SystemebeneAI ENGINEERING · SOFTWARE SYSTEMS · INFRASTRUCTUREDE

Claude Mythos Halves HAWK Security: The Attack, the Mathematics and What the Headlines Omit

Anthropic used Claude Mythos Preview to find a key-recovery attack on HAWK. What the mathematics means, what the attack cannot do and how the coverage frames it.

17 min read
  • #AI Engineering
  • #Security
  • #Kryptografie

On 28 July, Anthropic published two cryptanalytic results produced with Claude Mythos Preview. One concerns a reduced-round version of AES; the other concerns HAWK, a signature scheme from the third round of NIST’s additional post-quantum signature competition. Neither result affects systems currently in production. (Anthropic)

The coverage was extensive and generous with verbs: “cracked”, “broke”, “AI Cracks Post-Quantum Cipher in 60 Hours”. None of those descriptions is entirely wrong, but they leave out important details. I will therefore approach the result in two steps: first the mathematics, explained without assuming a background in lattice cryptography, and then the question of what the public framing gets right and what it does not.

The focus is HAWK because it is the more directly verifiable of the two results. The attack runs end to end and reconstructs a real HAWK-256 signing key on a single server. That distinction matters more than it may appear at first.

The core idea in three paragraphs

HAWK hides its secret key in a high-dimensional point lattice. The public key is something like a shadow of that lattice: it reveals all distances and angles but not the orientation. Recovering the orientation from that shadow is the hard problem on which the security assumption rests.

Mythos found a symmetry in HAWK’s lattice that previous work had overlooked. Using only the public key, the attack constructs a second, substantially smaller lattice in which the shortest vector leads directly to the secret key.

The cost of shortest-vector search grows exponentially with dimension. Because the trick reduces the decisive dimension by roughly half, the effective security strength is reduced accordingly. Retaining the same security level would require larger parameters and, in practice, substantially larger keys.

What a signature scheme does and what makes HAWK different

A digital signature proves that a message came from a particular signer without revealing the signer’s secret key. When a browser verifies that it is talking to the correct website, it verifies a signature. Common schemes such as ECDSA and RSA fail once sufficiently large quantum computers exist, which is why NIST has been standardising post-quantum schemes for years.

HAWK is lattice-based, but unlike ML-DSA or ML-KEM its security is not based on LWE or SIS. It relies on the module lattice isomorphism problem, module-LIP. Its secret key is a “short basis”:

B ∈ SL2(R_n)

A basis is a set of direction vectors from which every point in the lattice can be reached through integer combinations. The same lattice has infinitely many bases. Some are short and nearly orthogonal; others are long and badly skewed. Short bases are useful because they make computation efficient. SL2 simply means a 2×2 matrix with determinant 1, while R_n is the underlying number system: the entries are polynomials rather than ordinary integers. For n = 512, that apparently small 2×2 matrix represents a lattice of dimension 1024.

The public key is:

Q = B* B

This is the Gram matrix. It contains all pairwise inner products of the basis vectors, which means all their lengths and angles. Squaring is a useful analogy: computing x² from x is easy, but the reverse is not unique, and in high dimension the corresponding inversion problem is practically intractable. Q describes the shape of the lattice completely but not its orientation in space.

Key recovery therefore means finding any B' satisfying B'* B' = Q. It does not have to be the original key. Any basis producing the same Gram matrix can generate valid signatures. (Paper)

HAWK’s practical attraction was that signing avoids floating-point arithmetic while keys remain compact. That is a genuine advantage over Falcon, particularly for embedded systems. HAWK was the only lattice-based candidate to reach the third round in May 2026. NIST’s interim report had nevertheless explicitly called for more analysis of the smLIP assumption “within the particular structure of cyclotomic number fields” and noted that previous module-LIP techniques did not appear to apply to the complex cyclotomic fields used by HAWK. That is exactly where the new attack lands.

The symmetry everyone missed

The best known attack up to this point was direct BKZ reduction on the key lattice of dimension 2n. BKZ is the standard algorithm for finding short vectors in a lattice. It works in blocks, and the block size β determines both result quality and computational cost. Runtime grows exponentially in β. The HAWK authors derive block sizes β_key ∈ {211, 452, 940} for the three parameter sets.

Since 2023 there has also been a powerful technique due to Ducas. If a lattice is already known to be essentially an ordinary cubic lattice that has merely been rotated and scaled, his algorithm recovers the hidden orientation using calls in dimension ⌊d/2⌋+1 rather than d. Applying that directly to HAWK’s key lattice does not help, because its dimension is 2n, leaving calls in dimension n+1, which is no improvement over the block sizes above.

The actual discovery is one layer deeper. HAWK computes in a cyclotomic field built from a value ζ, which can be imagined as a pointer on a clock face with 2^ℓ positions. There are transformations of that clock face that leave the entire arithmetic structure unchanged: symmetries. Three of them are involutions, operations that return to the starting point when applied twice:

c : ζ ↦ ζ⁻¹        Zeiger spiegeln
τ : ζ ↦ −ζ         Zeiger um eine halbe Umdrehung weiterdrehen
σ := cτ            beides kombiniert

All previous module-LIP cryptanalysis had used only c. Gentry and Szydlo explicitly restricted their 2002 method to the case where the underlying extension is complex conjugation, and subsequent work kept that restriction. For more than twenty years, nobody tried the half-turn. That is the entire conceptual jump.

From τ one derives the so-called cocycle:

V_τ := B⁻¹ τ(B)

It measures how strongly the secret basis changes when the clock face is rotated by half a turn. If the basis remained unchanged, V_τ would be the identity matrix. Since det B = 1, one first obtains the cocycle equation V_τ τ(V_τ) = I. By itself this is useless because every arbitrary matrix A produces a solution A⁻¹τ(A). The search space has not become smaller yet.

The crucial part is that V_τ satisfies two additional conditions that can be written using only the public key:

(C1)  τ(Y) = adj Y
(C2)  Q Y  = σ(Y)ᵀ τ(Q)

(C1) is a linearisation trick. What one would really like to write is τ(Y) = Y⁻¹, but matrix inversion is nonlinear and therefore unsuitable for a linear system. The adjugate adj Y is a substitute constructed from the entries of Y through rearrangement and sign changes, and for determinant 1 it equals the inverse. A nonlinear condition thereby becomes linear.

(C2) connects the public key to its half-turn-transformed version. Both sides are known except for Y.

The important point is that both conditions are linear in the coordinates of Y, and all coefficients can be computed from the public key. Solving a linear system is cheap. Its integer solutions form a lattice Λ of dimension n, half the dimension of the original key lattice, and a basis can be computed in polynomial time using Hermite normal form.

Inside this smaller lattice, V_τ is a shortest vector. The attacker has reduced the problem from “search the complete key lattice of dimension 2n” to “search a known lattice of dimension n where the desired object is one of the shortest vectors”, without knowing the secret key.

Two properties make this reduction robust. Length is measured through:

Q(Y) := Tr_F(det Y)

and because det V_τ = 1, the squared length of V_τ is always exactly n/4, regardless of how the key was generated. There is therefore no key-generation choice that makes the attack harder. Unlike known subfield attacks on NTRU, there is also no conservation effect that consumes the dimensional gain again.

Why the dimension is cut in half

To find the shortest vector of Λ, the attacker needs to understand the shape of that lattice. A useful trick provides it: the map Y ↦ B Y τ(B)⁻¹ carries the cocycle lattice for any key isometrically to the cocycle lattice of the trivial key B = I. The map itself is secret because it contains B, but it does not need to be computed. Its existence is enough to reveal the shape by analysing the trivial key:

Λ ≅ √(n/4) · Z^(n/2+1)  ⊕  √(n/2) · Z^(n/2−1)

In other words, the lattice splits into two mutually orthogonal cubic lattices, one with n/2+1 axes and one with n/2−1, scaled differently. It is therefore “almost hypercubic”: not a perfect cubic lattice, but close enough for Ducas’ method in the Bambury-Nguyen formulation. That method returns all 2(n/2+1) shortest vectors using calls in dimension n/2+1.

The correct candidate then has to be selected. Only ±V_τ lead to the key, and they are precisely the candidates satisfying Y ≡ I (mod 2). This parity test is effectively free. The rest is the van Gent-Pulles descent: from V_τ, construct another sublattice isometric to √n · Z^n, whose shortest vectors are the columns of B⁻¹. A second run of the same reduction technique recovers them. Van Gent and Pulles proved in 2025 that such an automorphism would enable an attack; what remained open was whether it could actually be exposed in HAWK’s lattice. Mythos closed that gap.

The reason τ helps while c does not is structural. Setting τ = c gives σ = c² = id, so (C2) collapses to the statement that QY is symmetric. The resulting lattice has dimension 3n/2. With τ ≠ c, σ itself is a nontrivial involution and (C2) removes another n/2 dimensions, leaving dimension n. That dimensional saving is the complete explanation for the factor-of-two reduction.

The numbers and what they mean

Costs are expressed in gates, meaning elementary computational steps. Powers of two are used because the magnitudes quickly become unwieldy. 2^100 is far beyond anything ever computed on this planet; 2^128 is commonly treated as a comfortable security margin.

Parameter setSpecificationAfter the attack
HAWK-5122^1502^108
HAWK-10242^2882^182
HAWK-256 (Challenge)2^642^38

For HAWK-512 and HAWK-1024, these are the figures from the NIST forum announcement and the paper. Both parameter sets remain practically unattackable: 2^108 is still beyond realistic reach. What falls is not security in the sense of “now breakable”, but the claimed security level. HAWK-512 was presented with a particular margin and no longer meets that claim.

HAWK-256 is the case picked up by the press. The move from 2^64 to 2^38 is a reduction by roughly a factor of 67 million, which is the figure highlighted by Decrypt. The attack was actually executed for this parameter set.

The authors also note that their proven bounds are conservative. Under the heuristic model used by the HAWK specification itself, progressive BKZ reaches the target at block size 205 rather than the proven dimension 257. That corresponds to roughly 2^81 gates for HAWK-512 and 2^147 for HAWK-1024. The practical attack is therefore likely cheaper than the formal bound.

HAWK-256 was demonstrated in practice. The implementation is published as a repository. (GitHub) It constructs the 256×256 lattice using an integer-kernel computation and LLL, reduces it with fpylll to block size 44 and then runs a progressive BGJ sieve in the AMX implementation by Zhao, Ding and Yang up to sieve dimension 118. According to Anthropic, one recovery takes roughly three hours and 42 minutes on a 96-core Sapphire Rapids server and is dominated by the sieve. Every attempt succeeded, and every recovered key was tested through a sign-verify round trip against the official reference implementation.

What the headlines leave out

Coverage largely converged on “AI cracks post-quantum cipher in 60 hours”. Four details materially qualify that framing, and The Hacker News was the only article I found that presented all of them cleanly. (The Hacker News)

HAWK-256 is not a NIST parameter set. HAWK’s submitted security levels are HAWK-512 and HAWK-1024. HAWK-256 is a challenge parameter supplied by the authors specifically as a cryptanalytic target, small enough that it was never intended for production. The published attack code supports only HAWK-256 and rejects every other input. For HAWK-512, the proven oracle dimension is 257; that attack was not attempted.

The recovered key is not the original key. The attack does not recover the 96-byte seed from which the secret key was generated. It returns a 592-byte functionally equivalent signing key. For the security claim that distinction is irrelevant: anyone who can sign has won. For the phrase “stole the key”, it matters.

There is no independent reproduction yet. Anthropic coordinated disclosure in June, the HAWK authors reviewed the result, and the paper explicitly thanks them for feedback on the attribution of individual attack components. At the time of my research, however, the public NIST mailing-list thread had no replies and I could not find an independent rerun of the HAWK-256 key recovery. Whether NIST changes the parameters, revises the security claims or removes HAWK from the process remains open.

The AES attack is not executable end to end. Anthropic’s code performs complete key recovery only against a scaled-down AES-like cipher with a 24-bit key. For real 7-round AES-128, individual table entries and candidates are measured and total cost is extrapolated from those measurements. No end-to-end run exists, and 2^105 required chosen plaintexts make such a run impractical anyway.

The different interpretations in the coverage are revealing. CyberScoop quotes Ellen Boehm of Keyfactor arguing that this result demonstrates the NIST process working as intended and draws the operational conclusion that organisations should maintain continuous cryptographic inventories instead of revisiting them only every few years. (CyberScoop) TFTC connects the result to Bitcoin: BIP-360 uses ML-DSA and SLH-DSA, already finalised NIST standards, and never considered HAWK. In hindsight, the conservative choice looks sensible. Its more interesting point is that a US$100,000, 60-hour campaign is no longer a demonstration but a repeatable tool, while programmes with classified compute do not publish their results. (TFTC) Decrypt focuses on signature size: on a blockchain, signature bytes translate directly into block space and fees, and compactness was HAWK’s main selling point. (Decrypt)

Limits of the attack

The attack is exponential and remains exponential. This is not a polynomial-time break.

It needs two ingredients: an involution τ ≠ c and a half-dimension reduction for the resulting lattice class. The first exists exactly when (Z/m)^× is not cyclic, namely for m ∉ {1, 2, 4, p^k, 2p^k} with odd p. HAWK’s power-of-two conductors satisfy this condition, while conductors of the form p^k and 2p^k escape the construction. Falcon operates in the same ring and therefore has access to the same involutions, but it is still unaffected: its public key is not a Gram matrix but an NTRU quotient, and its security does not rely on module-LIP. The existence of the right involution alone is not enough. For other composite conductors with a small prime factor, the authors expect the attack to apply but have only demonstrated it on small parameters.

The attack does not generalise to ML-DSA, ML-KEM or lattice cryptography as a whole. Those schemes rely on LWE or SIS rather than module-LIP, and the attack specifically exploits the public key’s Gram-matrix structure together with det B = 1.

The main consequence for HAWK is therefore as much economic as mathematical. Keeping the same security level requires substantially larger keys, undermining the reason HAWK was attractive relative to Falcon. Anthropic itself notes that this removes many of the advantages that made the scheme compelling as a PQC signature candidate in its current form.

How the result was produced

The attack did not come from a single prompt. Anthropic describes an environment with several collaborating worker agents using a Claude-Code-like harness, access to Python and Sage, and published cryptographic literature inside a sandbox. Mythos first performed extensive literature research, then reasoned mathematically and experimented computationally, and after finding the attack built its own end-to-end verification pipeline.

The human operator had a background in theoretical computer science but was not a lattice-cryptography specialist. According to Anthropic, his contribution was largely project steering: instructions on how ideas should be recorded and which libraries to use for verification. The paper’s acknowledgements are unusually explicit that most mathematical discoveries were AI-assisted and that the human role consisted primarily of guiding, organising and verifying.

One detail of the multi-agent dynamics is worth noting. The key idea emerged from a pair of workers. The first dismissed it prematurely as impractical; the second found a way to exploit it. They continued exchanging messages until both were convinced.

Discovery, development and verification together took roughly 60 hours and about US$100,000 in API cost. By then HAWK had already gone through two rounds of expert review over two years.

AES, LEA and the verification bottleneck

The second result concerns AES-128 reduced to 7 of 10 rounds in a chosen-plaintext setting using 2^105 chosen plaintexts. The previous record for this variant dated from 2013. Mythos improved the strongest known meet-in-the-middle attack by adding a fingerprinting step it called the “Möbius Bridge”. One stage of the prior attack had to try 256 values and look them up in a precomputed table; the new fingerprint is invariant under that guessing step and therefore saves a factor of 256 directly. The transformation itself is more expensive, but further optimisations compensate for that cost. Depending on how it is measured, the net gain is roughly a factor of 200 to 800.

This result was produced almost entirely autonomously under deliberately harder conditions. The researchers prohibited all five established families of AES cryptanalysis and asked the model to find a sixth. Claude inherited notes from earlier runs documenting roughly 200 failed attack variants. It initially refused and considered the task impossible anyway. The researchers sent only three substantive messages, typos included, essentially telling the system not to pursue low-hanging fruit. It then ran for three days and eventually produced around one billion output tokens.

Less widely discussed but more executable is another result: Mythos also found an attack on 13 rounds of LEA, a Korean and ISO-standardised lightweight cipher for IoT devices. It runs in under an hour on a desktop and uses fewer than 2^30 plaintexts, compared with 2^98 plaintext pairs for the previous state of the art. Deployed LEA uses 24 rounds, so this does not break systems in the field.

A useful counterweight comes from CryptanalysisBench, built together with ETH Zurich, TU Berlin, the University of Haifa and Tel Aviv University and containing 191 tasks. (arXiv) Mythos solves 85.7 percent of tasks for which a solution is known; the weakest tested model still solves 65.3 percent. Against full-strength ciphers with no published break, every model scores below 9 percent. The models are therefore strong at reconstructing known attacks and still weak in the open category. HAWK and AES are outliers rather than the norm.

This is, for me, the most important point in the entire release. The HAWK attack is executable: generate a key, run the pipeline, receive another signing key a few hours later and have the reference implementation sign and verify with it. The proof is an exit code. The AES attack is different. Two researchers spent almost a month convincing themselves that it was correct after roughly a week of model work. Anthropic itself writes that human researchers become the bottleneck when models produce results faster than those results can be checked. That is not a prediction; it is a description of this project.

Assessment

My assessment is that nothing changes operationally for now. HAWK is not deployed, the AES result targets a reduced-round variant, and both findings are exactly why public standardisation processes exist. A candidate failing late in the process is normal; SIKE was broken in 2022 in roughly an hour on a laptop.

Something else is more significant. The HAWK discovery is not brute-force labour but an observation nobody made for two decades: that besides complex conjugation there are two additional involutions, and that one of them produces a lattice of half the dimension. In retrospect it looks obvious. Good cryptanalytic ideas often do.

SIKE is the most useful calibration, and the comparison cuts both ways. SIKE fell in one hour on a laptop; HAWK took 60 hours and US$100,000 of frontier-model compute. The difference is that SIKE required a very specialised expert, while in the HAWK case that bottleneck was replaced with compute. That is the real shift: cryptanalysis moves from a question of available specialists towards a question of budget.

For evaluating AI-generated research, I would take one simple rule from the result. An attack that can be executed and checked against a reference implementation belongs to a different category from an attack that exists only on paper. The first takes hours to verify; the second can take weeks. Whenever the problem allows it, structure the work so that the result runs rather than merely makes a claim. That applies to cryptanalysis as much as to any other work delegated to agents.

One question remains open, and Anthropic explicitly asks it without answering it: how should the community react if a model finds a weakness in a scheme that is actually deployed? HAWK involved coordinated disclosure to the authors in June and discussion on the public NIST mailing list. With a deployed scheme, the same situation would be considerably more uncomfortable.

Sources

Primary sources

Prior work used by the attack

Coverage

Related reading