Claude Mythos Found New Cryptographic Weaknesses: What HN Thinks

Last updated: July 28, 2026

Anthropic published a research post today showing that Claude Mythos Preview can discover mathematical weaknesses in cryptographic algorithms themselves -- not just bugs in their implementation. The results landed on the Hacker News front page with 126 points and 68 comments. Here is what the paper actually says, what HN thinks of it, and why it matters for developers building on top of both AI and cryptography.

What Mythos Found#

The research describes two primary results.

HAWK key-recovery attack. HAWK is a post-quantum digital signature scheme, a third-round candidate in NIST's call for additional post-quantum signatures. It has survived two rounds of expert human review over two years. Mythos Preview found a nontrivial automorphism in the lattice HAWK uses -- a symmetry that prior work had proven would permit an attack, but that no one had found was actually present. The resulting attack cuts HAWK's effective key strength in half. A single Anthropic researcher with a theoretical computer science background (not a lattice-cryptography expert) worked with Mythos over 60 hours, costing roughly $100,000 in API tokens. The attack is not polynomial-time, so it does not break HAWK outright, but it means HAWK would need double the key size to reach its claimed security level, undermining many of the scheme's advantages.

AES meet-in-the-middle improvement. On a reduced 7-round variant of AES-128 (the full cipher uses 10 rounds), Mythos discovered a technique it called a "Mobius Bridge" that improves the best known meet-in-the-middle attack by 200-800x. This attack works under a chosen-plaintext threat model and is entirely impractical against real systems -- it does not break full AES. But the discovery process was remarkable: Mythos worked almost entirely autonomously over three days, producing roughly one billion output tokens, with only three substantive human prompts. The prompts themselves were refreshingly unpolished -- things like "no again the goal is that we have highly inteligent model as good top researcher, we want to find new attacks." After Mythos produced the core insight, two human researchers spent several hundred hours validating the result.

Anthropic also announced CryptanalysisBench, a benchmark built with ETH Zurich, Tel Aviv University, and University of Haifa that packages cryptographic ciphers for evaluating LLM cryptanalytic capabilities. And they previewed additional results on LEA (a practical attack on 13 of 24 rounds running under an hour on a desktop), Serpent-128, and smaller improvements on Salsa20, Poseidon, and SHA-1.

Anthropic was clear that none of these results have practical impact on production systems today. But they warned that as model capabilities grow, we should prepare for a future where LLMs find real-world cryptographic vulnerabilities faster than humans can validate them.

What HN Is Saying#

The HN discussion at news.ycombinator.com/item?id=49087091 surfaced several sharp takes.

The results are real but contextualized. Top commenter Retr0id provided the clearest TL;DR: "They marginally improved on the best known academic attack on 7-round AES-128 (which normally uses 10 rounds - you do not need to worry about AES being broken). The attack on HAWK is perhaps more interesting - they were able to halve the effective key length. HAWK is a candidate for NIST standardisation. It has been studied academically, but isn't really deployed anywhere."

adrian_b added an important nuance about the AES attack: "While using the strongest attack for testing a cipher remains the correct method, chosen-plaintext attacks are no longer realistic today." Modern modes like AES-GCM use counter mode where attackers cannot influence what gets encrypted.

The multi-agent dynamics got attention. a-dub flagged the interesting detail about two worker agents working in parallel: one prematurely rejected the key idea, the other found a way to exploit it, and they eventually converged. a-dub questioned whether this was genuine collaboration or just stochastic search: "it would be interesting to replay and repeat the search to get a sense for how often it finds or misses the known working path."

The $100K cost sparked a class divide debate. mmaunder ran the numbers: "$100k in tokens in a week is an impressive feat even with massive parallelization. I suspect the TPS their internal folks have access to is far higher than their bulk public endpoints. There's a tech aristocracy rapidly emerging in our society and it's going to tear us apart." jrflo countered that a single heavy day of API usage could hit $10K, making $70K/week plausible. Several commenters speculated whether Chinese models could reproduce these results at lower cost, with ecshafer asking pointedly "If a Chinese model can do it for $1-10K, then why hasn't one?"

The messy prompts became a meta-discussion about prompt engineering. dwt highlighted the typos and grammatical errors in Anthropic's own prompts and asked: "All of that RLHF and fine-tuning effort is going toward making prompts like this, or worse, work with no fuss." The thread then turned into a broader discussion of whether complex prompt engineering and skills files are overrated. impulser argued: "Give a LLM a bash tool and a prompt and it will outperform your complex setup with skills and tools." qingcharles noted the irony: "It's counter to what sci-fi taught us using AI would be like. We never thought we'd have to feed it words of encouragement."

Skepticism about the framing. Diogenesian pushed back on Anthropic's PR framing: "Discovering a weakness that had previously been only theoretical is vastly different from discovering an unknown weakness." The work was impressive, they argued, but the article's first paragraph implied HAWK had no known weaknesses, when in fact prior work had already theorized the attack vector.

The chilling effect on human researchers. staticshock raised a longer-term concern: "A thing I worry about is that as AI transmutes tokens into effort, it'll split the world into two: some problems will yield, making human effort entirely unnecessary, and others will harden to the point where human effort will feel increasingly less worthwhile, because 'even AI couldn't solve it'."

And the obligatory HN snark: Johnny_Bonk posted simply "Great now can you make opus 5 work please."

Dev-to-Dev Take#

Three things stand out from this release.

First, the human validation bottleneck is real and already here. Mythos produced the AES attack in three days. Two researchers spent "several hundred hours" validating it. Anthropic says they are "reaching the limits of our own knowledge" on verifying Claude's cryptographic results. This mirrors the finding from Project Glasswing, where Claude found over 10,000 critical vulnerabilities that humans could not triage fast enough -- a problem we covered in AI Security Triage Bottleneck. As AI-generated research output accelerates, the bottleneck shifts from generating results to validating them. We may need AI-assisted verification pipelines before we have them.

Second, the prompt engineering lesson is worth internalizing. Anthropic's internal researchers did not use elaborate skill files or hundred-line system prompts. They sent short, frustrated, typo-ridden messages. The model understood intent through context and persistence, not through prompt precision. This aligns with a theme we have seen across the industry: agentic scaffolds and iterative loops matter more than clever prompting. Our own analysis of Claude Context Engineering Rules makes a similar point about steering over scripting.

Third, the HAWK finding changes the NIST timeline. HAWK was a promising candidate for post-quantum signatures because of its small key sizes. If those keys now need to double, the scheme loses its main advantage. The timing matters: organizations like Google and Cloudflare have announced 2029 deadlines for dropping pre-quantum algorithms. Every candidate that falls out of contention narrows the options. But this is exactly how the NIST process is supposed to work -- as commenter Retr0id noted, the purpose of standardization is to find weaknesses before deployment.

For developers, the practical takeaway is straightforward today: full AES and RSA are not broken. HAWK is not deployed. But the pace of AI-discovered cryptanalysis is accelerating. In just one year, LLMs went from being unable to crack basic ciphers to improving on expert-human results. If you are designing systems with multi-year security lifetimes, it is worth monitoring how fast this capability grows. And if you are building AI agents that interact with security-sensitive systems, the Agent Security Checklist and Claude Fable 5 Safeguards Architecture are good starting points for understanding the current threat model.

Sources#

• Anthropic research post: Discovering cryptographic weaknesses with Claude (accessed 2026-07-28)
• HAWK key recovery paper: anthropic.com/document/hawk_key_recovery.pdf
• AES Mobius Bridge paper: anthropic.com/document/aes_mobius_bridge.pdf
• CryptanalysisBench: arxiv.org/abs/2607.18538
• HN discussion: news.ycombinator.com/item?id=49087091 (accessed 2026-07-28)
• Project Glasswing initial update: anthropic.com/research/glasswing-initial-update

Continue Reading#

• AI Security Triage Bottleneck -- The Glasswing finding that Claude found 10,000+ critical vulnerabilities humans could not triage
• Claude Context Engineering Rules HN Analysis -- Why steering beats scripting in agent workflows
• Claude Fable 5 Solved the Jacobian Conjecture -- The previous math research milestone from Claude
• Securing AI Coding Agents -- A security checklist for teams deploying AI agents
• Fable 5 Safeguards and Refusal Architecture -- How Anthropic handles the tension between capability and safety in its frontier models