Claude's two new cryptographic results are important for different reasons. The HAWK result produced an end-to-end key-recovery demonstration, was confirmed by the scheme's team, and contributed to HAWK's withdrawal from NIST's additional-signature process. The AES result improves an attack on a seven-round research variant, but the full attack is too expensive to run and has a narrower verification record.
That difference matters more than the headline that an AI found cryptographic weaknesses. AI-assisted discovery needs an evidence ladder. A model-generated idea is a candidate. Executable artifacts, independent review, affected-party confirmation, and institutional action progressively support stronger claims.
What Claude actually found
Anthropic published both results on July 28, 2026. The company says Claude Mythos Preview worked mostly autonomously, using agent harnesses that could read literature, run Python and Sage experiments, and preserve intermediate work.
The findings target two very different objects.
HAWK: a practical demonstration against a candidate signature scheme
HAWK was a lattice-based digital-signature candidate in the third round of NIST's process for additional post-quantum signatures. The HAWK paper reduces key recovery to exact Shortest Vector Problem calls in dimension n/2 + 1. Its reported concrete estimates lower the HAWK-512 key-recovery cost from 2^150 to 2^108, and HAWK-1024 from 2^288 to 2^182.
Those remain enormous costs for the larger parameter sets. The result is still consequential because HAWK's value proposition depended on compact, efficient parameters. The researchers also supplied an open research artifact that recovers a HAWK-256 challenge secret key end to end in a few hours on one server.
The strongest evidence arrived outside Anthropic. On July 29, the HAWK team confirmed on the NIST PQC Forum that the attack approximately halves the lattice-reduction block size needed to recover an equivalent secret key. It concluded that straightforward parameter increases would make HAWK uncompetitive and withdrew the candidate. NIST's Round 3 page now records that withdrawal.
This attack does not transfer to Falcon, ML-DSA, or lattice cryptography in general. HAWK was a candidate rather than a deployed standard. No production system needs an emergency migration because of this result.
AES: a stronger paper claim with a weaker end-to-end check
AES-128 uses ten rounds. Claude's second result concerns a deliberately weakened seven-round variant that cryptanalysts study to understand security margins. It does not break full AES.
The Möbius Bridge paper improves a 2013 meet-in-the-middle attack. It removes one guessed key byte and reduces the estimated time from about 2^99 operations to between 2^89.3 and 2^91.4, while retaining the requirement for 2^105 chosen plaintexts. Depending on the accounting method, this is roughly a 200 to 800 times speedup.
The authors prove key-invariance properties, formalize in Lean a counting bound used in the rejection analysis, exhaustively test smaller instances, run the complete attack on a toy cipher, and benchmark components used in the complexity estimate. Those are meaningful checks. The full target attack still cannot be executed end to end; truncated-table false positives and the wrong-key-randomization model retain empirical assumptions.
Cryptographer Matthew Green therefore draws a sharp distinction: the HAWK artifact is easy to test directly, while the AES result remains an on-paper speedup whose complete real-world runtime cannot be measured. That does not invalidate the AES work. It places it on a different evidence tier.
A five-level verification ladder
The two results make a practical verification model visible.
| Level | Evidence | What it supports | Current example |
|---|---|---|---|
| 1. Candidate | Model transcript, hypothesis, draft derivation | The idea deserves investigation | Claude's initial attack concepts |
| 2. Reproducible artifact | Code, fixed inputs, test vectors, small certificates | Named components work under stated conditions | Public HAWK, AES, and LEA artifacts |
| 3. Structured verification | Proofs, formal checks, exhaustive small cases, component benchmarks | The claimed mechanism has survived targeted checks | AES invariance checks and toy-cipher run |
| 4. Outside confirmation | External expert reproduction or affected-team confirmation | Confidence is no longer confined to the originating lab | HAWK team's public confirmation |
| 5. Institutional consequence | Standard status, patch, erratum, or policy change | The evidence changed the governed system | HAWK withdrawn and NIST page updated |
These levels are cumulative in spirit, but they are not a single linear score. A machine-checked proof can be powerful while proving the wrong formal statement. An end-to-end demo can establish exploitability for one parameter set without proving a general theorem. An institutional response can be conservative and does not replace technical review.
The rule is simpler: report the evidence type, then make only the claim that evidence can carry.
Why a runnable artifact changes the review economics
The HAWK result is easier to trust because its central failure can be witnessed. A reviewer can choose a challenge instance, run the recovery code, and verify that the recovered key behaves correctly. The experiment compresses a long mathematical argument into a relatively cheap falsification interface.
The AES claim has a different shape. Its full attack requires resources that cannot be assembled for a validation run. Reviewers must audit reductions, cost models, formal statements, smaller experiments, and whether the measured components compose as claimed. Each layer helps, but none produces the same single decisive witness.
This is the same design problem discussed in the dual-loop protocol for mathematical agents: exploration can remain broad and non-deterministic, while reusable knowledge needs a fixed admission gate. The bottleneck moves from generating plausible ideas to building affordable ways to reject wrong ones.
A production workflow for AI-assisted science
Teams using agents for research can turn the ladder into an operating contract.
1. Freeze the claim
Write the target, assumptions, threat model, parameter set, baseline, and success criterion before the search begins. A result against seven-round AES must never drift into a claim about production AES. A challenge-instance recovery must state which production parameters it does and does not represent.
2. Separate discovery from verification
The discovery harness should optimize for breadth: literature search, hypothesis generation, computation, and adversarial exploration. A fresh verification path should optimize for failure detection. It receives frozen claims and artifacts rather than the originating agent's confidence.
3. Require a compact verification interface
Prefer test vectors, deterministic scripts, proof-assistant files, minimal counterexamples, and measured component benchmarks. Preserve tool versions, commits, random seeds, hardware details, and exact inputs. A paper is easier to audit when each important claim points to a smaller executable object.
4. Add outside reviewers before strong attribution
Same-lab review catches many errors, but it shares incentives and assumptions. Domain experts, scheme authors, standards bodies, and independent implementations provide different failure detectors. Anthropic's HAWK result crossed this boundary. The public AES record, as of August 10, 2026, has less independent confirmation.
5. Publish an evidence label with the headline
Useful labels include candidate, component-verified, end-to-end demonstrated, independently confirmed, and institutionally acted upon. They make updates cheap. When a new reproduction or refutation appears, the result can move tiers without rewriting its history.
What this changes about scientific throughput
Anthropic reports roughly 60 hours and about $100,000 in API cost for the HAWK discovery process. The AES effort generated about one billion output tokens; the model found the central idea in days, while human researchers spent hundreds of hours building confidence in it. These are vendor-reported figures, but the imbalance is the important part.
Generation is becoming abundant faster than expert verification. The scarce resource is moving toward reviewers who can understand the formal target, inspect the artifact, and identify a decisive counterexample. Research systems that add inference without adding verification interfaces will produce review debt.
The earlier OpenAI unit-distance case showed a similar pattern in mathematics. The contribution was not merely an AI-generated answer. It was an answer that entered a human verification process. Cryptanalysis raises the stakes because some future results may affect deployed systems and require coordinated disclosure before public reproduction.
FAQ
Did Claude break AES?
No. The published result improves an attack on seven-round AES-128. Production AES-128 uses ten rounds, and the attack also requires impractical data and computation.
Did Claude break HAWK?
It found an attack that substantially weakens HAWK's proposed parameters and undermines its competitiveness. The HAWK team confirmed the result and withdrew the candidate from NIST's process. HAWK was not a deployed standard.
Was the cryptographic research fully autonomous?
Anthropic describes the HAWK work as semi-autonomous with project-management guidance, and the AES discovery as almost fully autonomous after researchers built and steered the harness. Humans selected targets, supplied infrastructure, validated claims, wrote papers, and coordinated disclosure.
Is a Lean proof enough to verify AI-generated research?
A proof assistant verifies a formal statement under declared assumptions. Reviewers must still confirm that the statement matches the intended cryptographic claim, that the cost model is faithful, and that implementation details preserve the proven properties.
What is the strongest evidence that the HAWK result is real?
The evidence combines executable recovery code, a public outside mathematical check, explicit confirmation by the HAWK team, the team's withdrawal, and NIST's updated candidate page. The public record does not document a full independent rerun of the entire HAWK-256 implementation.
References
- Anthropic, Discovering cryptographic weaknesses with Claude, July 28, 2026.
- Zygimantas Straznickas and Stephen A. Weis, HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1, 2026.
- Milad Nasr and Nicholas Carlini, Cryptanalysis of 7-Round AES via the Algebraic Structure of its S-box, 2026.
- Anthropic, Cryptography Research Demo, 2026.
- NIST PQC Forum, HAWK-n Key Recovery discussion and withdrawal, July 28 to 29, 2026.
- NIST CSRC, Round 3 Additional Digital Signature Schemes, accessed August 10, 2026.
- Matthew Green, Some thoughts about Anthropic's new cryptanalysis results, July 29, 2026.
- Jonas Geiping et al., CryptanalysisBench: Can LLMs do Cryptanalysis?, 2026.