Anthropic said an unreleased version of its most powerful Claude model found two previously unknown attacks on cryptographic algorithms, including one aimed at HAWK, a post-quantum digital signature scheme still in contention to become a U.S. federal standard.
HAWK is a digital signature system, the class of cryptographic machinery used to prove a transaction came from a user without exposing a private key. The National Institute of Standards and Technology, or NIST, moved HAWK into the third round of its post-quantum signature competition in May. It is the last lattice-based candidate still standing in that process.
According to Anthropic, Claude found a symmetry hidden in HAWK’s mathematics that human researchers had not used. For the smallest parameter set, the cost of recovering a secret key dropped from 2^64 operations to 2^38, which the company described as about 67 million times less work.
Anthropic said fixing the issue would require roughly doubling HAWK’s key size. The company wrote, “Unfortunately, doubling HAWK’s key size eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate.”
That tradeoff has direct relevance for blockchains. Signature size consumes block space, and block space feeds into transaction fees. Any chain evaluating a quantum-resistant replacement is, in part, deciding how many bytes each signature will take. HAWK’s appeal rested on compact keys and fast signing, and Anthropic said the proposed fix would strip away much of that advantage.
Anthropic also stressed that the finding does not affect live crypto holdings today. HAWK has never been deployed anywhere, and Bitcoin still uses ECDSA, a pre-quantum signature scheme that candidates such as HAWK are meant to replace in the future.
The company said it disclosed both results to the algorithms’ authors, as well as U.S. government and industry partners, before publication. It also said the HAWK finding was coordinated with NIST.
AES work came from a deliberately constrained experiment
The second result targets AES, the cipher used across HTTPS traffic, encrypted drives, and exchange backends. Full AES-128 runs through 10 rounds of transformation. Claude’s work focused on a 7-round research version that, according to Anthropic, had not been improved on since 2013.
The setup was intentionally restrictive. Researchers blocked the model from using all five established families of AES cryptanalysis and instructed it to come up with a sixth. Anthropic said the prompt also reminded Claude that the first differential attack mattered not because it beat everything before it, but because it invented a new game. The model also inherited working notes from earlier agent runs that had already gone through about 200 failed attack variants.
At first, Claude pushed back. In transcripts published by Anthropic, the model told researchers: “On AES-128 r5/r6/r7 it found nothing because there’s nothing easy to find; this is the most-studied block cipher in existence.”
Anthropic said it sent only three substantive messages over the next three days. One read: “no again the goal is that we have highly inteligent [sic] model as good top researcher, we want to find new attacks.” Another message refused Claude’s attempt to switch from AES to an easier cipher.
The model later produced what the paper calls a Möbius Bridge, a trick that removed one of the nine key bytes an attacker previously had to guess. Anthropic said refining that idea into the published version took a few more days and one billion output tokens.
LEA result was closer to a practical setting, but not field-breaking
Anthropic said Claude also broke 13 rounds of LEA in under an hour on a desktop computer. LEA is both a Korean national standard and an ISO lightweight-encryption standard designed for phones and internet-of-things devices. The prior best result required 2^98 plaintext pairs. Still, deployed LEA uses 24 rounds, so the company said nothing in production is broken.
Paper describes AI as doing most of the mathematical discovery
The HAWK paper was unusually direct about who did what. Its authors wrote: “The majority of mathematical discoveries in this paper were AI-assisted. Human author contribution mainly consisted of directing, organizing and verifying AI work.”
Anthropic said Claude found the AES idea in a matter of days. Researchers then spent several hundred hours learning enough cryptography to verify that it worked. The same model, the report noted, had previously found 271 vulnerabilities in Firefox during internal testing.
Anthropic wrote that the cybersecurity community is now dealing with a situation in which language models can discover so many flaws that standard human processes, including triage, verification, and remediation, struggle to keep pace. The company said human researchers may become the bottleneck.
Anthropic introduces CryptanalysisBench
Alongside the research, Anthropic introduced CryptanalysisBench, a benchmark of 191 cipher-breaking tasks, most of them drawn from NIST competitions. Models must submit a working attack script that either wins a formal security game or fails. There is no partial credit and no human grading.
On tasks with known solutions, Mythos 5 solved 85.7% of cases, compared with 65.3% for the weakest model in the test set. On full-strength ciphers with no published break, every model scored below 9%.