Mythos Rewrites HAWK and Seven-Round AES Attack Costs

On July 30, 2026 (Beijing time), Ars Technica followed up on two cryptanalysis studies published by Anthropic: Claude Mythos Preview helped find a faster key recovery path for the post-quantum digital signature candidate HAWK and improved existing attacks on seven-round AES-128. Both results are within the realm of research environment cryptanalysis; HAWK has not been deployed, and the AES result only covers seven out of ten rounds. Anthropic clearly states that current production software does not need to change.

NIST Candidate Status and Attack Entry

HAWK's official status remains a candidate. The National Institute of Standards and Technology (NIST) advanced it along with eight other algorithms into the third round of additional digital signature standardization processes on May 14, expecting this phase to last about two years. NIST valued HAWK for its smaller signature size and integer-only implementation characteristics while requesting further analysis of its security assumptions in specific cyclotomic number fields. The third round allows candidate teams to update specifications and implementations but does not equate to final security approval. The current NIST page still lists HAWK without announcing removal, rejection, or final standardization decisions.

Anthropic's paper describes the attack entry as non-trivial automorphisms in the lattice structure used by HAWK. Researchers leveraged this symmetry to construct a lower-rank public lattice from the public key and reduced HAWK-n key recovery to polynomially many calls to an exact shortest vector problem oracle of dimension n/2 + 1. The paper also specifies that this construction does not transfer to Falcon, nor does it make attacks on larger parameters feasible in polynomial time; it remains a faster but exponentially growing with parameter size key recovery path.

Parameter Costs and Seven-Round AES Scope

Anthropic states that the HAWK attack took about 60 hours from discovery, development to validation, estimating API costs at around $100,000. The official research page revised the full key recovery cost for small HAWK-256 parameters from a previous estimate of 2^64 to 2^38; technical papers report that a single server can complete this parameter set's end-to-end recovery in just hours. For HAWK-512 and HAWK-1024, the gate counts were reduced from 2^150 to 2^108 and from 2^288 to 2^182 respectively; these numbers cannot be interchanged.

The other work targets a modified seven-round AES-128, not the current full ten-round AES-128. The paper uses a chosen plaintext threat model, assuming attackers can encrypt arbitrary inputs under an unknown key and obtain outputs, requiring 2^105 chosen plaintexts. This setup is used to compare academic attack costs and does not imply that attackers have real-world query capabilities. This premise far exceeds practical operational ranges; the research did not involve production service keys, traffic, or software implementation vulnerabilities, so it cannot be interpreted as AES being compromised.

Möbius Bridge and Human-Machine Division

Mythos proposed an algebraic fingerprint method called Möbius Bridge to eliminate one of the nine guessed key bytes in existing seven-round attacks, directly reducing guess counts by 256 times. Calculating this transformation itself adds overhead; thus, the paper combined multiple implementation optimizations. Depending on different workload metrics, the final attack is about 200 to 800 times faster than previous methods with a work factor of 2^99, placing total work between 2^89.3 and 2^91.4, with data complexity still at 2^105, not running end-to-end on full scale.

The human-machine division for the two discoveries was different. The HAWK project progressed semi-autonomously in a multi-agent sandbox using Python, Sage, and public papers; humans mainly provided project management and non-technical direction. For AES, researchers set up scaffolding for nearly autonomous search, generating hundreds of millions of tokens within three days, accumulating over one billion tokens by the time the method was perfected. Anthropic states that researchers spent several hundred hours learning and verifying the AES argumentation, with two people taking almost a month to build confidence in the conclusions.

Media Reporting and Pending Confirmations

One source statement needs retention. Ars Technica's public entry title describes HAWK as having withdrawn from competition due to this attack; Anthropic’s official stance is that doubling key sizes to maintain original security levels would significantly reduce HAWK's attractiveness, while NIST's public page still lists it among third-round candidates. The former is media summary, the latter is the current official status, both are now separately attributed here. Anthropic also stated that the team disclosed the attack to HAWK authors in June and coordinated disclosure through NIST’s public mailing list when releasing results; however, there are no formal follow-up decisions from either the HAWK team or NIST.

What can be confirmed is that security estimates for candidate schemes have been downgraded, and theoretical running times of existing seven-round AES attacks have been reduced, but no deployed cryptographic systems have been breached. Public materials do not provide revised parameters for HAWK, NIST's decision on its future, formal responses from the HAWK submission team, or independent reproductions of full AES paper analyses by third parties. Subsequent reporting can only adjust conclusions based on new standard documents, candidate scheme updates, or independent technical validations and cannot treat media headlines as the end of a standard process.