By Blumefield | July 31, 2026 The field of post-quantum cryptography just met a faster adversary than any human reviewer, and the standards race may never look the same.
A 60-Hour Break That Two Years of Review Missed
For most of the last decade, the world of post-quantum cryptography has moved at the deliberate pace of academic peer review. Candidate algorithms are proposed, dissected by specialists, and slowly whittled down over years of public scrutiny before anyone dares to build them into a browser or a bank. That rhythm just met something faster. Anthropic disclosed on July 28 that its still-unreleased Claude Mythos Preview model found a previously unexploited mathematical flaw in HAWK, a digital signature scheme that had survived two full rounds of expert examination inside the U.S. government's standards process. The work took roughly 60 hours.
The finding effectively halves HAWK's security, meaning its keys would have to double in size to keep the same protection. That change strips away nearly every efficiency advantage that made the scheme attractive in the first place. One day after the result went public on the NIST mailing list, HAWK's authors withdrew it from consideration. A candidate that a great deal of human effort had failed to break was retired within 24 hours of a machine pointing at it.
The mechanism is worth understanding, because it explains why this matters for post-quantum cryptography as a whole. HAWK's security rests on the hardness of the Lattice Isomorphism Problem. Mythos located a specific symmetry, a nontrivial automorphism, hidden in the lattice HAWK relies on. Earlier academic work had shown that finding such a symmetry would enable an attack, but had not established whether one was actually reachable in HAWK's particular structure. The model answered the open question, then wrote code that recovers a key from a weakened challenge version of the scheme in under four hours on a single server. You can read Anthropic's full research disclosure and verify the demonstration yourself.
Why HAWK Mattered
To grasp the stakes, it helps to know why anyone was building HAWK at all. The entire field of post-quantum cryptography exists because a sufficiently powerful quantum computer would break the public-key systems that secure most of the internet today, including RSA and elliptic-curve schemes. In 2022 the National Institute of Standards and Technology issued a call for additional signature designs that would stay secure in that future, and HAWK was one of the remaining third-round candidates. Details of that competition sit on the agency's post-quantum cryptography project pages.
HAWK's pitch was efficiency. It promised unusually compact signatures and fast performance, qualities that would have made it valuable in constrained hardware and high-volume systems where every byte and cycle counts. A late-stage break does not mean the standards process failed. The opposite is closer to the truth. Public review is designed to expose weaknesses before deployment, and history offers precedent. During the earlier round that produced today's standards, one candidate called SIKE was famously cracked on a laptop in about an hour. Catching HAWK now, rather than after it protected real traffic, is the system working as intended.
What unsettles specialists is not that HAWK fell but how. According to Johns Hopkins cryptographer Matthew Green, who published a detailed analysis of the results, the attack invented no exotic new mathematics. It stitched together tools that were already lying around and simply applied them more thoroughly than any human had bothered to. Green quotes the model's own summary calling the outcome "a little embarrassing for the field," because none of the ingredients were rare. Thoroughness at machine scale, it turns out, is exactly the kind of labor where these systems now excel, and post-quantum cryptography has a long tail of candidate schemes that have never received the exhaustive attention they deserve.
The AES Result and What It Is Not
Anthropic paired the HAWK break with a second, flashier-sounding claim: an improved attack on AES, the symmetric cipher that encrypts a large share of the world's data. Read past the headline and the picture calms considerably. The work targets a deliberately weakened seven-round version of AES-128, not the full 10-round cipher that actually protects real systems. Researchers routinely study these reduced-round variants to probe a cipher's margins without pretending to break the real thing.
Within that research setting, the model produced a genuine advance. It devised a fingerprinting technique it named a "Möbius Bridge" that removes a 256-way guessing step from a known meet-in-the-middle attack, speeding it up by a factor of between 200 and 800. Impressive as that sounds, the underlying attack still assumes an adversary can obtain encryptions of 2^105 chosen plaintexts, a quantity with no relationship to anything achievable on Earth. Green is blunt that this is a modest constant-factor improvement on work dating back to 2013, interesting to specialists and irrelevant to your bank. Full AES remains, in his memorable phrase, like a tractor buried in cement.
The contrast between the two results is the real lesson for post-quantum cryptography and classical encryption alike. One retired a live standards candidate; the other nudged an academic benchmark. Both, however, came from the same model working with minimal human steering, which is why neither can be waved away.
Verification Becomes the New Bottleneck
The most quietly radical part of Anthropic's account is not the attacks but the workflow. The HAWK result came from a researcher with a theoretical computer science background who was not a lattice-cryptography expert, guiding the model mostly on project management rather than substance. The AES result was even more autonomous. The model initially refused to engage, insisting the problem was impossible, until researchers prodded it with a few grammatically rough encouragements to stop looking for low-hanging fruit. Over three days it generated hundreds of millions of tokens and produced the Möbius Bridge idea largely on its own. Each result cost roughly $100,000 in compute.
That inversion creates a new choke point for post-quantum cryptography research. When a machine can generate plausible research faster than humans can check it, verification, not discovery, becomes the scarce resource. Anthropic's team spent nearly a month gaining confidence that the AES method was even correct, far longer than the model spent finding it. Green makes the same point from the outside: models are now very good at producing results that look real, which makes careful human review more necessary than ever, not less. Fully runnable attacks like the HAWK code are easy to confirm because anyone can execute them, but subtle speedup claims may require formal, machine-checkable proofs to trust. This is a theme Blumefield has tracked across the wider AI security landscape, where automated discovery keeps outrunning the human processes meant to validate it.
A Turning Point for Post-Quantum Cryptography
It would be a mistake to read this as a doomsday for encryption, and an equal mistake to shrug it off. The honest framing is that a powerful new reviewer has arrived precisely as the world undertakes its largest cryptographic migration in decades. Governments and companies are in the middle of swapping out RSA and elliptic-curve systems for post-quantum cryptography, and that transition is exactly when a fresh wave of scrutiny is most valuable. Every candidate that survives an AI-assisted audit earns more trust; every HAWK that falls now is one that never reaches production.
Anthropic says it followed responsible disclosure throughout, sharing the HAWK finding with the scheme's authors in June and briefing government and industry partners before publication. It also built a benchmark called CryptanalysisBench with academics at ETH Zurich, Tel Aviv University, and TU Berlin so others can track how model capabilities evolve. The company is candid about the harder question lurking behind these results. What happens when a model discovers a flaw in a system that is actually deployed and defended, rather than a candidate still under review? Nobody has a clean answer yet, and the firm is calling for one from academia, government, and industry.
For now, the field gets a preview of its own future. In roughly a year, language models went from being unable to attack the simplest textbook ciphers to felling a scheme that human experts had studied for two years. The ceiling, if there is one, is not yet visible. Post-quantum cryptography was always a race against a hypothetical quantum machine. It now has a second, very real competitor already on the track, and the smart move is to put it to work strengthening the standards before someone less friendly does the same.