Cryptographers around the world had been probing HAWK for weaknesses since it was submitted to America's post-quantum standardization process, and the algorithm had survived two full rounds of review without a single serious flaw surfacing. On July 28, 2026, Anthropic disclosed that an unreleased AI model had ended that streak in roughly 60 hours. The following day, HAWK's own creators withdrew it from consideration entirely.

HAWK was the last lattice-based candidate still standing in the third round of NIST's additional post-quantum digital signature process, a competition to select the cryptographic algorithms that will protect digital signatures once quantum computers become powerful enough to break today's standards. Its security rested on something called the Lattice Isomorphism Problem, essentially asking whether two mathematical structures that look different are secretly the same shape in disguise, a problem believed to be hard even for a quantum computer to solve. Anthropic's Claude Mythos Preview found a way through it that no human researcher had identified in years of dedicated study.

An Algorithm Two Years of Human Review Couldn't Crack

What Mythos actually discovered was a previously unknown mathematical symmetry, technically a nontrivial automorphism, buried in the lattice structure underpinning HAWK's security. That symmetry translated directly into a practical attack. For HAWK's smallest configuration, the cost of recovering a secret key dropped from 2^64 operations to 2^38, a reduction of roughly 67 million times less computational work required. In effect, the attack halves HAWK's security level, meaning the only way to restore its intended protection would be to double its key sizes, a change significant enough that Anthropic itself noted it would eliminate most of what made HAWK an attractive candidate in the first place.

Anthropic didn't rush the disclosure. The company privately notified HAWK's authors back in June, and the HAWK team helped independently verify the result before Anthropic coordinated a simultaneous public release alongside a notice to NIST's official mailing list on July 28. That's the kind of responsible disclosure process security researchers generally consider best practice, giving the affected team time to confirm the finding and prepare a response before it became public.

Why This Isn't a Reason to Panic About Your Data

It's worth being precise about what this attack does and doesn't affect, because the framing matters enormously here. HAWK was still a NIST candidate, not a finalized standard, meaning it was never deployed in any production system protecting real data. The three post-quantum standards NIST already finalized back in August 2024, known as ML-KEM, ML-DSA, and SLH-DSA, remain completely unaffected, since they rely on different underlying mathematical assumptions, specifically Module Learning With Errors and hash-based security, that the Mythos attack doesn't address at all.

Mythos also improved the best-known attack against a weakened, 7-round version of AES-128, the world's most widely used symmetric encryption standard, speeding up an attack technique that had stood unbroken since 2013 by a factor of 200 to 800 times. Even that result comes with a heavy asterisk: it targets only 7 of AES's full 10 rounds and requires 2^105 chosen plaintexts, a scale that makes it a research finding about theoretical security margins, not a practical threat to any system actually using AES today.

The Detail That Worries Cryptographers More Than the Break Itself

What's drawing the most attention from the cryptography community isn't really the specific break. It's how little specialized human expertise was needed to produce it. The researcher overseeing the project had a background in theoretical computer science generally, but wasn't an expert in lattice-based cryptography specifically. According to Anthropic's own account, that researcher's role was largely managerial, advising Mythos on how to organize its ideas and which software libraries to use for verifying its own results, rather than providing the deep domain expertise that's traditionally been assumed necessary to find this kind of flaw.

Matthew Green, a cryptography professor at Johns Hopkins University, offered a notable read on why that matters: Mythos didn't invent new mathematical theory to find the weakness. It combined existing, well-known cryptographic techniques in a way researchers simply hadn't thought to apply before. That's arguably more unsettling for the field than if the AI had discovered something entirely novel, since it suggests the raw tools needed to find this flaw were sitting in plain sight the whole time, waiting for something with enough patience and breadth to actually try the right combination.

A Second AI System Reached the Same Conclusion, Differently

The result also wasn't a one-off produced by a single lab's proprietary model. A separate research team independently attacked the same HAWK scheme using OpenAI's GPT-5.6, arriving at a working attack through an entirely different mathematical path, reducing the problem through what researchers described as adjoint lattice reduction on HAWK's underlying Gram factor problem. Two different AI systems, working independently through different mathematical routes, converging on the same conclusion that HAWK's design contained a genuine, exploitable weakness, makes it considerably harder to dismiss the finding as an artifact of one particular model's quirks.

What This Means for How Cryptography Gets Done Next

The total cost of developing the HAWK attack came to roughly $100,000 in API compute, according to Anthropic's own disclosure, a genuinely modest sum for a result that ended a standardization process two years of expert human review hadn't managed to derail. That price point is likely to shape how seriously the cryptography community now treats AI-assisted cryptanalysis going forward. Community members have already begun calling for formal standards to evaluate AI-generated cryptographic claims, comparable to existing frameworks used to vet claimed breakthroughs in pure mathematics, specifically to keep human reviewers from being overwhelmed as this kind of AI-assisted research becomes more routine.

For NIST's broader post-quantum standardization effort, HAWK's withdrawal narrows the field without derailing the overall process, since the finalized standards it protects remain untouched. But for the cryptography field more broadly, this episode marks a real inflection point: a class of algorithm that survived years of dedicated expert scrutiny fell to an AI system in under three days, guided by a human who wasn't even a specialist in the relevant subfield. Whatever comes after HAWK in NIST's process will very likely need to survive exactly this kind of scrutiny before anyone trusts it with real-world data.