Generated by Codex with GPT 5.6 Sol XHigh

Techmeme surfaced the research on July 28, pointing readers to Anthropic’s original report, Discovering cryptographic weaknesses with Claude. The headline sounds like an internet emergency: an AI model attacked a post-quantum signature candidate and a version of AES. The actual result is narrower and more interesting. Claude did not break the encryption protecting today’s web, but it did produce expert-level cryptanalysis that survived human checking—and it generated the ideas much faster than people could validate them.

That gap between discovery and verification may be the durable story. AI can now search mathematical attack spaces at enormous scale, but a plausible proof or optimized algorithm is not automatically correct. Anthropic’s researchers spent far longer establishing confidence in Claude’s output than the model spent proposing it. Cryptography may therefore be approaching the same transition already visible in AI-generated software: producing candidate work becomes cheap, while proving that the work deserves trust becomes the bottleneck.

A Real Break of a Candidate, Not Deployed Encryption

The first result concerns HAWK, a digital-signature scheme under consideration in the third round of a U.S. National Institute of Standards and Technology process for additional post-quantum signatures. Such schemes are designed to keep digital identities and messages verifiable even if large quantum computers eventually make common public-key systems unsafe.

HAWK had already passed through two years of expert review. In roughly 60 hours, a group of Claude Mythos Preview agents found a previously unused mathematical symmetry in the lattice underlying the scheme. That symmetry enabled a faster key-recovery method. For the smallest proposed parameter set, HAWK-256, Anthropic says the expected work fell from about 2^64 operations to a demonstrated 2^38. Larger versions remain impractical to attack, and the finding does not generalize to other post-quantum candidates or lattice cryptography as a whole.

The attack still matters. Restoring the intended security margin would require much larger keys, erasing advantages that made HAWK attractive. This is precisely why NIST publishes candidate schemes before standardizing them: adversarial review is supposed to expose weaknesses before deployment. Claude accelerated that process; it did not compromise a system people currently use.

The discovery process also shows what “autonomous research” means in practice. Claude agents reviewed the literature, performed mathematical reasoning, ran computational experiments, and built an end-to-end verification pipeline. Two agents pursued the decisive idea in parallel: one rejected it too early, while the other found how to exploit it and persuaded the first through further exchanges. A human with a theoretical-computer-science background managed the work and offered operational guidance, but was not a lattice-cryptography specialist. Anthropic estimates the model usage cost about \$100,000.

The AES Result Is Impressive—and Deliberately Impractical

The second result targets AES-128, the dominant symmetric cipher used to protect data. Full AES-128 applies ten rounds of transformation. Researchers often study reduced-round versions because they are easier to attack and can reveal techniques that might later generalize, much as engineers stress-test a simplified component to understand the safety margin of the complete design.

Claude attacked a seven-round variant, not production AES. The prior method also assumes access to 2^105 chosen plaintexts—an impossibly large collection of messages selected by the attacker and encrypted under the same unknown key. Even Anthropic’s improved method would cost hundreds of millions of dollars to execute. No deployed software needs to change because of this finding.

Within that academic problem, however, the improvement is substantial. Claude devised a fingerprinting method it called the Möbius Bridge. The fingerprint stays unchanged across a value that the previous best attack had to guess 256 different ways. After accounting for the extra cost of computing the transform, Anthropic reports a 200-to-800-fold speedup over the earlier state of the art.

This experiment was even more autonomous than the HAWK work. A researcher built a scaffold that let Claude form hypotheses, run experiments, reject failures, and preserve useful results. The model initially insisted the target was too hard and tried to retreat to easier ciphers. After three short interventions telling it to keep pursuing a publishable advance, Claude worked for several days, produced hundreds of millions of tokens, found the key idea, and eventually consumed about one billion output tokens. Anthropic again estimates roughly \$100,000 in API usage.

The expensive part for people came afterward. Researchers spent several hundred hours learning enough of the relevant cryptography to check the claims, and nearly a month before they were confident the method was correct. Claude’s attack was discovered in about a week. This asymmetry is both encouraging and dangerous: a system can create more novel technical claims than qualified humans can responsibly evaluate.

Benchmarks Are Becoming Research Scaffolds

Anthropic also worked with researchers from ETH Zurich, Tel Aviv University, and the University of Haifa on CryptanalysisBench, a collection of 191 tasks spanning six families of cryptographic primitives. The benchmark includes schemes with known practical breaks, stronger candidates with no known practical break, scaled-down variants, and production-level challenge problems.

Across five frontier models, the paper reports success on 65% to 86% of the easiest tier, along with multiple full-strength and scaled-down problems in the harder tier. The systems did not merely reproduce known attacks: the authors report previously unknown findings involving the SpoC authenticated-encryption design and a published security proof for KINDI. CryptanalysisBench therefore serves two purposes. It measures model capability, but it also packages the tools, verification targets, and prior work needed for models to attempt new research.

That distinction matters because a benchmark can become an engine for capability rather than a passive test. Once the environment automatically checks candidate attacks, stronger models can search the space repeatedly and turn failures into training or workflow improvements. Cryptography is especially suitable because many claims can ultimately be tested with mathematics and code, even when the path to the claim is creative.

The New Risk Is Uneven Verification Capacity

Anthropic disclosed the HAWK result to its authors, the government, and industry partners before publication, then released papers and demonstration code. Those steps are reassuring for research on undeployed or deliberately weakened systems. They do not settle what should happen when a model finds a practical break in a cipher already protecting financial, government, or communications infrastructure.

The immediate lesson is not to panic about AES. Full AES remains unbroken, HAWK is not deployed, and both attacks are still exponential or otherwise impractical at relevant settings. The more serious signal is the rate of change. In Anthropic’s account, models moved within roughly a year from failing basic cryptanalysis to finding a flaw that survived years of human review. Other ciphers have received far less attention than AES, and automated research can examine that long tail much faster than the small community of expert cryptographers can.

This creates a defensive opportunity and a coordination problem. Models could stress-test candidate standards, revisit neglected algorithms, and help designers improve systems before attackers do. But responsible disclosure, independent reproduction, remediation, and migration remain human and institutional processes. If discovery scales faster than those processes, the backlog itself becomes a security risk.

The clean takeaway is that Claude did not crack the internet. It demonstrated that frontier models can participate in cryptographic research at a level where their findings deserve serious expert attention. The next challenge is no longer just making models capable of finding weaknesses. It is building enough verification capacity, disclosure discipline, and deployment readiness to ensure that faster discovery leads to stronger security rather than a pile of unaudited claims—or vulnerabilities no one can fix quickly enough.