Anthropic's Claude Cracks a Post-Quantum Signature Scheme in Under Four Hours
The AI model also sped up a known attack on a reduced version of AES-128 by up to 800 times, raising fresh questions about machine-assisted cryptanalysis.
Key points
- Anthropic says its Claude Mythos Preview model helped build a full key-recovery attack against HAWK-256, a candidate post-quantum signature scheme.
- The released attack runs end-to-end in roughly three hours and 42 minutes on a 96-core server.
- The same model produced a 200 to 800 times speedup on an existing attack against seven-round AES-128, a stripped-down research version of the standard cipher.
- A symmetry in the underlying lattice maths, previously unexploited, made the HAWK break possible.
- Neither result affects the full 10-round AES-128 used in production systems today.
Anthropics Claude Mythos Preview model has helped derive an end-to-end key-recovery attack on HAWK-256, a lattice-based signature scheme designed to survive attacks from future quantum computers. HAWK is one of the candidate systems being tested to replace the digital signatures protecting software updates and banking traffic once quantum machines can break today's cryptography. A working implementation is already out: on a 96-core server, it recovers the secret key in about three hours and 42 minutes.
How did an AI model break the scheme?
Claude helped researchers spot a symmetry in the lattice that HAWK-256 is built on, one no prior attack had used. A lattice, here, is a grid-like mathematical structure whose hardness is meant to keep the signing key secret. That shortcut cut straight through it.
That's the striking part. The model didn't just optimise known code; it contributed to the mathematical insight itself.
HAWK is a research candidate, not a deployed standard. It was submitted to post-quantum competitions rather than baked into your browser, so no production system faces immediate risk. It's still a warning shot for every other lattice scheme under review. We've tracked post-quantum cryptography across 13 stories since June, and this is the first time a working key-recovery implementation has landed mid-competition.
What about the AES result?
Claude also produced a 200 to 800 times speedup on a published attack against seven-round AES-128. AES-128, the Advanced Encryption Standard with a 128-bit key, protects most encrypted web traffic and disk encryption. The full version runs 10 rounds of scrambling. Researchers attack reduced-round versions as a way to measure how much safety margin the full cipher has. A faster attack on seven rounds doesn't mean AES is broken. It means the margin shrank a little, and an AI helped shrink it.
What is actually at stake?
| Result | Target | Impact |
|---|---|---|
| Key recovery | HAWK-256 signature scheme | ~3h 42m on a 96-core server |
| Attack speedup | 7-round AES-128 (research variant) | 200x to 800x faster |
| Deployed AES-128 | 10 rounds, in production | No change, still considered secure |
Two things matter for anyone outside the cryptography community.
First, post-quantum standards are still being chosen. Schemes that look elegant on paper can collapse when a new attack angle appears, whether it comes from a human or a language model. Standards bodies will lean harder on schemes with the longest, most battered track records.
Second, AI-assisted cryptanalysis isn't a talking point anymore. It produced running code that recovers a key in an afternoon. Defenders will need to assume attackers can point similar tools at their own systems.
What should security teams do now?
Nothing needs ripping out today. AES-128 as deployed is unaffected, and HAWK-256 isn't in your stack unless you're running experimental post-quantum software. Teams planning post-quantum migrations should watch which schemes survive this new wave of scrutiny before committing, and favour hybrid deployments that keep a classical algorithm alongside the post-quantum one until the dust settles.
