The internet is in the middle of swapping out its math. Large quantum computers, if they arrive, would break most of the cryptography now protecting banking, software updates and encrypted traffic, so the US National Institute of Standards and Technology has spent close to a decade running open contests to pick replacements.
One of those contests is still live. On May 14, NIST advanced nine algorithms to a third round of review for new digital signature schemes. A digital signature is the math that proves a message, a payment or a software update really came from the sender it claims to come from. The teams behind the nine survivors have until August 14 to file final changes to their designs.
That deadline is why Tuesday's announcement lands differently from the usual AI research press release.
On July 28, Anthropic published two papers claiming that Claude Mythos Preview, a frontier model the company does not sell publicly, found new mathematical attacks on two cryptographic algorithms. One of them is HAWK, and HAWK is one of the nine.
The distinction the company is drawing is the whole story. Claude's security work until now has surfaced implementation bugs, meaning mistakes programmers made while translating an algorithm into working code. Thousands of those have been found across major software, including in cryptographic libraries. They are the equivalent of a sound lock installed crooked. What Anthropic is claiming this time is that Claude "is able to find mathematical flaws in the algorithms themselves." The lock design is wrong, and careful installation does not help.
What HAWK is, and what the attack does
HAWK is the only remaining candidate built on lattices, a branch of geometry involving grids of points in hundreds of dimensions. Its appeal was practical. Signatures run 555 bytes at the lowest security level, smaller than the standards NIST has already approved, and the design avoids the fiddly decimal arithmetic that makes rival schemes easy to code incorrectly.
The attack works by locating a symmetry hidden in HAWK's lattice. Academic work published last year had proved that such a symmetry, if one existed, would cut the key-recovery problem roughly in half. Nobody had found one. The model did.
For HAWK-256, a deliberately undersized configuration that HAWK's own designers publish as a target for attackers, the cost of stealing a secret key falls from about 18 quintillion operations to about 275 billion. Anthropic released code that recovers such a key end to end in under four hours on a single 96-core server.
The two configurations NIST actually evaluates, HAWK-512 and HAWK-1024, are not broken. Their estimated attack costs drop as well, but both remain far beyond anything buildable. Restoring the original security margin would mean doubling key sizes, which would also erase most of what made HAWK worth choosing.
What the result does not show
The claim that a model did the work is doing a lot of load-bearing here. Anthropic's own wording is "mostly autonomously," and the model was pointed at a scheme that prior research had already flagged as possibly vulnerable to exactly this kind of symmetry. One of the authors of that prior paper is also a designer of HAWK.
Verification remains a human job, and an expensive one. Anthropic put the compute bill at roughly $100,000 per result, and 60 hours for HAWK. Its researchers then spent several hundred hours confirming the second result, with two of them taking nearly a month to reach confidence.
Outside checking has begun but is thin. Anthropic posted the attack to NIST's public mailing list, where the cryptographer Daniel Apon replied that the math checked out independently for him. Beyond that, The Hacker News reported finding no independent reproduction of the key recovery, and NIST has not said whether HAWK's standing changes.
The second finding is weaker than its headline suggests. It speeds up an attack on AES, the cipher protecting most encrypted traffic, by 200 to 800 times. But it targets a stripped-down seven-round research version rather than the full ten-round cipher, and it assumes an attacker can obtain roughly 400 octillion messages encrypted under the same key. Anthropic did not run the full attack. It measured components and projected the rest.
Anthropic also disclosed that the model initially refused the AES problem, insisting the target was too well studied to improve on. Researchers published their own typo-ridden prompts pushing it to continue.
The competitive backdrop makes this less of an outlier than it looks. Google has run Gemini at open problems from the Erdős collection, and Anthropic said this month that a public model resolved the Jacobian Conjecture. Cryptography is simply the domain where a claimed result can be checked by running code.
Mythos Preview is not purchasable. It reaches organizations through Project Glasswing, Anthropic's closed security program.
For anyone tracking this as an investment thesis rather than a math story, the number that matters is not 67 million. It is $100,000, and whether it keeps falling.