Quick headline for your inner cryptographer (and the part of you that likes dramatic AI stories): Anthropic’s research run with its Claude Mythos preview surfaced two neat-but-not-apocalyptic results — an end-to-end key-recovery against a test parameter of the HAWK signature scheme and a big-speedup trick against a reduced-round AES. Neither one breaks production systems, but both are great examples of machines doing clever, surprising math with a human babysitter nearby.

HAWK-256: a symmetry, some lattices, and a practical demo (sort of)

First up: the lattice-y thing. Researchers used a previously unused automorphism — basically a hidden symmetry — to turn the HAWK-256 key-recovery problem into an easier lattice task. The attack builds a special object the team calls a τ-cocycle lattice, runs lattice reduction and sieving, finds short vectors, and then reconstructs signing material that works with the original public key. Fun fact: the recovered object is a 592-byte decoded key that can sign like the original, not the original 96-byte secret seed.

The released demo targets only the small challenge parameter (that’s the one meant to be poked at), verifies success by signing a message and checking it against a reference implementation, and expects an end-to-end runtime on the order of a few hours on a beefy multicore server (the posted number was about three hours and 42 minutes on a 96-core machine). The implementation is intentionally narrow: it only accepts that challenge parameter and refuses anything else.

Numbers matter: the estimated work factor for the challenge parameter falls dramatically in exponent form — from around 2^64 down to about 2^38 for that specific HAWK-256 setting. For the larger, production-level parameter sets the gate-count estimates also dropped a bit but remain astronomically large and essentially impractical to attack. Crucially, this is still an exponential attack (not a polynomial-time collapse), and it doesn’t automatically translate into breaks of other post-quantum schemes.

Workflow note: the model did most of the heavy brainstorming, but humans supplied direction, ran the compute, and performed the painstaking verification. Anthropic reported nontrivial engineering costs and hours of human verification alongside the model runs.

Seven-round AES-128: remove the guess, speed things up — but don’t panic

The second highlight is a clever tweak to a previous meet-in-the-middle style attack against AES reduced from ten rounds to seven. The new idea constructs an invariant fingerprint (named the Möbius Bridge) that doesn’t change across a particular guessed value in the older attack. Because that fingerprint is invariant, the attack can drop a 256-way enumeration step and thus avoid testing 256 possibilities at that stage.

That optimization translates to a reported speedup of roughly 200x to 800x depending on how you count time and parallelism. Sounds scary until you remember the caveat: the attack assumes an attacker can obtain on the order of 2^105 chosen plaintexts under a single unknown key — a requirement that puts this attack firmly in the “academic curiosity” category rather than “real-world threat.”

The released artifacts show full black-box recovery only for a tiny AES-like toy cipher (24-bit key). For the full seven-round AES-128 they measured component costs and projected the end-to-end cost, but they did not run a complete end-to-end key recovery on the full 128-bit key. So the speedup is real for the algorithmic piece they found, but the overall practical attack still needs infeasible data and resources.

Also amusing: the model initially resisted the idea that AES could be improved upon, and the human researchers’ blunt persistence (and many follow-up prompts) pushed the investigation forward. The project used very large model outputs and nontrivial compute and verification time.

  • What to remember: Both findings are intellectually interesting and worthwhile for cryptanalysis, but neither forces immediate changes to deployed cryptography.
  • HAWK-256 (the challenge parameter) was the thing that got hit; the production HAWK parameter sets remain effectively safe for now.
  • The AES improvement affects a reduced-round cipher and still needs absurd chosen-plaintext assumptions, so no emergency patching required.
  • These results show large models can propose nontrivial math and crypto ideas, but humans still do the heavy lifting to verify, implement, and vet them.

In short: glamorous AI-assisted math, interesting implications for future crypto research, but no immediate mass panic. Keep calm, update your reading list, and let the cryptographers double‑check everything while you enjoy the show.