An AI Cracked a Quantum-Proof Encryption Standard in 60 Hours. NIST Withdrew It the Next Day.

Every encrypted message you send — every bank transaction, every login, every private file, every government communication — is protected by mathematics. Specifically, it is protected by mathematical problems that are easy to verify but extraordinarily hard to solve. The security of the internet rests on the assumption that these problems are hard enough that no computer, running for long enough, could break them in any reasonable timeframe.

Quantum computers threaten to change that. A sufficiently powerful quantum machine running Shor's algorithm could crack the RSA and elliptic curve cryptography that secures most of today's internet in hours or days rather than millennia. The world has known about this threat for years. The response has been a global effort, led by the US National Institute of Standards and Technology, to standardise a new generation of post-quantum cryptographic algorithms — mathematical schemes designed to resist attack even from quantum computers. NIST has been running this standardisation process since 2016.

On July 28, 2026, Anthropic published research showing that Claude Mythos Preview — its most capable and restricted AI model — had found two previously unknown attacks on HAWK, the last lattice-based scheme remaining in NIST's third-round post-quantum signature competition. The AI did this in approximately 60 hours, working mostly autonomously, at a cost of around $100,000 in compute. Human cryptographers had reviewed HAWK for years without finding these weaknesses. The HAWK team withdrew the scheme from the NIST process the following day. Yesterday.

What HAWK Was — And Why It Mattered

To understand why this result matters, you need to understand what HAWK is and where it sat in the global effort to replace vulnerable cryptography.

A digital signature scheme is the mathematics that proves a message or transaction came from you — without ever exposing your private key. When you authorise a bank transfer, when a software update is verified as legitimate, when a government document is signed digitally — a signature scheme is doing that verification. The schemes currently in use, including RSA and ECDSA, are vulnerable to quantum computers. NIST's post-quantum signature competition exists to find replacements that aren't.

HAWK is, or was, a lattice-based digital signature scheme — meaning its security derives from the hardness of mathematical problems involving high-dimensional geometric structures called lattices. HAWK is the only lattice-based scheme among the nine candidates that NIST advanced to the third round of its additional post-quantum digital-signature process in May 2026. It was the last of its kind in the competition. Lattice-based cryptography is widely considered the most promising family of post-quantum schemes because lattice problems have resisted decades of mathematical attack. HAWK was supposed to be the signature algorithm that brought lattice security to standardisation.

What Claude Mythos Found — The Attack Explained

Claude Mythos Preview found two distinct weaknesses in HAWK. The primary result is the most consequential: Anthropic said Mythos Preview developed and verified the result over approximately 60 hours in a multi-agent environment. A human researcher provided occasional project-management guidance but was not a lattice-cryptography specialist. The human in the room was not a cryptographer. The AI did the mathematics.

The attack works by reducing the complexity of the lattice problem underlying HAWK. The attack approximately halves the block size required in lattice reduction to recover an equivalent secret key. In practical terms: the mathematical problem that was supposed to make HAWK secure is significantly easier to solve than anyone had previously demonstrated. The HAWK team helped verify the result before disclosure — they confirmed that Anthropic's attack was genuine before it was published.

Critically, what this is not: The attack remains exponential. It is not a polynomial-time break of HAWK, and Anthropic said it does not extend to other NIST signature candidates or lattice cryptography generally. This means the attack does not reduce lattice cryptography as a whole to a solved problem — it finds specific weaknesses in HAWK's construction that do not generalise. The other eight candidates in NIST's third round are not compromised by this result. But HAWK itself is: The HAWK team said straightforward mitigations, including doubling the parameters or moving to higher-rank modules, would make HAWK uncompetitive. A scheme that needs to double its parameters to survive an attack is no longer a competitive standard. Hence the withdrawal.

The Second Result — Möbius Bridge and AES

The HAWK break was the headline. The second result is arguably more interesting from a theoretical standpoint — and more misunderstood in the coverage it has received. The same model, working mostly on its own over three days, invented a new attack technique — which it named the Möbius Bridge — that makes an existing attack on a weakened version of the world's most widely deployed symmetric cipher, AES, between 200 and 800 times faster.

Before panic sets in: this does not break production AES. The AES used in your browser, your bank, your encrypted hard drive, and every VPN on Earth runs at 10 rounds of transformation. The second result targets AES-128 reduced from ten rounds to seven. Seven-round AES is a deliberately weakened research variant that exists solely for cryptanalysis research — it is not used in any real-world system. The 200–800× speedup on a variant nobody actually deploys is a significant theoretical result, but it does not touch the security of anything protecting real data today.

What the Möbius Bridge result does represent is something more subtle and more significant than a practical attack: it demonstrates that Anthropic's AI can invent novel mathematical attack techniques autonomously. The AI did not apply a known method. It invented a new one, named it, and verified its effectiveness. That is a different category of result from finding an existing vulnerability. It suggests that AI-assisted cryptanalysis is not just accelerating known approaches — it is expanding the space of what approaches exist.

The Disclosure Process — How Anthropic Handled It

One dimension of this story that has received less attention than the results themselves is how Anthropic managed the disclosure — and how different it looks compared to how OpenAI handled the Hugging Face incident earlier this month.

Anthropic disclosed the attack to HAWK's authors in June and coordinated simultaneous public disclosure to the NIST mailing list alongside today's research release. The HAWK authors were given advance notice. They verified the result independently. They confirmed the findings before publication. NIST was notified. The disclosure was coordinated, responsible, and gave the affected parties time to prepare their response before the world found out. The HAWK team's withdrawal was pre-arranged — they were not blindsided by a public research paper.

This is the textbook model for responsible disclosure of cryptographic vulnerabilities, applied to a result found by an AI system. The contrast with an autonomous AI hacking an external company and running for nine days before its own developers noticed is not subtle.

What This Means for the Post-Quantum Transition

The implications reach well beyond HAWK itself. The US government has mandated that federal agencies transition high-value assets to post-quantum cryptography by the end of 2030. Financial institutions, healthcare systems, and critical infrastructure are all working against the same deadline. The assumption underlying all of that work is that the NIST-standardised algorithms are secure — that the years of human cryptographic review they underwent are sufficient to catch significant weaknesses before deployment.

What Anthropic's result demonstrates is that AI can audit cryptographic schemes at a speed and cost that human review cannot match. HAWK spent years in NIST's review process. Mythos found two novel attacks in 60 hours for $100,000. That asymmetry has two readings: the alarming one is that vulnerabilities in deployed post-quantum standards might be found by adversarial AI before defenders discover them. The optimistic one is that Anthropic just demonstrated a tool that can comprehensively audit cryptographic candidates before standardisation — and that it would be both affordable and fast to apply to every remaining NIST candidate before any of them are deployed at scale.

The Larger Question — What Can AI Find That We Missed?

The cryptographic community's response to the HAWK result has been largely calm — the attack is significant but contained, and the responsible disclosure process worked as designed. The deeper anxiety is the question the result implies without stating directly.

NIST's post-quantum standardisation process is one of the most rigorous cryptographic review efforts in history — years of open competition, thousands of expert eyes across dozens of countries, structured academic analysis at every stage. That process missed what an AI found in 60 hours. Not because the human reviewers were negligent, but because the search space of possible attacks is vast and the AI searched it faster and more systematically than any team of human researchers could.

The four NIST post-quantum standards already finalised — CRYSTALS-Kyber, CRYSTALS-Dilithium, FALCON, and SPHINCS+ — are not directly affected by this result. But Anthropic's findings raise a question that the cryptographic community will be working through for months: if Mythos can do this to HAWK, what could a similarly motivated AI-assisted audit find in the already-standardised schemes? Running that audit — proactively, before adversaries do it first — now looks less like an academic exercise and more like a security imperative.