The short answer
An AI model found a genuine mathematical weakness in a candidate post-quantum cipher in about 60 hours, and its makers withdrew the cipher from standardisation a day later. In research published on 28 July 2026, Anthropic reported that its restricted Claude Mythos Preview model discovered a "nontrivial automorphism" — an internal lattice symmetry — in HAWK, a signature scheme submitted to NIST. The finding roughly halves HAWK's effective key strength: for its 256-bit challenge parameters, expected attack cost falls from about 2^64 to 2^38.
The same model also invented a new technique, which it named the "Möbius Bridge", that makes an existing attack on reduced-round AES-128 between 200 and 800 times faster. Both results were produced with occasional one-line guidance from a researcher who was not a cryptographer, at an API cost of roughly $100,000. The work builds on the cryptanalysis Anthropic and rivals such as Anthropic's peers have been probing as frontier models gain reasoning depth.
What Anthropic actually reported
HAWK is a lattice-based digital signature scheme — one of the "additional" candidates NIST has been reviewing to broaden the post-quantum toolkit beyond its first finalised standards. Signature schemes are the part of cryptography that proves a message, a software update or a certificate is authentic. HAWK's appeal was speed and compact signatures; its security rested, like most lattice schemes, on hard mathematical problems that neither classical nor quantum computers are meant to solve efficiently.
According to Anthropic, the model located a specific internal symmetry of HAWK's lattice — a "nontrivial automorphism" that earlier researchers had proved would enable an attack if it existed, but had never found. Exploiting it approximately halves the block size needed to recover an equivalent secret key. In concrete terms, the expected work factor for the HAWK-256 challenge falls from around 2^64 to 2^38, and gate-count estimates for the higher parameter sets drop sharply as well. The HAWK team confirmed the result and, on 29 July 2026, withdrew the scheme from NIST's additional post-quantum signature standardisation process.
What was not broken
The headlines invite panic, so read the fine print carefully. HAWK was a candidate, not a deployed standard — no product, browser or bank was relying on it. The second finding, the "Möbius Bridge", improves a meet-in-the-middle attack on 7-round AES-128 by eliminating one 256-way guess an attacker would otherwise make. Real AES-128 runs ten rounds; the seven-round version is a research punching bag used precisely to measure progress, and even this improved attack needs roughly 2^105 chosen plaintexts, which is wildly impractical. Full AES, the cipher inside TLS, disk encryption and payment systems, remains unbroken.
It is also worth being honest about the human role. The model worked largely autonomously and generated on the order of a billion output tokens across the AES effort, but a researcher still steered it with a handful of substantive prompts, and confirming the mathematics was correct took two people close to a month. This is a powerful assistant that compresses discovery, not an oracle that hands over finished, verified breaks.
Why the speed is the story
Strip away the specifics and the signal is about time and cost. The relevant comparison is not "AI versus AES" but "days versus years". A weakness that survived roughly two years of scrutiny by specialist cryptographers was found by a general model, driven by someone outside the field, in about 60 hours and for roughly $100,000. That is the kind of budget a mid-size company spends on a single quarter of one engineer.
When the cost of finding structural weaknesses drops that far, the safe assumption is that more will be found, faster — in candidate algorithms, in older primitives still lurking in production, and in the way teams use cryptography rather than the ciphers themselves. Defenders get the same tool, which is the good news, but the asymmetry favours whoever runs the analysis first. That is why "our crypto is standard, so we're fine" is the wrong posture; the right one is knowing exactly what you run and being able to change it quickly.
What it means for US & EU software teams
For most teams the practical takeaway is not about HAWK at all — it is about crypto-agility. The organisations that will absorb news like this calmly are the ones that treat cryptographic choices as replaceable components behind a clean interface, not as constants baked into a dozen services. If swapping a signature scheme or a key-exchange algorithm means touching one module and rotating keys, a withdrawn candidate is a Tuesday; if it means re-architecting, it is a project you cannot start in time.
There is a direct post-quantum reading, too. NIST has already finalised its primary standards — ML-KEM for key encapsulation, ML-DSA and SLH-DSA for signatures — and this episode is a reminder to build migrations on those selected, heavily reviewed algorithms rather than betting on unselected candidates. Teams that hold long-lived secrets should also weigh "harvest-now, decrypt-later" risk: data exfiltrated today can be stored against a future break, so the migration clock for sensitive systems has already started. For regulated sectors such as FinTech, where auditors increasingly ask about quantum-readiness, a documented plan is fast becoming table stakes.
Finally, use the capability defensively. The same model class that found the HAWK flaw can be pointed at your own code to flag deprecated primitives, weak configurations and misuse of cryptographic libraries — the everyday mistakes that break far more systems than novel math ever will. That is a strong argument for pulling cryptographic review forward and folding AI-assisted analysis into a proper security audit rather than treating it as a one-off.
How to act on it this quarter
You do not need a cryptography team to respond sensibly. You need an inventory and a plan.
- Build a cryptographic inventory. Catalogue every algorithm, key, certificate and library version across your services — including transitive dependencies. You cannot migrate what you cannot see.
- Prefer finalised standards. For any new work, choose NIST-selected ML-KEM, ML-DSA or SLH-DSA over unselected candidates, and avoid pinning security-critical designs to schemes still in review.
- Design for agility. Put cryptographic choices behind an interface so a primitive can be replaced and keys rotated without re-architecting the product.
- Model harvest-now risk. For long-lived secrets, assume captured ciphertext may be decrypted later and prioritise those systems in your migration order.
- Turn the tool on yourself. Add AI-assisted review to your security process to catch weak configurations and library misuse — then have a human verify anything it flags.
- Assign an owner. Name someone to track NIST guidance, standard withdrawals and your own migration state, so the next withdrawn candidate is a status update, not a fire drill.
None of this is legal advice, and how much work it implies depends on how much of your stack you can already see. But the strategic signal is clear: AI has made cryptanalysis faster and cheaper, and the advantage goes to teams that can inventory, standardise and swap — not the ones betting that no one will look.
Frequently asked questions
What did Anthropic's Claude find in the HAWK cipher?
In research published on 28 July 2026, Anthropic said its Claude Mythos Preview model found a nontrivial automorphism — an internal lattice symmetry — in HAWK, a post-quantum signature scheme submitted to NIST. Prior researchers had proved such a symmetry would enable an attack if it existed but had not found one. The result roughly halves effective key strength: for the HAWK-256 challenge parameters, expected attack cost drops from about 2^64 to 2^38. The model reached the finding in roughly 60 hours, and the HAWK team withdrew the scheme from NIST's additional signature process on 29 July 2026.
Does this break AES or the encryption my apps use today?
No. The AES result, a technique Claude named the "Möbius Bridge", is 200 to 800 times faster than prior methods but targets a deliberately weakened 7-round research variant of AES-128, not the full 10-round cipher that protects real traffic, and it still needs an impractical number of chosen plaintexts. HAWK was only a candidate scheme and is not deployed anywhere. Nothing protecting production data was broken.
Why does AI-driven cryptanalysis matter if nothing was broken?
Because the timeline compressed. A general-purpose AI model, guided by a non-specialist and costing about $100,000 in API usage, found in days a structural weakness that expert human review had missed over roughly two years. That shortens the window between a weakness existing and a weakness being found, which raises the value of crypto-agility: the ability to swap algorithms quickly without re-architecting a product.
What should software teams do about post-quantum cryptography now?
Prioritise the NIST-standardised algorithms already finalised — ML-KEM, ML-DSA and SLH-DSA — over unselected candidates such as HAWK; build a cryptographic inventory so you know where every algorithm and key lives; and design for agility so a cipher can be replaced behind an interface rather than hardcoded. Teams handling long-lived secrets should also account for harvest-now, decrypt-later risk when planning migrations.
Can we use AI defensively on our own cryptography and code?
Increasingly, yes. The same capability that found the HAWK flaw can be pointed at your own implementations to surface weak configurations, deprecated primitives and misuse of cryptographic libraries. It does not replace expert review — verifying the HAWK finding still took two researchers about a month — but it is a strong force multiplier inside a security audit and a reason to bring cryptographic review forward in the software lifecycle.
Sources
Anthropic — Discovering cryptographic weaknesses with Claude, 28 July 2026 (primary source)
The Hacker News — Claude AI Just Cracked a Post-Quantum Test Scheme and Found a Faster 7-Round AES Attack, July 2026
The Quantum Insider — AI Finds New Weaknesses in Cryptographic Algorithms, Anthropic Says, 29 July 2026