Claude AI analyst found critical vulnerabilities in post-quantum signature HAWK and truncated AES
Artificial intelligence continues to demonstrate capabilities that go far beyond simple text generation. Anthropic's Claude Mythos Preview model has successfully conducted its own cryptanalytic research, identifying weaknesses in two cryptographic algorithms: the post-quantum digital signature scheme HAWK and a reduced version of the AES-128 encryption standard.
This involves two independent attacks. The first targeted HAWK, a candidate for standardization in the field of post-quantum cryptography. The AI discovered a previously unknown symmetry in the mathematical structure of the algorithm, which significantly lowered its security estimate. For the HAWK-256 version, the cost of full key recovery dropped from 2^64 to 2^38 operations. This means that to maintain the previous level of protection, key sizes would have to be roughly doubled, negating one of the scheme's main advantages: compactness.
Accelerating the Attack on AES and New Benchmarks
The second result concerns the 7-round version of AES-128 (the full version uses 10 rounds). Claude Mythos Preview developed a method called Möbius Bridge, which improved the previously known meet-in-the-middle attack by a factor of 200 to 800. It is important to emphasize: this scenario remains purely research-oriented. To implement it, an attacker would need to send 2^105 pre-selected encryption queries, making it completely impractical for real-world systems.
According to the company's estimates, each of these studies cost approximately $100,000 in API call expenses. The search for the attack on HAWK took about 60 hours, while verifying the results for AES required several hundred hours of work by human researchers. This clearly demonstrates that AI acts as a powerful assistant, not a replacement for an expert.
To objectively assess the capabilities of language models in this area, a special benchmark called CryptanalysisBench was created. It includes 191 tasks across six families of cryptographic primitives. The best models, including Claude Mythos 5, solved up to 86% of first-level tasks, but on full, unweakened schemes, their results did not exceed 9%.
Expert opinion: These results are not a cause for alarm for the industry, but rather a demonstration of a new stage in AI development. We are witnessing the model transition from passive analysis to actively seeking and formulating new attacks. The fact that Anthropic notified the algorithm authors and NIST in advance indicates a mature and responsible approach. However, for cryptographers, this is a clear signal: from now on, the security of new schemes must be verified not only mathematically but also with the help of AI assistants capable of finding non-obvious mathematical symmetries.