Claude AI Discovers Faster Attacks on HAWK and AES Cryptography
In brief
- Claude Mythos discovered improved attacks on HAWK and AES cryptographic algorithms
- HAWK 256 attack cost reduced from 2^64 to 2^38 operations
- Claude developed attacks in 60 hours using multi-agent research, costing ~$100,000 in API usage
- Frontier AI identified mathematical weaknesses missed by years of human cryptographic review
Claude's cryptanalysis discoveries
Claude Mythos discovered improved attacks against two cryptographic algorithms. Against HAWK, Claude identified a previously unused mathematical symmetry that enabled a faster key recovery attack. For HAWK 256, the estimated cost of recovering a key fell from 2 to the power of 64 operations to 2 to the power of 38.
Claude improved an existing meet-in-the-middle attack against seven-round AES 128 with a fingerprinting method called the Möbius Bridge. The full AES attack was estimated to be between 200 and 800 times faster than previous methods. It's worth noting that HAWK has not been deployed and the AES attack applies only to a seven-round research version rather than the complete ten-round AES 128 cipher.
Scope and timeline
Claude developed the HAWK attack in about 60 hours using a multi-agent research system. Anthropic estimated that the work cost about $100,000 in API usage. A human researcher provided occasional guidance but lacked specialist knowledge of lattice-based cryptography. Claude generated about one billion output tokens while refining the AES attack approach.
The validation process took far longer than discovery. Anthropic researchers then spent several hundred hours validating the result, substantially longer than the model took to discover it.
Broader implications
frontier AI models can identify mathematical weaknesses that escaped years of human review.
Anthropic partnered with researchers from ETH Zurich, Tel Aviv University, and the University of Haifa to create CryptanalysisBench, a benchmark for evaluating AI cryptanalysis capabilities. Anthropic said HAWK would need to double its proposed key sizes to maintain the intended security level.
The company emphasized both the opportunity and risk. AI could help identify weaknesses before new cryptographic standards are deployed, but Anthropic warned that future AI models may discover cryptographic flaws with immediate consequences for real-world security. The company said it followed responsible disclosure procedures and consulted academic, government, and industry specialists before publishing the findings.
