Cryptography breakthrough: how AI uncovers flaws in HAWK and AES algorithms

Recent research by Anthropic’s Frontier Red Team reveals critical vulnerabilities in two cryptographic algorithms, HAWK and a reduced version of AES, discovered through AI-assisted analysis. While these findings do not pose immediate threats to current systems, they underscore the evolving landscape of cryptographic security.

The short flight of the post-quantum falcon

HAWK, a digital signature scheme designed to resist quantum computing attacks, was once a strong candidate in the NIST’s post-quantum cryptography standardization process. The algorithm had successfully passed two rounds of expert evaluations over two years. However, Anthropic’s research demonstrated a critical flaw in its design.

The vulnerability was uncovered using a pre-release version of Mythos, an AI model not yet publicly available. By leveraging geometric symmetries in the Euclidean lattice isomorphism problem—HAWK’s underlying security assumption—the research team reduced the key recovery complexity from 2⁶⁴ to 2³⁸ operations. This breakthrough enabled the extraction of a secret key in just 3 hours and 42 minutes on a standard 96-core server.

To restore acceptable security levels, HAWK’s designers would need to double the key and signature sizes, compromising its primary advantage: computational efficiency. Consequently, the HAWK team withdrew the algorithm from the NIST selection process on July 29, 2026, rendering it obsolete.

What’s really happening with AES?

AES, the Advanced Encryption Standard, is a widely deployed symmetric encryption algorithm used globally in banking systems, TLS protocols, and hardware acceleration by major chip manufacturers. Anthropic’s research focused on a deliberately weakened version of AES-128, reduced to 7 rounds instead of the standard 10.

The breakthrough involved a novel technique called the “Möbius Bridge,” an invariant fingerprinting method integrated into a meet-in-the-middle attack. This innovation eliminated a computationally intensive step requiring 256 iterations, accelerating the attack by a factor of 200 to 800 compared to prior work from 2013. While this vulnerability is confined to academic research, it highlights the need for continuous cryptographic scrutiny.

The French National Cybersecurity Agency (ANSSI) recommends using symmetric keys of at least 192 bits for post-quantum security, with AES-192 and AES-256 offering robust alternatives to AES-128.

Reflections on these discoveries

Despite the lack of immediate impact on current systems, these findings raise important considerations for the cryptographic community. First, HAWK’s withdrawal underscores the fragility of post-quantum algorithms under sustained scrutiny. Second, the efficiency of AI in uncovering vulnerabilities poses new challenges for validation processes.

Anthropic’s research required approximately 60 hours of autonomous computation, costing an estimated $100,000 using commercial API tools. Interestingly, the pre-release version of Mythos initially refused to execute tasks on the reduced AES variant, asserting that no improvements were possible on such a well-established algorithm. Only after refining the research scaffolding did the model generate a billion tokens over several days to devise a new attack method.

The findings underwent rigorous validation by two researchers over a month, ensuring mathematical rigor and eliminating potential hallucinations. This process highlights the growing pressure on human experts to validate AI-generated results amid an explosion of discovered vulnerabilities.

The bottleneck shifts: AI-driven cryptanalysis

These discoveries are not isolated. Anthropic hinted at further publications, signaling a broader trend: AI is becoming a powerful tool in cryptanalysis. The real challenge now lies in human validation—triaging, verifying, and mitigating AI-generated findings—rather than in discovering them.

While AI accelerates cryptographic analysis, it does not replace human expertise. The HAWK and AES cases demonstrate that perseverance and deep understanding remain irreplaceable. As AI models like Mythos evolve, the cryptographic community must adapt to ensure robust security in an era of AI-assisted discovery.