The list of post-quantum signature schemes that looked unbreakable until they weren't just got one name longer. Rainbow fell to a laptop in a weekend. SIKE fell in about an hour. HAWK — the last lattice-based candidate standing in NIST's additional signatures competition — fell this week to an AI model that spent 60 hours on the problem and roughly $100,000 in API credits.
Anthropic published the finding, alongside a second result against a reduced version of AES. Neither breaks anything running in production today. Both change the arithmetic of who gets to review cryptography, and how fast.
What actually broke
HAWK's security rests on the Lattice Isomorphism Problem, a hard math puzzle involving high-dimensional grids of points. Claude Mythos Preview — an unreleased model Anthropic has not made publicly available — found a nontrivial automorphism (a hidden symmetry in that grid) sitting in the specific lattice HAWK uses. Earlier researchers had proved that such a symmetry would enable a faster attack. Nobody had found one.
The effect is brutal in the way cryptographers measure things. Recovering a secret key from the smallest configuration, HAWK-256, was estimated at 2^64 operations. Mythos brought that to 2^38 — roughly 67 million times less work. The attack is still exponential, so larger HAWK parameters remain out of practical reach, and the flaw doesn't generalise to other lattice-based schemes.
The fix is the problem. Patching it means roughly doubling HAWK's keys, and as Anthropic put it, that eliminates "many of the reasons making the scheme" attractive in the first place. Compact keys and fast signing were the entire pitch.
The AES result needed convincing
The second finding targets AES-128, the cipher protecting your HTTPS sessions and encrypted drives. Full AES runs 10 rounds; researchers pointed Claude at a 7-round research variant that no one had improved since 2013.
The model initially refused, telling researchers there was nothing easy to find because "this is the most-studied block cipher in existence." Three prompts and a billion output tokens later, it produced a technique the paper calls a Möbius Bridge, eliminating one of the values an attacker previously had to guess and speeding the best known attack by 200 to 800 times.
A quieter third result may matter sooner. Mythos recovered a 13-round LEA key — a Korean national standard and ISO lightweight-crypto spec used in phones and IoT hardware — in under an hour on a desktop. Deployed LEA runs 24 rounds, so nothing in the field is exposed.
Humans are now the slow part
The uncomfortable detail is buried in the HAWK paper's author note: human contribution "mainly consisted of directing, organizing and verifying AI work." Claude found the AES idea in days. Anthropic staff then spent several hundred hours learning enough cryptanalysis to confirm it was real.
Anthropic also released CryptanalysisBench, 191 cipher-breaking tasks built with ETH Zurich, Tel Aviv University, and TU Berlin. Mythos solved 85.7% of tasks with known solutions. Against full-strength ciphers with no published break, every model tested scored under 9% — the current ceiling, and one worth watching.
What to do about it
Nothing here requires an emergency patch. HAWK has never shipped, and the AES and LEA results hit reduced-round variants only. The practical guidance hasn't changed, but the timeline pressure has:
- Stick to standardised algorithms. ML-KEM and ML-DSA (FIPS 203/204) survived the same gauntlet that HAWK just failed. Competition candidates are not standards.
- Build crypto agility now. Every system where swapping an algorithm requires a rewrite is a system betting that nothing will break. Three candidates say otherwise.
- Inventory what you actually run. You cannot migrate what you haven't catalogued — including the lightweight ciphers buried in embedded firmware.
- Treat harvest-now-decrypt-later as live. Long-lived secrets crossing RSA or ECDSA today are the exposure that matters, not HAWK.
The takeaway from Rainbow, SIKE, and now HAWK is consistent: post-quantum cryptography is a necessary bridge, not a destination, and none of it is provably secure. What's new is that the adversarial review keeping that bridge honest no longer runs at human speed.