From HAWK Withdrawal to 7-Round AES: The Technical Reality Behind Anthropic Mythos's Cryptographic Breakthroughs

In July 2026, the NIST PQC Round 3 official status page recorded a major change: HAWK, a post-quantum digital signature algorithm selected for Round 3 evaluation, was voluntarily withdrawn by its design team. The direct catalyst for the withdrawal stemmed from research findings on the Claude Mythos Preview model disclosed by Anthropic in the Anthropic official research announcement. Not only did the model derive a key recovery path targeting HAWK, but Anthropic also released verification code alongside the HAWK Key Recovery paper. After reviewing the results, the HAWK team confirmed in the HAWK team’s withdrawal statement on the NIST forum that the attack roughly halves the lattice reduction block size required to recover an equivalent private key. Because forcibly increasing parameters to maintain security would compromise its lightweight and fast performance advantages, the design team opted to withdraw from the selection.

In the concurrently released AES Möbius Bridge paper, Anthropic also presented the model’s analytical progress on the classic symmetric encryption algorithm AES-128. The Möbius Bridge method proposed by the model improves the cryptanalysis efficiency of a 7-round reduced variant of AES-128 by a constant factor. Cryptographers noted in Matthew Green’s cryptography blog commentary that this achievement represents a purely academic algorithmic optimization that in no way affects the security posture of 10-round AES-128 deployed in production environments. Together, the sudden withdrawal of a candidate algorithm in the competition and the academic optimization of symmetric encryption outline frontier AI models’ genuine exploration along the boundaries of cryptographic offense and defense.

Rule Analysis and Quantum Threats: How Do Quantum Computers Break Classical Encryption?

The life-and-death decisions for algorithms in the competition rest on cryptographic engineering’s rigorous assessment of security margin. Security margin is a cryptosystem’s buffer zone against unknown mathematical breakthroughs. If a new attack significantly weakens an algorithm’s mathematical hardness, the design team must expand key sizes or increase the number of computational rounds. For candidate algorithms that prioritize being lightweight, parameter bloat directly undermines their competitiveness in engineering deployment.

The global urgency to find a new generation of post-quantum algorithms stems from the fundamental disruption that quantum computing poses to classical asymmetric encryption. Classical public-key algorithms like RSA base their security on the difficulty of large integer factorization. Forward calculation of the product of two large prime numbers $p \times q = N$ incurs very low overhead, but classical computers have no known polynomial-time inverse algorithm; currently, the best general-purpose integer factorization algorithm is the sub-exponential number field sieve, rather than simple brute force.

The core weapon quantum computers use to break this balance is Shor’s algorithm. It transforms integer factorization into finding the period of a modular exponentiation function, then uses the quantum Fourier transform to sample the period information. Once the period is recovered, classical computation can deduce the factors $p$ and $q$ in polynomial time.

Lattice-based cryptography builds its security on hard problems in high-dimensional lattices, such as finding sufficiently short vectors. The research community currently does not know how to transform such problems into period-finding tasks suited for Shor’s algorithm, nor has it discovered classical or quantum algorithms that can efficiently solve them at cryptographic parameters. Consequently, lattice-based cryptography has become one of the primary paradigms for post-quantum cryptography.

Dissecting the HAWK Attack: Dimensionality Reduction in High-Dimensional Lattices

Given that researchers have not found a general-purpose quantum algorithm that can efficiently break lattice-based cryptography, why did HAWK fall to Mythos? The answer lies in HAWK’s own algebraic structure. HAWK’s private key is a set of secret key vector bases inside a high-dimensional lattice that are geometrically extremely short and nearly orthogonal; a user holding these short vectors can generate signatures. The public key, meanwhile, hides the short vectors themselves and publishes only the geometric projection relationships between them, namely the Gram matrix $Q = B^* B$.

In the 2025 theoretical study on HAWK secret bases, researchers had already proven that if an attacker could obtain a non-trivial automorphism of HAWK’s underlying integer lattice, key recovery could achieve at least a quadratic speedup. However, that study did not show how to derive such an automorphism relying solely on HAWK’s public key, and the paper explicitly stated at the time that the findings did not yet affect HAWK.

The Mythos model’s breakthrough completed precisely this unfinished algebraic derivation. The model identified the specific automorphism Galois involution $\tau: \zeta \mapsto -\zeta$, and then utilized the public key Gram matrix to construct the private key’s transformation relationship under this mapping as a $\tau$-cocycle lattice $\Lambda_\tau(Q)$ dependent only on the public key. In the HAWK Key Recovery paper, Mythos proved that this sublattice exhibits algebraic isomorphism properties, where its shortest vectors correspond exactly to the hidden symmetry transformations, and these target vectors are concentrated in the subspace $\mathbb{Z}^{n/2+1} \oplus \sqrt{2}\mathbb{Z}^{n/2-1}$.

This construction compresses the most difficult search at the algorithmic level. Taking HAWK-512 as an example, the attack first constructs a $\tau$-cocycle lattice of rank 512 from the public key, and then leverages its special structure to reduce the invocation dimension of the exact shortest vector solver to 257 dimensions—that is, $n/2+1$. Lattice reduction costs are highly sensitive to dimension and block size, so this reduction significantly lowered estimated costs. Anthropic subsequently released an automated solver script invoking BKZ and Sieve algorithms, which solved the equivalent private key for HAWK-256 test parameters in 3 hours and 42 minutes on a 96-core reference machine; as of the verification of this article, no public third-party full reproduction of this end-to-end pipeline has been found.

The HAWK team confirmed in the HAWK team’s withdrawal statement on the NIST forum that the attack roughly halves the lattice reduction block size required to recover an equivalent private key. Although standard parameters HAWK-512 and HAWK-1024 remain unfeasible to break within practical timeframes under existing physical computing power, their security margin has been compromised. If parameters were enlarged to restore original security margins, HAWK would lose its lightweight and fast performance advantages; hence, the design team voluntarily chose to withdraw.

Demystifying the AES Möbius Bridge: Why Does It Not Affect Production AES?

Compared to the HAWK withdrawal in the post-quantum competition, the public is often more concerned about whether the active production encryption algorithm AES is impacted. Clarifying this concern requires distinguishing between academic testbeds and actual production environments. The AES algorithm encrypts iteratively through steps including byte substitution, shift rows, mix columns, and key addition; AES-128 deployed in production environments strictly executes 10 iteration rounds. In academic cryptanalysis, researchers typically use reduced-round variants as testbeds to evaluate the analytical power of novel mathematical tools. The Möbius Bridge attack proposed by Mythos specifically targets a reduced variant of AES-128 running only 7 rounds.

The mathematical intuition behind the Möbius Bridge is built upon the finite field algebraic structure of the S-box, AES’s core nonlinear component. Mathematically, the S-box is composed of finite field inversion combined with a fixed affine transformation. Traditional guessing attacks must try 256 possibilities individually for each candidate key byte. In the AES Möbius Bridge paper, Mythos utilized invariants of finite field inversion under specific transformations to design a special algebraic fingerprint. This fingerprint remains invariant as unknown key bytes change, enabling the filtration of a vast number of invalid guesses at once and reducing the number of attempts per byte from 256 to 1.

Even with this algebraic compression realized, the attack still requires obtaining $2^{105}$ chosen plaintexts. After balancing data, time, and memory consumption, the attack yields a 2.1–2.7 bits improvement in overall computational complexity, leaving the total complexity at approximately $2^{96.3}$, measured here in the table lookup units defined in the paper.

Cryptographers summarized in Matthew Green’s cryptography blog commentary that this is a modest constant-factor optimization within an academic scope. The current method covers only 7-round AES-128 and offers no attack extending to 10-round AES-128 in production environments. Production systems do not need to migrate or patch as a result of these findings.

Cognitive Shift: As Vulnerability Finding Becomes Cheaper, Verification and Remediation Become the New Bottleneck

Observing HAWK’s high-dimensional reduction alongside AES’s 7-round optimization paints a clear picture of Anthropic Mythos’s true capabilities in cryptography. Neither production AES-128 nor NIST-standardized post-quantum algorithms such as ML-KEM and ML-DSA are affected by these two results. The true significance of this event lies in a frontier AI model carrying out cutting-edge paper reading, mathematical construction, and automated code verification within human-built research frameworks; the results were subsequently confirmed by the HAWK team, precipitating the withdrawal of a standard candidate algorithm.

From the perspective of technical capability evolution, Mythos demonstrated the ability of general language models to engage in research-grade algebraic reasoning. Rather than remaining confined to pattern matching of known vulnerabilities, the model completed mathematical constructions that prior research had left open and wrote executable verification code. The HAWK team confirmed the attack’s impact on lattice reduction block size, and NIST subsequently updated the candidate status.

If this capability generalizes reliably, the resource bottlenecks of security engineering will shift accordingly. In the past, uncovering frontier algebraic flaws relied on scarce expert intuition; if models can generate executable attack hypotheses with high concurrency, the research community will face a denser stream of candidate results. In this context, rapidly verifying vulnerability authenticity, accurately assessing impacts on security margins, and executing disclosure and remediation will become far scarcer than simply generating more candidates.