Claude Mythos Finds Weaknesses in HAWK and Seven-Round AES

According to The Hacker News, the attack exploits a previously unused automorphism, or symmetry, in the lattice structure underlying HAWK. The reported method constructs a "tau-cocycle lattice" from a public key, applies lattice reduction and sieving to find short vectors, then reconstructs a secret basis capable of signing messages accepted by the original public key.

The Hacker News reports that Anthropic released an implementation with an expected end-to-end runtime of roughly three hours and 42 minutes on a 96-core server. The implementation verifies its result by signing a message and checking it with the NIST reference implementation, rather than recovering the original 96-byte secret-key representation.

Anthropic's post describes HAWK as significantly weakened by the finding, while noting that the attack does not affect the other NIST post-quantum schemes or other schemes using related methods. This distinction is important for migration planning: a break of a candidate or test parameter is material to standardization and cryptographic review, but it is not equivalent to a compromise of deployed post-quantum infrastructure.

The second result concerns seven-round AES-128, not the full ten-round AES-128 cipher used in standard deployments. The Hacker News reports that the method removes a 256-way guessing stage from an existing meet-in-the-middle attack, producing a claimed 200- to 800-fold speedup.

Anthropic's research post states that the attack still requires an impractical number of chosen plaintexts. Its footnotes further state that the result does not affect similar cipher schemes. The Hacker News likewise reports that Anthropic said no production software needs to change because of the AES finding.

For cryptography practitioners, reduced-round attacks remain useful research artifacts because they test the security margin between a full construction and weakened variants. They should not, however, be interpreted as a practical break of AES-128 in deployed protocols based on the evidence published here.

According to The Hacker News, Anthropic released the findings alongside technical papers and reproducibility artifacts, and described Mythos Preview as conducting much of the research while humans supplied direction, compute, and extensive verification. Anthropic's post also notes that many autonomous sessions produced no new discoveries and that follow-up work improved the insight from a successful session.

The result adds a concrete example to a broader pattern in AI-for-science research: automated systems can search large spaces of hypotheses and experiments, while independent human and software verification remains essential before a claimed security result can influence standards or operational guidance. Here, the public scope and reproducibility materials are central, since the findings concern cryptographic claims that require scrutiny beyond the original research team.