In a breakthrough that’s stirring discussions in cybersecurity circles, researchers have uncovered weaknesses in two encryption systems: the post-quantum signature scheme HAWK and a reduced variant of the AES encryption standard. The findings, unveiled by the Frontier Red Team at Anthropic, highlight both the power and limitations of artificial intelligence in identifying cryptographic flaws, while emphasizing that the impact on current systems remains minimal.

Unmasking the post-quantum hawk

HAWK, a signature scheme designed to withstand attacks from quantum computers, had been a strong contender in the NIST’s post-quantum cryptography standardization process. The algorithm had successfully passed two rigorous review rounds over two years, showcasing its resilience against conventional attacks.

However, the team’s experiments with Mythos Preview—Anthropic’s internal AI model—revealed a hidden vulnerability. By exploiting a geometric symmetry in the Euclidean lattice isomorphism problem, researchers were able to cut the complexity of key recovery in half. For the HAWK-256 variant, this meant reducing the computational effort from 2⁶⁴ to 2³⁸ operations, enabling a full key extraction in just 3 hours and 42 minutes using a standard 96-core server.

The discovery forced the HAWK team to withdraw the algorithm from the NIST selection process on July 29, rendering it obsolete for practical use. While the breakthrough doesn’t spell doom for current systems, it underscores the fragility of cryptographic assumptions in the face of advanced AI-driven analysis.

Peeling back the layers of AES

The second focus of the research was AES, the gold standard for symmetric encryption. Unlike HAWK, AES is a battle-tested algorithm powering everything from financial transactions to secure communications. The team targeted a deliberately weakened version of AES-128, restricted to just 7 of its 10 standard transformation rounds, to test the limits of AI-assisted cryptanalysis.

Using a novel invariant fingerprinting technique dubbed the “Möbius Bridge,” researchers integrated a meet-in-the-middle attack that eliminated a critical exhaustive search step. This innovation accelerated the attack speed by a factor of 200 to 800 compared to previous benchmarks from 2013. Yet, the finding remains confined to academic exploration, as the full 10-round AES standard remains impervious to such tactics.

Reflections on AI’s growing role in cryptanalysis

The revelations prompt important questions about the future of cryptographic research. While AI models like Mythos Preview can uncover weaknesses faster than traditional methods, the verification process remains human-intensive. For instance, validating the HAWK findings required 60 hours of autonomous computation and a month of review by two researchers. The AI’s initial refusal to engage with the reduced AES variant—claiming no improvements were possible—only adds to the complexity.

Moreover, the financial and computational costs are significant. Had the team used Anthropic’s commercial tools, the HAWK analysis alone would have run up a $100,000 bill in API fees. The AES research, though cheaper, still demanded substantial resources to refine the AI-generated attack methodology.

The bottleneck shifts to human oversight

The broader implication is clear: the bottleneck in cryptanalysis is no longer finding flaws but validating them. The surge in vulnerabilities discovered by AI tools—across platforms like Firefox, Windows, and Apple systems—has overwhelmed existing review processes. As AI continues to push boundaries, the cybersecurity community must adapt to ensure rigorous, human-led verification of AI-generated discoveries.

For now, the systems we rely on remain secure. Yet, the rapid evolution of AI-driven cryptanalysis signals a new era where traditional methods must evolve to keep pace with machines capable of uncovering hidden weaknesses in mere hours.