A Candidate Died in About Twenty-Four Hours

On July 28, 2026, a message landed on pqc-forum, the public mailing list NIST uses to run post-quantum standardization out in the open. The subject line was dry: "HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1." To anyone outside the field that reads like noise. To anyone inside it, that sentence is a death certificate. The author was Stephen A. Weis of Anthropic, and buried in the post was a claim that made the thread unusual: the result had been produced by Claude with minimal human technical guidance. Within the hour, Daniel Apon — a cryptographer deeply involved in NIST's standardization process — replied with four words that carried a lot of weight. "Nice. It checks out independently for me."

The next day, July 29, Léo Ducas posted to the same list on behalf of the HAWK team. They were withdrawing the scheme from NIST's additional signatures standardization process. A submission that had been built, defended, revised, and pushed through two full rounds of adversarial expert review since 2022 lasted roughly one day after the attack went public. Go look at NIST's Round 3 additional signatures page right now. Under lattice-based signatures there's exactly one entry, HAWK, and next to it sits the word "withdrawn." The page was last updated July 29, 2026. That's not a press release or a vendor claim — it's the standards body's own record, which makes it the hardest fact in this entire story.

Here's the thing, though: "HAWK got broken" is not actually the news. HAWK was never deployed anywhere. The parameter set that fell to a practical, run-it-on-a-server attack wasn't HAWK-512 or HAWK-1024 — the ones NIST was actually evaluating — but HAWK-256, a research challenge size. The news is who found it and how fast. Anthropic handed an unreleased research-preview model, Claude Mythos Preview, a multi-agent scaffold built on top of Claude Code, plus access to Python, the Sage mathematics system, and the published cryptographic literature. The model read the field, formed hypotheses, ran computational experiments to test them, threw out what failed, and went again. Sixty hours later, and roughly $100,000 in API spend, it had a structural flaw that some of the best lattice cryptographers alive had stared past for more than two years.

So let's get into the questions worth answering. What exactly did the model find, and why was it invisible to humans who were specifically looking? The jump from 2^64 to 2^38 operations sounds catastrophic — is it, or is that number doing less work than it appears? What is the "Möbius Bridge," the second finding, and why did Anthropic hammer so relentlessly on "nothing you use got weaker"? Why did the HAWK team fold in a single day instead of proposing bigger parameters? And the one that actually matters long-term: does the way we vet cryptographic standards have to change now, or was this a lucky shot at an unusually fragile target?

Who's Actually Standing on This Field

Start with Anthropic. The work came out of the company's frontier red team research orbit, and the model in question is Claude Mythos Preview — emphasis on preview. This isn't something you can call through the API. It's an internal artifact Anthropic runs to measure where the capability ceiling actually is. In the announcement the company described these as "the strongest attacks we have found to date," and then spent a remarkable amount of the same document undercutting its own headline: neither result, it repeated, has practical impact on today's computer systems. That's not false modesty. Anthropic clearly knew that a slightly sloppier framing turns into "AI BREAKS ENCRYPTION" within an hour, and the reputational cost of that would land on them.

Next, the HAWK team. According to the project's official site, HAWK was built by around ten cryptographers spread across NXP Semiconductors, CWI (the Dutch national research institute for mathematics and computer science), PQShield, and other institutions. The author list includes Joppe W. Bos, Léo Ducas, Thomas Prest, and Ludo N. Pulles — these are not marginal figures. Ducas and Prest were both involved in designing Falcon, which NIST already standardized as FN-DSA. HAWK's pitch was specific and appealing: fast, compact, and completely free of floating-point arithmetic, which is a genuine engineering headache in Falcon. HAWK-512 targeted NIST security level 1 with a 1,024-byte public key, a 555-byte signature, and a 184-byte private key. It was also the last lattice-based scheme still alive in NIST's additional signatures track.

Then there's NIST and the open-review community that surrounds it. NIST has been running post-quantum standardization since 2016, producing ML-KEM (Kyber), ML-DSA (Dilithium), and SLH-DSA (SPHINCS+). It then opened a separate call for additional signature schemes, explicitly because putting nearly all of the world's signature eggs in the lattice basket felt uncomfortable. The defining feature of this process isn't closed committee review — it's public sniping. Anyone can post an attack to pqc-forum. When a candidate dies, that is officially treated as the system working rather than the system failing. Apon confirming the math within an hour and the authors withdrawing the next day is exactly what that machinery looks like when it fires correctly.

Finally, the stakeholders whose names never appear in the thread: every organization currently planning a cryptographic migration. Federal agencies, banks, cloud providers, browser vendors, certificate authorities. All of them are under pressure from the "harvest now, decrypt later" threat model, which says adversaries are already storing encrypted traffic to open once a cryptographically relevant quantum computer exists. For these people the story reads two ways at once. Reassuring, because the flaw got caught before deployment. Unnerving, because if a preview model can do this to a scheme that survived two years of scrutiny, the obvious next question is what it could do to the schemes that already shipped.

What Actually Happened

Start with the lattice. Lattice cryptography, described crudely, rests on the difficulty of finding the shortest vector in a high-dimensional grid of points — the Shortest Vector Problem, or SVP. Cost blows up exponentially with dimension, which is where the security comes from. But symmetry changes that math. If a lattice maps onto itself under some transformation, an attacker can fold the search space instead of walking all of it. What Mythos found is precisely that: a previously unexploited nontrivial automorphism in the lattice HAWK uses. The genuinely striking part is that prior work had already established the conditional — earlier researchers had shown that if you could efficiently find such an automorphism, an attack would follow. Nobody had answered whether one actually existed in HAWK's lattice. Anthropic's framing was blunt: Mythos Preview found the additional automorphism needed to exploit the path.

Now the numbers, and this is where you need to read carefully. Per the pqc-forum post, HAWK-n key recovery reduces to SVP in dimension n/2 + 1 — the attacker's working dimension gets cut roughly in half. On HAWK-256, the research challenge parameter, expected full key-recovery cost drops from about 2^64 operations to 2^38. That's 26 bits of exponent, which translates to roughly 67 million times less work. Anthropic didn't stop at theory, either; they ran it. A HAWK-256 secret key came out in about three hours and forty-two minutes on a single 96-core server, and the reproduction code went up on GitHub under Apache 2.0 alongside AES and LEA material. For the parameter sets NIST was actually evaluating, the attack stays firmly out of reach: HAWK-512 goes from 2^150 to 2^108, and HAWK-1024 from 2^288 to 2^182 in the AGPS'20 gate-count model. Nobody is computing 2^108 of anything. So why did the team quit? Because the fixes are worse than the disease. Doubling parameters or moving to higher-rank modules restores the security level but destroys the entire reason to pick HAWK over ML-DSA. Cloudflare's Bas Westerbaan made that point directly in the forum thread — inflate the parameters and you eliminate most of what made HAWK attractive.

The second finding is a different animal. The target here is AES-128, but not the AES-128 in your TLS session — a research-reduced seven-round variant, where the real standard uses ten. Cryptographers routinely attack round-reduced ciphers to measure how much safety margin a design has left. On that target, Mythos largely independently invented a technique Anthropic named the Möbius Bridge. The strongest known meet-in-the-middle attacks on 7-round AES required guessing one of 256 possible values at a critical juncture. Mythos constructed a fingerprint that is invariant to that guess, which deletes the guessing step entirely. Net effect: a 200x to 800x speedup over prior best work, with the range depending on how you count execution time. This run went near-autonomously for three days, burned through hundreds of millions of tokens, and involved only a handful of short human nudges. Early on, when the model pushed back that the challenge as posed wasn't winnable, it produced a line Anthropic chose to quote in the announcement: "If you want a different outcome, the target has to change."

Now the cold water, and it matters. Even with an 800x improvement, this attack is not runnable. It needs roughly 2^105 chosen plaintexts, a quantity of data that does not and will never exist. The target is seven rounds; real AES-128 is ten. Your HTTPS connections, your disk encryption, your messaging app — none of it got one bit weaker on July 28. Anthropic published both results as papers, the HAWK key recovery paper and the AES Möbius Bridge paper, plus a companion benchmark built with outside academics including researchers at ETH Zurich and Tel Aviv University. That benchmark, CryptanalysisBench, contains 191 tasks across six families of cryptographic primitives, sorted into three difficulty tiers, and scores five frontier models: Claude Opus 4.8, Sonnet 5, Mythos 5, GPT-5.5, and the open-weights GLM 5.2. On tier one — schemes with known practical breaks — models solved 65% to 86%. Along the way the models produced results that weren't in the literature at all, including a key-recovery attack exploiting design flaws in SpoC AEAD and errors identified in KINDI's security proofs.

Item Detail Basis
Model Claude Mythos Preview (unreleased research preview) Anthropic research post
Setup Multi-agent scaffold on Claude Code; Python, Sage, published literature Anthropic research post
HAWK core finding Nontrivial automorphism in HAWK's lattice Anthropic HAWK paper (PDF)
Reduction HAWK-n key recovery reduces to SVP in dimension n/2 + 1 pqc-forum post, 2026-07-28
HAWK-256 cost 2^64 → 2^38 operations (~67 million times less work) Anthropic post; CSO Online
HAWK-512 / 1024 2^150 → 2^108 / 2^288 → 2^182 (AGPS'20 gate model) pqc-forum post
Demonstration HAWK-256 secret key recovered in ~3h42m on one 96-core server Anthropic post; The Hacker News
Resources ~60 hours of model work, ~$100,000 in API cost Anthropic post
AES finding "Möbius Bridge" on 7-round AES-128; 200–800x over prior best Anthropic AES paper (PDF)
AES limitation Requires ~2^105 chosen plaintexts; full 10-round AES unaffected The Hacker News
External check Daniel Apon: "It checks out independently for me" (math reduction only) pqc-forum thread
Outcome HAWK withdrawn July 29; NIST Round 3 page marks it "withdrawn" NIST CSRC Round 3 page

Who Wins and Who Eats the Loss

Anthropic is the obvious winner, and not in the usual benchmark-chart way. This is a result carved into an external institution's permanent record. The word "withdrawn" on a NIST page is not marketing copy — it's an adjudication by a standards body, and the thing that triggered it was a model the public can't even use yet. That's a capability argument no eval score can match. Anthropic also didn't leave it as a flex. The company explicitly raised the unresolved policy question of how researchers, companies, and governments should respond when a language model finds a flaw in cryptography protecting critical infrastructure, and said it hopes the work drives that discussion. That's a shrewd position to stake out ahead of regulation. And the economics deserve attention on their own: roughly $100,000 bought an outcome equivalent to months of work by several world-class specialists. Cryptanalysis is quietly moving from a headcount problem to a compute line item.

The HAWK team took the clear loss. Four years, two rounds, countless talks and rebuttals, gone. But their conduct is going to be remembered better than the loss. They didn't stall, didn't argue the attack away, didn't ship a face-saving parameter bump. They verified the result and pulled the submission in a day. The team's own reflection was disarmingly plain — one of their heuristics turned out to be invalid, found by colleagues working with AI assistance, and the lesson they drew was that humans make mistakes and humans are slower than AI. Read honestly, this isn't a story about a team that was careless. It's a story about the ceiling of human review. Dozens of eyes over two years can genuinely fail to see a structure that is there.

NIST and the standards community are in a more ambiguous spot. The surface reading is a clean win — the flaw was caught pre-deployment, which is exactly what the gauntlet exists to do. Ellen Boehm of Keyfactor read it that way, framing the episode as evidence the NIST evaluation process is functioning. Flip it over, though, and uncomfortable questions stack up. This time the discovering party was cooperative: Anthropic says it shared the HAWK finding with the scheme's authors back in June before coordinating disclosure through the NIST list in July. That was goodwill, not a rule. What happens when the next party with equivalent capability doesn't do that? And what happens to a review process built on volunteer human hours when machines can generate plausible cryptanalytic claims faster than anyone can check them? That's why Apon pushed in the thread for a community standard to adjudicate AI-generated cryptanalytic claims, invoking Scott Aaronson's famous list of warning signs for bogus proofs as a model. Markku-Juhani Saarinen argued the same direction from the evidence side: AI-assisted cryptanalysis should arrive with machine-checkable proofs or working demonstrations against scaled-down targets — something tangible.

There's a subtler casualty worth naming: diversity within the signature portfolio. This attack does not touch Falcon/FN-DSA, ML-DSA, or lattice cryptography as a family — Anthropic said so explicitly and the forum thread backs it. The problem is that HAWK was the only lattice-based scheme left in the additional signatures track. With it gone, the nine Round 3 candidates are isogeny-based (SQIsign), MPC-in-the-head (MQOM, SDitH), multivariate (MAYO, QR-UOV, SNOVA, UOV), and symmetric-based (FAEST). Since the whole point of the additional call was to find non-lattice options, you can argue this is the process converging on its stated purpose. Still, the practical slot HAWK was competing for — small, fast, floating-point-free signatures — now has one fewer contender.

We've Seen Versions of This Before

Candidates dying in cryptographic competitions is routine, and the most spectacular recent example is SIKE. An isogeny-based key encapsulation scheme that made it all the way into NIST's fourth round, SIKE was demolished in 2022 by Wouter Castryck and Thomas Decru of KU Leuven, who applied a theorem from the 1990s and recovered keys on a single laptop in about an hour. The same year, Rainbow collapsed. A multivariate signature scheme that had reached the third-round finals, it fell to Ward Beullens, who recovered a key over a weekend on a laptop. The lesson both times was identical to the lesson now: surviving years of public review is not proof of security, it's just absence of disproof. And both times, the community's framing was the same one being used this week — better here than in production.

For the success column, look at the AES competition itself. NIST issued the call in 1997, the world's cryptographers spent three years publicly trying to destroy each other's candidates, and Rijndael was selected in 2000. More than twenty-five years later there is still no practical attack on full 10-round AES-128. The Möbius Bridge result actually reinforces this: the best the strongest available research effort could do was speed up an attack on a seven-round toy version by a couple of orders of magnitude, and that attack still needs an impossible amount of data. Open adversarial review, given enough time, produces durable artifacts. The SHA-3 competition followed the same arc with the same outcome.

On the AI side, there are real precedents too. Google's Big Sleep, built jointly by Project Zero and DeepMind, found a genuine previously unknown memory-safety vulnerability in SQLite in late 2024 — the first publicly documented case of an LLM agent discovering an exploitable bug in widely deployed production software. In 2025 the same system, combined with threat intelligence, caught an SQLite flaw (CVE-2025-6965) that attackers already knew about and were preparing to use, shutting it down before exploitation. In mathematics, DeepMind's AlphaEvolve improved long-static matrix multiplication results, and Anthropic's own announcement pointed at an OpenAI model disproving a conjecture in discrete geometry. The direction of travel is consistent: these systems have moved past summarizing known results and into producing new ones.

The failure precedent matters just as much. Over the past couple of years, open-source security maintainers have been buried under AI-generated vulnerability reports that read plausibly and contain nothing. Daniel Stenberg of curl has repeatedly and publicly complained that AI-written bug bounty submissions consume scarce human verification time while yielding almost nothing real. The reason the HAWK case landed differently is structural: the claim was a mathematical reduction someone else could check, reproduction code shipped with it, and the AES paper went through what amounted to nearly a month of human cryptographer verification. Strip out verifiability and scale up volume, and you get the curl outcome rather than the HAWK outcome. That failure mode — not the attack itself — is what Apon and Saarinen are trying to build guardrails against.

How the Rest of the Field Counters

Google is the most likely first responder. It already had the lead narrative in AI-driven vulnerability discovery through Big Sleep, and it's been publicly pushing timelines for post-quantum migration. Now that Anthropic owns a headline that reads "our model removed a candidate from a NIST standardization track," Google has a strong incentive to demonstrate comparable mathematical discovery. DeepMind's AlphaEvolve and FunSearch lineage already produces novel results in combinatorics and algorithm design, and pointing that at cryptanalysis is a short step. That said, Google sits on the defender side of the internet in a way Anthropic doesn't, so expect its framing to lean toward "what we prevented" rather than "what we broke."

OpenAI is arguably already in this story, indirectly. According to reporting from implicator.ai, on July 17 — ten days before Anthropic's disclosure — a researcher named Hengyi Luo published a separate GPT-5.6-assisted attack on HAWK. That's a single-outlet account and the details deserve independent confirmation, but if it holds, the context shifts meaningfully. It would mean HAWK wasn't felled by one lab's isolated breakthrough; it was under converging pressure from multiple models and multiple researchers probing the same structure at the same time. GPT-5.5 is also one of the five models scored in CryptanalysisBench, which gives OpenAI both a reason and a ready-made venue to publish its own cryptanalysis numbers.

Chinese labs and the open-weights ecosystem are the quieter variable. The single most consequential detail in the benchmark may be that GLM 5.2, an open-weights model, is in the scored lineup at all. If meaningful cryptanalytic capability isn't confined to closed frontier models behind API gates, then controlling who has this capability stops being a viable policy lever, and the conversation has to shift to disclosure norms and defensive deployment instead. That calculus is almost certainly part of why Anthropic pushed the policy question so hard in its announcement. Expect "cryptanalysis capability" to become a standard line item in frontier model evaluations, and expect national AI safety institutes to add it to pre-deployment checklists.

The cryptography community's own counter-play may be the most interesting of all, and it'll likely split in two directions that reinforce each other. The offensive-defensive move is to normalize AI red-teaming as a prerequisite: before you submit a scheme, you run frontier models against your own design hunting for exactly this kind of hidden structure. That's straightforwardly rational, and NIST could bake it into the rules for a future call. The gatekeeping move is Saarinen's: require AI-generated claims to arrive with machine-checkable proofs or scaled-down demonstrations, which functions as a filter protecting finite reviewer attention. Both can coexist. Anthropic, for its part, has signaled it wants to host the conversation, announcing plans for an academic workshop on the role of language models in security and cryptography research.

One more thing worth flagging: Anthropic already published its next targets. The company said it has preliminary attacks on 13-round LEA, 6-round Serpent-128, Salsa20, Poseidon, and SHA-1. Poseidon is the one to watch outside academia — it's widely used as a hash function inside zero-knowledge proof systems, which means the blockchain world has a direct stake in whatever comes next. That list is simultaneously a pressure signal to competitors and a prioritization roadmap for defenders.

So What Actually Changes

If you're a developer, the honest answer is: nothing today. Don't touch your TLS config, don't rip out AES-GCM, don't panic about disk encryption. The one concrete cleanup item is narrow — if you have experimental code carrying PQC candidates and HAWK is among them, you can drop it, and you now have an unimpeachable citation for why, since NIST's Round 3 page lists it as withdrawn. The more durable takeaway is crypto agility. The old advice about not hardcoding algorithms and keeping primitives swappable behind an interface has always been easy to defer. This week gave it a concrete price tag: if algorithms can go from "surviving expert review" to "formally withdrawn" in a single day, your replacement cycle needs to be measured in weeks, not years.

If you're an investor, there are two signals here. First, how frontier labs prove value is shifting. Benchmark deltas are getting cheap and contested; a permanent entry in an external standards body's record is not. Anthropic bought one for about $100,000, which is a rounding error against training costs and an extraordinary return in narrative terms. Second, this is a legible data point on compute substituting directly for elite expert labor. Sixty hours and six figures overturned two years of review by specialists at the top of their field. That arithmetic may generalize to adjacent domains — formal verification, materials search, algorithm optimization. But be careful with the extrapolation: this worked in a domain where answers are checkable. Apon could confirm the reduction in an hour precisely because mathematics permits that. Push the same claim into fields where verification is slow or subjective and the economics fall apart.

If you're a regular person, this changes nothing about your security. Your messages, your banking app, your saved passwords are exactly as safe as they were last week. If anything it's mildly good news, since the failure was caught before anything shipped. What is worth internalizing is a filter for the next few years, because "AI breaks encryption" headlines are going to keep coming. Three questions sort the real from the inflated. Is the target a deployed algorithm or a competition candidate? Is it the full-strength version or a round-reduced research variant? And did anyone actually recover a key, or is this a theoretical speedup? This story answers: candidate, both (reduced for AES, full for HAWK but at challenge size), and yes but only on the toy parameter set.

If you run security for a company or agency, this is your prompt to do inventory. Boehm's point was the practical one — you need visibility into what cryptography you're using and where. Build a cryptographic bill of materials, ask your vendors for their PQC migration plans in writing, and rehearse an algorithm swap at least once so you know how long it actually takes. The correct reading of this week is not "what you're running is unsafe." It's "how fast could you move if it became unsafe?" For policymakers and regulators, the harder homework is disclosure protocol. When a frontier model finds a flaw in cryptography protecting real infrastructure, who gets told first, how long does it stay private, and through what channel does it go public? Anthropic followed textbook coordinated disclosure here — authors in June, public forum in July. That was a choice, not an obligation, and right now there's nothing that would compel the next party to make the same one.

🥄 Three Things You're Probably Wondering

— So what does this mean for me? Practically nothing, right now. HAWK was never deployed anywhere and the AES work targeted a reduced research variant, so nothing on your devices got weaker. The realistic downstream effect is that as standards get proposed and killed faster, the apps and services you use will swap out cryptographic algorithms more often than they used to.

— Why is this happening now specifically? It's less about raw intelligence and more about endurance. This result came from sixty hours of reading literature, forming hypotheses, running Sage computations, failing, and re-forming — a loop that only became possible once models could hold tools and context over very long horizons. You were never going to get this from a single prompt, no matter how smart the model.

— Does this mean other ciphers fall next? Too early to call. Anthropic disclosed preliminary attacks on Salsa20, Poseidon, SHA-1 and a few round-reduced ciphers, but preliminary is doing real work in that sentence, and nothing full-strength and deployed has been practically broken. The safer bet is that more candidates get eliminated during standardization, not that deployed cryptography starts failing.

Sources

Numbers are as of announcement and may change.