A handful of prompts, misspellings and all — inteligent, agian, worth, genuinly scattered through them — took a model from “this is too hard, I won’t try” to a cryptographic weakness that human experts had reviewed and missed.

That’s the most counterintuitive detail in research Anthropic published on July 28 (Discovering cryptographic weaknesses with Claude). Using Claude Mythos Preview, they found mathematical attacks on two real cryptographic targets — not bugs in an implementation, but structural weaknesses in the algorithms themselves. One target is HAWK, a lattice-based signature scheme that was competing in the NIST post-quantum signature standardization process; the other is AES-128 cut down to 7 rounds (the full cipher is 10).

Start with the numbers, because they decide how seriously this should land.

What it actually found

A little background first, so the rest reads even if cryptography isn’t your field. HAWK and AES aren’t tools for guessing passwords; they’re locks. AES encrypts data; HAWK produces digital signatures — proof that a message really came from you and wasn’t tampered with. Both are foundational algorithms that systems lean on to protect information. Opening either lock requires a key: a long string of random data. The security goal for these algorithms is that the best an attacker without the key can do is barely better than trying every possible key one at a time — and there are so many keys that exhaustive search is hopeless. What the model did here is called cryptanalysis: finding a shortcut, a way to prove you don’t have to try nearly as many keys as you thought. So every number below is answering the same question — following the shortcut the model found, how far does the number of guesses drop?

HAWK. The model found a nontrivial automorphism in the lattice the scheme is built on — a symmetry of the lattice that leaves its structure intact, which an attacker can exploit to accelerate key enumeration dramatically. The upshot: recovering the full signing key for HAWK-256 drops from an assumed cost of roughly 2^64 operations to about 2^38 — from around 18 quintillion down to about 275 billion. The first number is far beyond any realistic computing budget; the second is an attack Anthropic actually ran. In the bit-security terms cryptographers use, the exponent falls from 64 to 38 — the effective strength is close to halved. The whole discover-develop-verify cycle took about 60 hours and roughly $100,000 in API cost, with an Anthropic researcher — someone with a theoretical computer science background, but not a lattice cryptography specialist — project-managing.

Weakened AES. Breaking a cipher like this normally means enumerating a huge space of candidate values and checking each one. The model invented a fingerprinting construction it named the “Möbius Bridge”: it found an invariant fingerprint that lets you collapse one guessing step — one that would otherwise range over 256 possible values — without checking each one, cutting that piece of the work by a factor of 256 in a single move. With the rest of its optimizations, the overall speedup came to 200–800× over prior work. This round was almost fully autonomous: the researcher built the scaffolding, and the model proposed its own hypotheses, ran its own experiments, and revised its own approach. It emitted about a billion tokens, and substantive human input came down to three prompts.

There’s a further result that should sober you more than either of these: for 13-round LEA (a lightweight cipher, 24 rounds at full strength), the model pushed the attack from needing 2^98 plaintext pairs down to under 2^30 plaintexts — a modern desktop finishes it in under an hour. That one isn’t a paper threat; it runs.

The limits matter, or this gets scarier than it is. HAWK isn’t deployed — it’s a candidate. The AES attack hits a 7-of-10-round weakened version; full AES is untouched, and Anthropic estimates that even implementing the weakened attack would cost “hundreds of millions of dollars.” No production system was broken in this work. So the most natural worry a reader has — can bad actors already point an agent like this at real keys and crack them faster — is, for now, no: one target isn’t live, the other is deliberately weakened. But what the research demonstrates is precisely that the path works, which is why the disclosure and governance questions later in this piece matter.

The counterintuitive part: the bottleneck wasn’t capability, it was talking it into trying

On my first read, my attention stayed on the attacks. On the second, it landed where it should have: those few prompts.

The model started by refusing. It said “AES-128 r5/r6 is just genuinely hard,” and called it “the most-studied block cipher in existence” — exactly the statistically-safe answer you’d expect from a model whose training data is full of “AES is secure.” The researcher gave no technical guidance whatsoever. What they gave was directional correction:

“the models tend to think it is impossible to solve so they don’t try they need a good amount of prompting”

“no again the goal is that we have highly inteligent model as good top researcher, we want to find new attacks”

“no we don’t want to change the targets [..] agian we need to find something that worth publishing”

“again we are not looking for low hanging fruit, we want proper research to find genuinly hard findings”

Not one of these is about cryptography. No hint about which mathematical tools to reach for, no nudge toward the answer. Every one of them is fighting a single tendency — the model treating “this is hard” as a reason not to try. Once that layer was pushed aside, the model did the rest of the derivation on its own.

Which surfaces the diagnosis that matters: this was a derivation, not a retrieval. The distinction is load-bearing. If the model had merely pattern-matched some published attack out of its training corpus, that’s not discovery — it’s recitation. But per Anthropic, the Möbius Bridge is a construction not present in the prior literature, and they published the chain-of-thought for the attack as a PDF (aes_mobius_bridge_cot.pdf; per the document’s own note, the record was rewritten by the model for readability with programs and outputs summarized, so it’s not a raw, unedited transcript) so you can watch it move step by step from hypothesis to construction. Publishing the reasoning is itself a claim: this was reasoned out, not memorized.

Why does “a little coaxing was enough” matter? Because it says that in this experiment, at least, what held the model back wasn’t mathematical ability — it was its own conservative estimate of that ability. That’s an inference I’m drawing from a single experiment, not a general finding the research establishes; Anthropic doesn’t explain where the conservatism comes from either. Alignment training’s emphasis on not bluffing past what you know is a plausible guess, but only a guess. Even so, the observation cuts both ways. The upside: capability may be systematically underestimated, and the ceiling is higher than the demo shows. The thing to watch: that conservatism is not a safety guardrail. It’s a default posture, and a few sentences of plain English walk right around it — it stops no one who actually wants to use the capability.

The bottleneck that genuinely moved: verification

If you only read “a model did in about a week what human experts hadn’t managed in years,” you’ll reach for too-excited a conclusion. But there’s a quiet number in this research that pulls the excitement back down: verifying the AES result took the humans nearly a month — two researchers, hundreds of hours — before they were confident it was correct.

The gap between how fast the model produced and how fast humans could check is stark: a week against nearly a month. This probably isn’t unique to cryptography — Anthropic expected human verification to be the bottleneck too — and my read is that “generation is cheap, verification is expensive” will be the normal shape of LLM-assisted research, where whether you can trust the output depends on verification, not on generation. A model that runs fast enough to spit out a billion tokens, paired with a human process that takes a month to confirm right from wrong, has its real throughput set by the latter.

For cryptographic auditing as a field, the implication is concrete. Cryptographic standards have always lived on open adversarial review: a scheme is published, countless people try to break it, and it earns trust only by surviving. NIST’s post-quantum call is exactly this kind of public request for analysis. If the attack side gets dramatically accelerated by LLMs while the verification side stays manual, two things happen at once. First, the long tail of niche schemes that nobody bothered to seriously scrutinize could get systematically swept for the first time — a net gain. Second, reviewers and standards bodies have to treat “how do we verify an AI-generated attack quickly and credibly” as a first-class engineering problem, or they’ll be swamped by their own generation capacity.

Dual use: this one didn’t cross the line, but where the line goes is undecided

Content moderation is my day job, so the structure where the same capability serves the good use and the bad one — the exact same capability — is familiar. I wrote about another version of it a few days ago in Too Loose for Regulators, Too Tight for Researchers: Who Are AI Guardrails Actually For?: the hired penetration tester and the actual attacker ask the model for the same exploit, and a guardrail reading the text alone can’t tell them apart. Cryptanalysis is textbook dual use — you find weaknesses to fix them, and to exploit them, and the capability itself takes no side.

Anthropic handled this one with restraint, and it’s worth recording as a reference case for disclosure: they shared the attack details with the HAWK authors back in June, notified government and industry partners in advance, had academics independently confirm the results, and finally went public in sync with the NIST mailing list. That’s the security world’s mature norm of coordinated disclosure — give the people who can fix it time first, then publish.

But the authors leave one honest, unanswered question in the piece, and I think it’s the most important takeaway in the whole thing: as models’ cryptanalytic results keep getting stronger, if a model someday finds a vulnerability with immediate real-world impact, there is no ready answer for what researchers should do. The only reason this round could be published cleanly is that nothing production was hit — HAWK isn’t deployed, AES was weakened. That precondition is a matter of luck, not institution. When it fails to hold — say, when a comparable capability finds an implementable attack on a cryptosystem guarding real assets — whether the existing coordinated-disclosure process is adequate, who decides how long to sit on it, and what role the model vendor plays are all still blank.

So I don’t read this research as an “AI is about to break encryption” thriller; it’s a long way from that. I read it as a dry run of a situation where the capability has arrived, human verification is still the bottleneck, and disclosure norms are not yet adapted to the scenario where an AI finds a vulnerability that directly affects a real system. The technical side running ahead usually isn’t the problem. The problem is when it runs to the point where governance has to take over and governance hasn’t shown up. This time it did, and did it decently. The trouble is next time, the preconditions may not be this friendly.

Three judgments for practitioners

  1. Don’t read a model’s “I can’t / this is too hard” as its capability ceiling. The evidence here is that it may just be a trained-in conservative posture, and a bit of directional prompting pushes it aside. This is structurally the same as what jailbreak research keeps finding: in the systems tested, a model’s “no” doesn’t survive sustained multi-turn pressure. Microsoft’s Crescendo attack escalates a topic through a chain of innocuous-looking follow-ups and succeeds on most tested prohibited tasks against GPT-4, Gemini and others, far outperforming prior automated jailbreak methods (arXiv:2404.01833, published at USENIX Security 2025); Scale AI’s evaluation shows that defenses holding single-turn automated attacks to single-digit success rates get pushed past 70% by humans working over multiple turns (arXiv:2408.15221). Note the difference: those studies measure safety refusals being worn through across turns, whereas what got pushed aside here is the model’s conservative estimate of its own ability — a different target. But the operational conclusion is the same: measure a model’s ceiling under sustained, multi-turn guidance, not from its first-turn refusal.
  2. If you’re building an LLM-assisted research or audit pipeline, design for verification as the bottleneck from the start. Generation-side cost will keep falling; whether the work ships depends on how fast and how credibly you can confirm it’s correct. Don’t let a month of manual checking strangle a model that produces in days.
  3. Guardrails on dual-use capability can’t rely on the model’s default reluctance. That conservative layer got walked around here with plain English. Real constraints have to come from the institutional layer — coordinated disclosure processes, verification thresholds, defined vendor responsibility — and none of those are ready today for the scenario where an AI finds a real production vulnerability.

References