On 28 July 2026, Anthropic published research showing that its controlled-access model Claude Mythos Preview discovered a previously unknown mathematical weakness in HAWK — a lattice-based digital signature scheme that had advanced to the third round of NIST’s Additional Digital Signatures process.

Within 24 hours, the HAWK team confirmed the attack and withdrew the candidate from NIST’s standardization process.

This is significant. It is not, however, a break of post-quantum cryptography in general, nor of any algorithm currently standardized or widely deployed.

What Exactly Happened?

HAWK is a hash-and-sign signature scheme based on the module Lattice Isomorphism Problem (module-LIP). It was designed to offer compact signatures and integer-only arithmetic — no floating-point operations — making it attractive for constrained environments.

Working with an Anthropic researcher over roughly 60 hours, Claude Mythos Preview identified a nontrivial automorphism: a previously unexploited symmetry in the specific lattice structure used by HAWK. Earlier theoretical work had shown that such a symmetry would enable a faster attack; no one had confirmed it existed in HAWK’s construction until now.

The result:

• For the smallest parameter set (HAWK-256), the estimated cost of full key recovery dropped from approximately 2^64 to 2^38.
• Practical key recovery on challenge instances was demonstrated in a few hours on a single server.
• Larger parameter sets (HAWK-512 and HAWK-1024) also saw reduced security estimates, though they remain computationally impractical to attack today.
• Restoring the original security margin would require roughly doubling key sizes — eliminating the compactness advantage that made HAWK competitive.

The attack is classical (not quantum) and specific to HAWK. It does not transfer to other lattice-based schemes such as ML-DSA (Dilithium) or FN-DSA (Falcon).

How AI Found What Experts Missed

Anthropic’s discovery process is worth understanding, because it signals a shift in how cryptographic review will work.

Mythos operated in a multi-agent harness with access to Python, Sage, and published cryptographic literature. A human operator with a theoretical computer science background — but not deep lattice cryptography expertise — provided project management rather than mathematical direction.

The key insight emerged when two worker agents investigated the same idea in parallel: one rejected it as infeasible; the other found a way to fully exploit it. After extensive literature review, mathematical reasoning, and computational experiments, Mythos built an end-to-end verification pipeline to confirm the attack.

The full discovery cost roughly $100,000 in API compute. That is a fraction of what a comparable human cryptanalysis effort might require — and it completed in days, not years.

Anthropic also reported a separate finding: an improved attack on 7-round AES-128 (a reduced variant of the full 10-round cipher). That result has no impact on production AES but reinforces the same message — frontier AI models are now contributing to research-level cryptanalysis, not just finding implementation bugs in libraries.

Why This Matters (and Why It Doesn’t Panic Us)

This episode is a textbook example of the NIST process working as designed. Candidates are published precisely so the global research community — and now advanced AI systems — can stress-test them before they become critical infrastructure.

Key takeaways:

• HAWK was never a standard. It was still under evaluation. No production systems relied on it.
• The already-standardized algorithms are unaffected. ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (SPHINCS+), and the forthcoming FN-DSA remain intact. The mathematical assumptions underlying these schemes are different and have undergone far more extensive public scrutiny.
• AI is accelerating cryptanalysis. What once took years of expert human review can now surface in days. This is powerful for defenders, but it also raises the bar for responsible disclosure and continuous evaluation.
• Verification is the new bottleneck. Anthropic notes that while Mythos discovered the AES attack in roughly a week, human researchers spent nearly a month validating its correctness. As AI output accelerates, the cryptography community will need new workflows to keep pace.
• Cryptographic agility is no longer optional. Organizations must be able to replace algorithms without major disruption.

HAWK is not the first NIST candidate to fall late in the process. SIKE — another post-quantum candidate — was completely broken in an hour on a laptop during the main PQC standardization effort. The system is designed to catch these failures before deployment.

What Organizations Should Do Now

1. Continue (or start) your cryptographic inventory. Know exactly which algorithms and key sizes you use today — classical and post-quantum.
2. Prioritize migration to the NIST-standardized algorithms. ML-KEM and ML-DSA are the primary recommendations for most use cases.
3. Design for agility. Hybrid certificates, algorithm negotiation, and modular crypto libraries make future transitions far less painful.
4. Test your readiness. Use tools that check real-world protocol support rather than theoretical claims.

If you haven’t already, run your domains through our free PQC Domain Checker. It reveals whether your servers actually offer quantum-resistant key exchange and signatures in practice — not just whether the algorithms exist on paper.

Our data shows that while PQC adoption is accelerating, most deployments remain incomplete. Knowing what you actually expose to the internet is the first step.

The Bigger Picture

The quantum threat remains real and long-term. Large-scale, cryptographically relevant quantum computers do not yet exist, but the harvest now, decrypt later risk is already here for long-lived data.

What this HAWK incident shows is that the defensive side is also accelerating. AI-assisted cryptanalysis — including Anthropic’s new CryptanalysisBench benchmark, built with ETH Zurich, Tel Aviv University, and TU Berlin — is becoming a permanent feature of the landscape.

That makes thorough public review, diverse algorithm portfolios, and genuine cryptographic agility more important than ever.

Post-quantum cryptography is not broken. One candidate was stress-tested, found wanting, and removed — exactly as the process intends.

The standards that matter are still standing. The work of migrating to them continues.

Need help assessing or accelerating your post-quantum migration? Contact QuReady or explore our PQC readiness assessment and implementation services.

Last updated: 29 July 2026