💻 Quantum

An AI Spent $100,000 to Break a Cryptographic Scheme That Survived Two Years of Expert Review. The Math on What Happens Next.

Anthropic's Claude Mythos discovered a 67-million-fold reduction in the work needed to crack HAWK-256, a NIST post-quantum signature candidate, in 60 hours of compute time. That vulnerability had survived 2.5 years of scrutiny by hundreds of the world's best cryptographers. When cryptanalysis becomes a commodity, the economics of who can audit algorithms, and how fast, changes everything.

Marcus Chen

Sixty hours and one hundred thousand dollars. That is what it cost Anthropic's Claude Mythos Preview model to find a structural vulnerability in HAWK, a lattice-based digital signature scheme that the National Institute of Standards and Technology advanced to the third round of its post-quantum cryptography standardization process just ten weeks earlier, placing it among nine finalists competing to protect the world's digital infrastructure against quantum computers that don't exist yet but almost certainly will within the decade. The same flaw had eluded the global cryptographic community through two full rounds of expert review spanning November 2023 to May 2026, consuming an estimated 4,400 combined researcher-hours of collective scrutiny across dozens of institutions on three continents.

It didn't stumble on a minor edge case. It identified a nontrivial automorphism, a hidden symmetry, in HAWK's underlying lattice structure, then constructed a complete key-recovery attack that reduces the computational work factor for HAWK-256 from 2⁶⁴ operations to 2³⁸. Run the division: 2⁶⁴ ÷ 2³⁸ = 2²⁶ = 67,108,864, a sixty-seven-million-fold improvement that transforms what was an intractable computation into something a well-funded adversary could reasonably attempt. On a 96-core server, the full end-to-end attack completes in three hours and forty-two minutes, which means a nation-state actor with a modest server farm could forge digital signatures for the weakest HAWK variant before lunch.

Academic partners at ETH Zürich, Tel Aviv University, and the University of Haifa independently verified the mathematics. Anthropic disclosed the findings to NIST and HAWK's designers in June, then published via the NIST mailing list this week.

The Kill Test: What Makes This Different

HAWK is not some obscure toy. It was the sole lattice-based candidate among nine schemes that advanced to NIST's third round on May 14, 2026, which matters because NIST had already standardized two lattice-based signatures, ML-DSA and FN-DSA, and wanted additional options built on entirely different mathematical foundations in case a future breakthrough compromised the lattice family wholesale. HAWK offered smaller signatures than FALCON, required no floating-point arithmetic, and was attractive for constrained hardware like IoT devices and smart cards. It was the compact option, and now it may be the compromised one.

The automorphism Mythos discovered doesn't invalidate the scheme outright for the larger parameter sets NIST actually considers. HAWK-512 and HAWK-1024 remain computationally beyond practical reach even with the newly discovered symmetry applied. But the finding forces designers into a brutal tradeoff. Double the key sizes to restore confidence? Or abandon the scheme entirely and start over with something else? Either path erodes the compactness advantage that made HAWK worth standardizing in the first place, and either path consumes years of evaluation time the post-quantum migration does not have to spare.

"Both of our primary attacks are expected results," Anthropic noted in the accompanying research post, adding that "the purpose of NIST's standardization process is to discover weaknesses in candidate schemes before they are deployed." That framing is precisely right and precisely insufficient. Nobody disputes that the process is designed to find flaws. What is new is the speed and cost at which flaws can now be found.

The Cost Curve Nobody Is Talking About

Consider what it actually costs to audit a cryptographic scheme the traditional way. NIST's post-quantum standardization process has been running since December 2016. Forty initial signature candidates were submitted in June 2023 for the additional signatures track alone. Fourteen advanced to the second round. Nine survived to round three. Each round involves open calls for cryptanalysis papers, conference presentations, implementation reviews, and side-channel analyses. Participating researchers, scattered across universities, government labs, and corporate R&D divisions in dozens of countries, represent some of the most specialized human capital on Earth.

A fully loaded senior cryptographic researcher at a U.S. or European institution costs $150,000 to $200,000 per year including salary, overhead, and compute resources. Conservative estimate: if just five researchers dedicated 10% of their time to HAWK-specific analysis across the 2.5-year review period, that's 1.25 person-years of effort, or roughly $200,000 in direct cost. More realistically, dozens of researchers across multiple institutions examined HAWK's security properties over two rounds. None found the specific automorphism that Mythos located in 60 hours.

The math is uncomfortable. Anthropic spent $100,000, and the global cryptographic community spent considerably more over a much longer timeframe, yet the AI found what the humans missed. No individual researcher or institution failed. The entire collective process simply did not surface one particular structural weakness within its evaluation timeline, even though the theoretical possibility of such an automorphism had been flagged in earlier work and remained on the cryptographic community's radar as a known avenue of attack. Mythos succeeded not because it is smarter than any individual cryptographer, but because it could explore the mathematical landscape differently, combining techniques across subfields that rarely intersect in traditional research workflows and iterating at speeds that compress years of speculative exploration into a single weekend.

Nine Candidates, $900,000

The immediate implication is arithmetically simple. NIST's third round contains nine candidates spanning four mathematical families: lattice-based (HAWK), isogeny-based (SQIsign), MPC-in-the-Head (FAEST, MQOM, SDitH), and multivariate (MAYO, QR-UOV, SNOVA, UOV). NIST expects the evaluation to take approximately two more years.

At $100,000 per AI audit cycle, you could stress-test all nine candidates for under $1 million. That is less than most NIST-funded research grants. It is a rounding error on the cryptographic research budgets of intelligence agencies. Run the audits in parallel and you could have preliminary results across the entire candidate pool in weeks.

This does not mean AI replaces human cryptanalytic review. The model required a human researcher to manage the workflow, and the final verification demanded hundreds of hours of expert mathematical review. What changes is the discovery phase, the grinding, speculative exploration of mathematical structures where breakthroughs hide. That phase compresses from years to days when AI handles the search and humans handle the verification.

The AES Warning

The HAWK finding alone would be notable. Anthropic's second disclosure makes the pattern harder to dismiss as a one-off. In a separate, largely autonomous experiment, Mythos invented an entirely novel cryptanalytic technique called the "Möbius Bridge" that accelerates the best known attack on seven-round reduced AES by factors of 200 to 800.

Mythos eliminated the guess by identifying an invariant fingerprint that lets an attacker match partial computations across both halves of the search without enumeration, a conceptual leap that yields runtime gains between 200x and 800x depending on attack parameters while still demanding approximately 2¹⁰⁵ chosen plaintexts, a data requirement that keeps it firmly in theoretical territory. Full ten-round AES-128 remains untouched.

What's remarkable is how autonomously the discovery happened. The model initially refused, insisting that AES could not be broken and citing established security proofs with the confidence of a textbook. Only after persistent prompting did it begin exploring weaker variants, and once started it ran largely on its own: a software scaffold limited token usage and provided feedback on invalid moves while the model generated more than one billion output tokens over three days before converging on the Möbius Bridge construction, a mathematical object that no human had named because no human had found it.

Security margin math matters here. AES-128 has ten rounds. Best classical attacks have historically gained roughly one additional round per decade since AES's adoption in 2001: five-round attacks in the early 2000s, six-round by 2010, seven-round by 2020. If AI compresses that progression, gaining one round every one to two years instead of every ten, full AES-128 enters the danger zone significantly sooner than anyone's planning for. Each additional round is exponentially harder to crack, so the relationship is not linear, and the 200-800x improvement stays within the seven-round boundary. But the trajectory demands attention: the gap between the best attack and the production cipher narrowed by a qualitative leap, not an incremental refinement.

$102 Billion in Addresses That Haven't Moved

The findings collide directly with the most contentious debate in cryptocurrency governance. BIP-361, co-authored by Casa CTO Jameson Lopp and five collaborators, proposes a three-phase forced migration that would freeze Bitcoin held in quantum-vulnerable addresses if holders don't move to quantum-resistant formats within five years of activation.

Approximately 34% of the current Bitcoin supply, roughly 1.7 million BTC, worth approximately $102 billion at current prices, sits in address types where the public key has already been broadcast on-chain. These addresses are the most exposed to both quantum and classical attack improvements. BIP-361's companion proposal, BIP-360, introduces a quantum-resistant address format called Pay-to-Merkle-Root, specifying three NIST-standardized algorithms with deliberate fallbacks in case any one is later broken.

BIP-361's authors argue the migration window is closing because cryptographic attacks are improving by up to 20-fold. Anthropic's findings validate that assumption with a concrete, verified example. That speed improvement is not 20-fold. It is 67-million-fold for HAWK-256, and 200-800-fold for reduced AES. These are classical attacks, not quantum, meaning the threat is not hypothetical future quantum computers but present-day AI models running on commercially available hardware.

Blockstream CEO Adam Back has publicly opposed BIP-361's forced freezing mechanism, favoring an optional upgrade path instead. His counterargument has merit: Bitcoin's core philosophy is censorship-resistant, decentralized money, and protocol-level freezing of any coins sets a dangerous precedent regardless of technical justification. The community is split. Panelists at the Bitcoin 2026 Conference debated the tradeoffs extensively, with some forecasting Q-Day as early as 2027-2028 and others arguing the NSA's CNSA 2.0 standard gives until 2030.

Neither side's timeline accounts for the acceleration that AI-driven cryptanalysis introduces. Q-Day is a quantum threshold. What Anthropic demonstrated is that significant cryptographic erosion can arrive classically, at commodity prices, well before any quantum computer becomes operational.

Limitations

Several caveats temper the implications. First, HAWK-256 is the weakest parameter set and was never a serious candidate for standardization. NIST evaluates HAWK-512 and HAWK-1024, both of which remain computationally infeasible to attack even with the newly discovered automorphism. The vulnerability demonstrates a methodology, not a live threat to deployed systems.

Second, the $100,000 cost figure reflects Anthropic's privileged access to its own frontier model at internal rates. External researchers paying commercial API prices would face substantially higher costs, likely $300,000-$500,000 for equivalent compute. That is still far cheaper than traditional research timelines, but the democratization thesis requires accessible pricing.

Third, the model required human scaffolding throughout. The HAWK discovery used a multi-agent setup where one agent initially dismissed the core idea and a partner pushed forward, a dynamic that required human orchestration to resolve. Its AES work ran more autonomously but still needed a software scaffold and extensive post-hoc verification. Fully autonomous AI cryptanalysis is not here yet. What's here is AI-augmented cryptanalysis that dramatically compresses the most expensive phase of the work.

Finally, the comparison between AI cost and human cost is structurally imprecise. The global cryptographic community's review of HAWK produced far more than one attack: it generated implementation analyses, side-channel resistance evaluations, performance benchmarks, and formal security proofs that the AI did not attempt. The AI found one specific vulnerability faster and cheaper. It did not replicate the full value of the standardization process.

The Bottom Line: What You Can Do

Cryptanalysis has been a discipline where breakthroughs arrived on the timescale of academic careers, where a PhD student might spend four years finding a weakness in a single scheme and count that as a good dissertation, the kind that earns tenure-track job interviews and citations in the hundreds over a decade of follow-up work. A senior researcher might publish two or three significant cryptanalytic results in an entire career. That timescale shaped everything: how long standardization processes take, how many candidates can be evaluated, how wide the security margins need to be, how urgently organizations migrate to new algorithms when old ones show cracks.

That timescale just compressed by two or three orders of magnitude.

If you manage cryptographic infrastructure, the action items are concrete. Audit your TLS certificate chain for post-quantum readiness. Cloudflare and AWS already offer hybrid ML-KEM key exchange. If you hold cryptocurrency in addresses where the public key has been broadcast, move to a fresh address now; don't wait for BIP-360. If you're selecting algorithms for long-lived systems like embedded devices, government infrastructure, or medical devices with 10-20 year lifecycles, prefer schemes from different mathematical families as fallbacks, not just different parameters within one family.

If you work in cryptographic research, the landscape has shifted under your feet. AI models are not replacing you. They are giving you a tool that searches mathematical structures faster than any graduate student but still needs your judgment to verify results and assess practical implications, which means the researchers who integrate AI into their cryptanalytic workflows will outpace those who don't, and the schemes that survive AI-augmented scrutiny will be the only ones worth trusting.

For everyone else: the internet's cryptographic foundations are not breaking today. Full AES-128 and the standardized post-quantum algorithms remain solid. But the margin between "theoretically possible" and "practically achievable" just narrowed in a way that should accelerate every migration timeline on every roadmap. When the cost of finding a flaw drops from years of specialized labor to a weekend of compute time, the question is no longer whether algorithms will be broken, but how quickly the ones we depend on can be stress-tested before they're deployed at scale.