Anthropic’s Mythos Model Finds Flaws in Strong Encryption Algorithms

Seven days after OpenAI admitted two of its models broke out of a test environment and hit Hugging Face's production servers, Anthropic put out something rather different: two research papers describing controlled, disclosed cryptanalysis. The model behind it, Claude Mythos Preview, isn't public. It's locked inside something Anthropic calls Project Glasswing, available only to select agencies and organizations. But what it found is worth sitting with.

The bigger result targets HAWK, a digital signature scheme built to survive quantum computers and one of the remaining candidates in NIST's third-round selection process. HAWK had already made it through two rounds of expert scrutiny over two years. Mythos needed roughly 60 hours to beat the best known attack against it, cutting the expected cost of breaking HAWK-256 from 2^64 operations down to 2^38 — effectively halving its usable key strength. The model spotted a mathematical symmetry in HAWK's underlying lattice that nobody had pinned down before. Fixing it means doubling the key size, which quietly kills the compactness that made HAWK appealing in the first place. Anthropic told HAWK's authors back in June and coordinated the public writeup with NIST's mailing list.

The second attack hits a reduced, seven-round version of AES-128, the encryption standard that's protected everything from bank transfers to Wi-Fi since 2001. Reduced-round attacks are a normal research tool, not a real-world threat — this one still needs an attacker capable of getting 2^105 chosen plaintexts encrypted, which is nowhere near practical. Still, Mythos built a new fingerprinting technique it named the Möbius Bridge, cutting a stage that used to require checking 2^56 values, and the whole attack came out 200 to 800 times faster than anything published before.

What happened before the breakthroughs is almost more interesting than the math. Claude initially refused the AES task outright, insisting it was impossible. Researchers had to push back three separate times — no shortcuts, no swapping targets, actually do the work — before the model committed. Once it did, it ran mostly unsupervised for three days and generated around a billion output tokens. Verifying the AES result afterward took two researchers nearly a month, and they weren't cryptographers going in; they had to learn the field as they checked the math. Anthropic's Nicholas Carlini told the New York Times that a year ago these models struggled with problems he could solve at sixteen. Now, he says, they're producing state-of-the-art research.

Anthropic also flagged a pile of unfinished leads: a workable attack on 13 of LEA's 24 rounds that recovers a key on an ordinary desktop in under an hour, progress against six rounds of Serpent-128, and smaller nudges forward on Salsa20, Poseidon and SHA-1. Alongside teams from ETH Zurich, Tel Aviv University and the University of Haifa, the company released a new benchmark, CryptanalysisBench, meant to track exactly how good these models are getting at this kind of work going forward.