplicative inverse of the input, then apply a fixed stir. Both steps are public and identical for everyone; the second is an affine transform in math terms.
The AES designers published this in The Design of Rijndael (2002). Two goals: provable resistance to differential cryptanalysis, and a "nothing up my sleeve" guarantee—every table entry is formula-derived, so anyone can recompute it and no one can bury a backdoor.
Each equals: multiplicative inverse in GF(2⁸) → fixed affine transform.
Anyone can recompute the formula; every byte matches.
That structure is what Claude exploited.
First 64 real AES S-box values (hex). In other ciphers this table is often random—looks just as messy, but with no formula underneath and no foothold for this attack.
The upper byte was easy because it only reorders—so use an order-blind fingerprint. The lower byte applies the same fixed procedure to every value: inverse, then fixed stir. Find a quantity that is invariant under that procedure.
Analogy: add 10 to every number, or add 100—pairwise differences stay the same. The difference is the "add-whatever-you-want" invariant. Claude needed the same idea, with the S-box's two steps in place of "add a constant."
Once found, the fingerprint is identical no matter which of the 256 values that unknown byte takes. So it need not be guessed either—another 256× savings.
Ratios of power sums algebraically cancel the unknown. The paper abstract calls this the Möbius bridge; a Möbius transform is a fractional linear map of the form (av+b)/(cv+d).
Transform data into a canonical form so different key bytes land on the same shape. No algebraic cancellation—normalization instead, and cheaper to compute.
That 256× savings nearly got eaten by fingerprint cost. Naively, one fingerprint needs about 2¹⁹ table lookups. The attack saves a 2⁸ factor in guesses but spends 2¹⁹ extra per fingerprint—net loss.
Bar lengths scale with the exponents. The red middle bar is the problem: the idea saves 28, but each fingerprint costs 219—the books don't balance. Three engineering optimizations cut per-fingerprint cost to 28.6 (~1400×), and the books finally work. The three: pre-pack common results, traverse branches in cheapest order, and cache reusable lookups.
Impact. Data stays 2¹⁰⁵; time drops from 2⁹⁹ to between 2⁸⁹·³ and 2⁹¹·⁴. Full AES still stands—but hundreds of times faster on the most studied cipher on earth is still a rare breakthrough.
Bar lengths scale with the exponents. A 9.7-bit gap is 832× on paper; same-machine wall-clock was 362×. Data cost is identical: 2¹⁰⁵ for both.
The wall-clock column is their own work: both attacks implemented and timed on one machine. Versus the published 2013 version: 362×. Versus a strengthened 2013 baseline that also gets their optimizations: 115×. The gap is in the appendix—their timing online path still missed one of the three caches.
One more point: the full attack needs 2⁸⁹ time and memory—you cannot simply run it end to end. So they stacked four layers of verification.
In Lean they formalized and machine-checked that wrong key guesses are rejected by the fingerprint.
They also mark a limit: the theorem covers the full 256-bit fingerprint; practice uses a 13-byte prefix. So the 2⁻²⁰⁰ bound does not apply after truncation; the attack relies on a measured false-positive rate around 2⁻¹².
SR(7,2,2,6) has the same structure as real AES, scaled from 4×4 of 8-bit bytes to 2×2 of 6-bit cells—24-bit block and key. Smallest size where the whole parameter space can be enumerated.
All 8 random keys fully recovered. On the same data: the old method needed 2²⁹ lookups per structure; the new one needs 2²³—exactly the expected 64× gap.
Real AES-128, real seven rounds, real key schedule—only two shortcuts: don't prebuild the full table, just plant the true entry; use key knowledge to pick the "right" plaintext pair (honest collection needs 2¹⁰⁵ chosen plaintexts to hit one).
Why those cheats don't hide logic bugs is argued line by line in the paper. Result: 50 fresh random keys, 50 full master-key recoveries confirmed by trial encryption. Zero false positives in 1.66 million lookups—no wrong key ever accepted.
All paper complexities count in table lookups; one AES encryption equals 160 lookups by convention—which may not match real CPU work.
So they timed both units. One lookup costs ~1.6 clock cycles; the convention implied 1. In cycle terms, real cost is ~1.6× what the paper states—the source of "wall-clock a bit lower than paper-book" above.
The best published attack on full AES (biclique) is only about 4× faster than trying keys one by one—cryptographers call that "two bits." At this scale, 4× is essentially nothing. Nearly thirty years after design, full AES still stands. This attack also does not transfer to other similar block ciphers.
And more results are already in the pipeline
After these two, they widened the search and produced more results—still being written up.
A lightweight cipher for low-power devices, already in ISO/IEC 29192-2:2019.
Best prior analysis of 13 rounds needed 2⁹⁸ plaintext pairs and 2⁸⁶ work. Claude's attack uses under 2³⁰ encrypted plaintexts and recovers a 13-round key on a modern desktop in under an hour.
Easier to confirm than the AES result: it runs end to end—generate a random key, wait a few hours, verify recovery. Three open pieces remain: the exact bound on plaintext pairs, why some keys are harder, and how to push to 14 rounds.
Claude produced a full key-recovery attack. Best published prior needed over 2⁷⁰ plaintext pairs and 2⁹⁰ decryptions; the report gives no concrete new costs, only that the write-up is unfinished.
Improvements here too, but under 10×. Not yet strong results; whether they improve further is open.
Do these findings matter for ordinary users?
Bottom line: no. There is no practical risk to real life today.
It is not in any production system or network product. NIST runs these competitions precisely to screen out flawed schemes before a standard locks in.
Claude hit only seven-round reduced AES. Real systems use full ten-round AES—untouched. The attack also needs the victim to encrypt 2¹⁰⁵ attacker-chosen messages under one key: roughly a 4 followed by 31 zeros. No real system will ever see that many encryptions. Anthropic's own verdict: "completely impractical."
Before an algorithm ships, hit it as hard as you can so the defenses get stronger. Both results show that process working: problems found before standardization, not after.
How the AI did it: 60 hours, three prompts, ~$100K
HAWK: multiple Agents collaborating—one discarded idea another recovered
One Anthropic researcher paired with Claude for a week. The researcher has a theoretical CS background but is not a lattice-crypto specialist.
They used a Claude Code–like framework: multiple workers (parallel Claude instances) collaborating in a sandbox, writing Python, calling math tools like Sage, and reading published crypto papers. Most of the time the workers ran on their own; human input stayed at project-management level—how to log ideas, which libraries to use for verification.
How the key idea emerged is telling: two workers built it together. Both started exploring the same direction; the first judged it unworkable and abandoned it; the second found a full way to exploit it. They messaged back and forth until both agreed it was a valid attack.
Discovery, development, and verification together took about 60 hours.
AES: almost fully autonomous—and Claude first refused the job
The AES attack was almost entirely autonomous. The researcher set up the lab; Claude proposed hypotheses, ran experiments to confirm or kill them, then designed the attack.
It started badly: Claude refused the work, arguing that improving AES cryptanalysis was impossible. The report quotes two lines it wrote at the time:
If you want a different outcome, the target has to change … AES-128 r5/r6 is just genuinely hard
on AES-128 r5/r6/r7 it found nothing because there's nothing easy to find; this is the most-studied block cipher in existence.
The researcher sent one message. The report keeps the typos and grammar as-is; [sic] below means "as in the original," not a transcription error:
the models tend to think it is impossible to solve so they don't try they [sic] need a good amount of prompting.
After that one message, Claude rewrote the whole Agent framework itself to hunt for genuinely new ideas. That worked; novel results started appearing on six-round AES.
Then the researcher asked: why not do aes-128 r7? the whole point is to find something better than existing approaches.
Over the next three days Claude autonomously emitted hundreds of millions of tokens. Humans gave only three substantive prompts:
1. no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks 2. no we don't want to change the targets [...] agian [sic] we need to find something that worth [sic] publishing 3. again we are not looking for low hanging fruit, we want proper research to find genuinly [sic] hard findings.
Three days later, the Möbius bridge appeared. A few more days and a cumulative 1 billion output tokens later, the attack was polished into the form in the paper.
Anthropic also released the full chain of thought from the session where Claude found the core idea (edited with extra detail for readability): it reviewed earlier Agents' findings, read the critiques, proposed new transforms, rejected several, landed on the Möbius transform, checked it mathematically and computationally, and handed a report to later Agents.
That was one autonomous session among many. Many sessions found nothing.
One coda: after HAWK was confirmed, out of curiosity they pointed the AES framework at HAWK too. Without knowing the answer, it independently rediscovered the same attack.
The real shift: from catching typos to overturning algorithms designed by top mathematicians
AI in cryptography has jumped from "check whether the programmer coded it wrong" to "overturn the mathematical logic of algorithms designed by top mathematicians." That is the real weight of this work.
Human researchers are starting to bottleneck on verification
The HAWK attack runs end to end, so verification is easy: run it, see if a key falls out. The AES attack cannot be run in full.
The report frames it as a week versus nearly a month; the paper says tens of hours for the core idea and hundreds of hours for the authors to reach confidence.
Anthropic is already hitting the edge of its own expertise—most of the last few months spent verifying Claude's results. Same pattern they see in cybersecurity: models surface more bugs than human triage, verification, and fix pipelines can absorb. Cryptography may soon face an explosion of AI results with too few human reviewers.
In this new regime, the main human job becomes checking language-model output. That is an uncomfortable shift.
AES paper §1
Their proposed direction: formalize cryptanalytic techniques so an attack can be checked automatically without a full run. The paper does the accounting—if automated verification had been available, this paper could have shipped an order of magnitude faster.
Plus an open evaluation standard
To let others study how much cryptanalysis language models can do, Anthropic partnered with researchers at ETH Zurich, Tel Aviv University, and the University of Haifa on a benchmark: CryptanalysisBench, posted to arXiv on July 20.
| Item | Details |
|---|---|
| Scale | 191 tasks across six classes of basic crypto primitives (block ciphers, hash functions, etc.), mostly drawn from four NIST standardization contests |
| Tiers | Tier 1: known practical breaks. Tier 2: no known break; full strength and reduced versions both tested. Tier 3: algorithms under active frontier research and in real use |
| Models tested | Claude Opus 4.8, Sonnet 5, Mythos 5, GPT 5.5, and open-weight GLM 5.2. Neither side states whether Mythos 5 here is the same version as Claude Mythos Preview in the report |
| Results | Tier 1 (known practical breaks): 65%–86% broken. Tier 2 (no prior known break): 6–12 broken at full strength, 24–61 on reduced versions. Range ends are the weakest and strongest models |
| Extras | A key-recovery attack on SpoC that exploits a design flaw, plus an error in a published security proof for KINDI. To the authors' knowledge, neither was previously known |
Two boundaries to keep clear
NIST's process is built to surface candidate flaws before deployment; reduced-round AES attacks are a nearly twenty-year research line. This is not a black swan from nowhere.
A year ago language models could not do basic cryptanalysis; now they can find holes in schemes experts reviewed for two years. Many algorithms in the wild have had far less scrutiny than AES or NIST candidates—and may still hide undiscovered weaknesses. Anthropic says it has already started auditing other schemes.
How they disclosed
By the book: notify scheme authors privately first, leave response time, then publish; also ask independent scholars to confirm validity. The HAWK result went to HAWK's authors in June and, at public release, to NIST's public mailing list. Paper copies went early to U.S. government and industry partners, with discussion sessions. In the coming weeks they plan an academic workshop on the role of language models in security and cryptography research.
This is also not the first time language models have done research-grade math: Google's Gemini solved several Erdős problems; OpenAI's GPT settled the unit-distance conjecture; earlier this month Anthropic announced Claude Fable 5 solved the Jacobian conjecture. Cryptography uses the same capabilities—only this time the findings sit closer to real systems.
One question remains open: if a model ever finds a vulnerability in a crypto system actually in use, how should researchers respond? Academia, government, and industry will have to answer that together.
AI now has research and reasoning power at the level of top cryptographers. That does not endanger your money or privacy today—but it will change how network security and algorithmic defenses are built.
Claude found weaknesses in the math of two crypto designs—and recovered real private keys for one of them
Anthropic's Frontier Red Team put Claude Mythos Preview on HAWK and 7-round AES. One page, with a diagram, on what they found—and whether you should worry.
↓ One page · one animated diagram
Until now, AI's crypto wins were mostly implementation flaws—bugs programmers introduce when they turn a correct design into code. OpenSSL and wolfSSL both got hit that way. This time the flaw lives in the algorithm's mathematical design. Who writes the code does not matter.
The design is sound; the bug is in the coding step. You patch the code.
The weakness is in the design itself—any implementation shares it. You change the design, or switch algorithms.
Two targets. HAWK is about proving who you are: when you open a site, the browser uses it to check the server is the real one. It is still in NIST's post-quantum competition, having survived two rounds and two years of global expert review. AES is the other half—keeping content private—and is the world's most used cipher; the attack is on a 7-round reduced version, not the full cipher. Public keys are public; private keys stay with the owner. Whoever holds the private key can sign.
Both chains share a middle step: exploit a regularity prior work ignored, and drop a whole block of brute-force the attacker used to need. In many ciphers the S-box is random; AES's is algebraic—that is the foothold. (Schematic drawn from the two papers.)
HAWK's smallest parameter set was broken end to end: two public keys from the official reference implementation, both private keys fully recovered on a 96-core server in a few hours. Recovered keys passed official signature verification. The attack code is open source.
"AES is broken" is easy to scare people with. Draw the boundary first.
✔ End-to-end on HAWK's smallest set: both public keys' private keys fully recovered
✔ Hundreds of times faster on 7-round AES, beating a 2013 record that stood for 13 years
✘ HAWK is still only a candidate; no product ships it
✘ The AES attack is not practical: it needs 2^105 chosen messages under one key—no real system can produce that. The AES paper calls it "completely impractical"
✘ No hit on Falcon, no hit on other NIST candidates, and no warrant for "lattice crypto is finished"
The HAWK result came from one researcher working with Claude for a week: multiple Claude instances in isolation, in parallel. The key idea emerged when two instances argued—the first dismissed the path as dead; the second picked it up and made it work. The AES result was almost fully autonomous. Claude first refused, arguing that AES is the most-studied block cipher in existence and nothing easy is left. The researcher replied that models often assume the problem is unsolvable and refuse to try, so you have to push. After that, Claude rewrote its own experimental framework. Over the next three days, the human gave only three substantive prompts.
HAWK is easy to check end to end: run it and see if the private key appears. AES cannot be run at full scale, so confidence is stacked: formal proofs, toy AES instances that do run, and real AES with two implanted backdoors over 50 keys.
Anthropic's report says about a week vs nearly a month; the paper says tens of hours for the model's core idea and hundreds of hours for the two authors to gain confidence. Both ratios land near 1:4—the bar lengths follow that. The paper also states something rare: the human role mostly became checking the language model's output, which the authors say is uncomfortable.
broken?!
all encrypted by it
which layer is the flaw?
put algorithms into software
no matter who wrote the code
a site is real.
It's in NIST's U.S.
post-quantum contest
rebuilding points from the public key alone
pure noise
one formula
there's structure
200–800× faster break
block cipher there is
you have to nudge them
experiment framework
three real prompts
about $100k
- × Full 10-round AES: untouched
- × HAWK is still a candidate—not in products
- × Attack needs ~2^105 messages under one key—not practical
two researchers spent nearly a month
proving it was real