An AI Just Broke Cryptography That Took Humans Two Years to Build. For $100,000.

An AI model just cracked a cryptographic algorithm that human experts had spent two years trying to break. It took 60 hours and cost about $100,000 in API calls.

That's not a hypothetical. It happened last week. Anthropic's Claude Mythos Preview — a model the public can't use — found a mathematical flaw in HAWK, a post-quantum digital signature scheme currently under consideration by NIST. The same model also found a new way to attack a reduced version of AES, the encryption standard that protects basically everything you do online.

Neither result breaks anything you're using today. But the story of how it happened — and what it means for the future of security — is worth your attention.

What HAWK is, and why it matters

Before we get to the AI part, you need to understand the target.

Quantum computers, if they ever become practical at scale, will shred most of the cryptography currently protecting the internet. RSA, ECDSA, the stuff that makes HTTPS work — all of it falls to Shor's algorithm once you have a big enough quantum machine. We're not there yet, but the cryptographic community has been preparing for years. The logic is simple: the systems you deploy today might still be in use when quantum computers arrive, so you need encryption that can survive them.

That's why NIST has been running a multi-year competition to find new "post-quantum" cryptographic schemes. The process started in 2016, attracted dozens of submissions from research teams worldwide, and has been slowly narrowing the field through rigorous public review. Each round involves cryptographers worldwide trying to break the candidates.

HAWK is one of the surviving candidates in the third round. Its security is based on something called the Lattice Isomorphism Problem — a mathematical puzzle involving grids of points in high-dimensional space. The idea is that certain operations on these lattices are easy to perform but nearly impossible to reverse without the secret key. Lattice-based cryptography has become the dominant approach for post-quantum schemes because it's both theoretically sound and computationally efficient.

HAWK had been through two rounds of expert review. Cryptographers had picked at it for over two years. The lattice structure had been analyzed, the key generation process audited, the signature verification stress-tested. It was considered solid.

Then an AI model found a shortcut.

The attack

The vulnerability Mythos discovered is elegant in a way that should make cryptographers uncomfortable. HAWK's lattice has a hidden symmetry — a "nontrivial automorphism" — that no human expert had successfully exploited. Previous research had theorized that if you could find such a symmetry, you could attack the scheme. The math was there in the literature. But no one had proven that HAWK's specific lattice actually contained an exploitable automorphism.

Mythos found it. And the consequence is severe: the attack effectively cuts HAWK's key strength in half. To maintain the same level of security, you'd need to double the key size — which eliminates many of the reasons HAWK was an attractive candidate in the first place. Bigger keys mean bigger signatures, more bandwidth, slower verification. For a scheme competing in a NIST standardization process, that's potentially disqualifying.

Here's what makes this remarkable: Mythos worked semi-autonomously in a multi-agent setup. Think of it as a team of AI agents collaborating in a sandboxed environment with access to Python, Sage (a mathematical software system), and the full body of cryptographic literature. One agent initially tried to dismiss the attack idea as infeasible — it looked at the problem and essentially said "this probably won't work." A second agent disagreed, found a way to make it work, and implemented the full exploit.

The human researcher involved had a background in theoretical computer science but wasn't a lattice cryptography specialist. His role was mostly project management — giving direction, not doing the math.

The model did the math.

The AES attack, and the moment the model gave up

The second discovery is arguably more interesting, not because of the cryptography but because of the human-AI dynamic.

A different Anthropic researcher built a scaffold that let Claude Mythos autonomously form hypotheses and test them against the target. The target was a reduced version of AES-128 — specifically, a version with only 7 of the full 10 rounds. This is a standard approach in cryptography research: you study weakened versions to understand the full algorithm's resilience. If you can break 7 rounds but not 10, the 3-round gap is your margin of safety.

Mythos initially refused to work on it. The model concluded that further improvements were impossible and essentially told the researcher to give up. In its words: "If you want a different outcome, the target has to change… AES-128 r5/r6 is just genuinely hard."

This is a model that reads the existing literature, assesses the difficulty, and makes a judgment call. And in this case, it was wrong. But it took a human to see that.

The researcher pushed back with three words of guidance: look for "genuinely novel ideas."

That's all it took. Over the next three days, Mythos generated roughly one billion tokens, received only three more substantive prompts (one of which was a typo-ridden "we want proper research to find genuinly hard findings"), and developed a new fingerprinting method Anthropic calls "Möbius Bridge." The technique eliminates one of the guesses an attacker needs to make, improving on the best previously known attacks by a factor of 200 to 800x.

One billion tokens. Three prompts. A breakthrough that improves on decades of human cryptanalysis by two to three orders of magnitude.

After that, human researchers — who, Anthropic notes, were also not cryptography experts — spent several hundred hours verifying the results. The verification took longer than the discovery. Let that sink in.

What this costs, and who can do it

Each discovery cost roughly $100,000 in API fees. That sounds like a lot until you realize what you're comparing it to. A team of specialist cryptanalysts working for two years on HAWK — that's a university research group, funded by grants, publishing papers, presenting at conferences. Their cost is easily in the millions. And they didn't find the vulnerability.

The asymmetry is the point. $100,000 is within the budget of a well-funded research lab, a national intelligence agency, or frankly a sufficiently motivated individual with a credit card and an API key. The barrier to entry for autonomous cryptographic research is dropping fast, and it's going to keep dropping as models get smarter and compute gets cheaper.

Anthropic is acutely aware of this. That's why Mythos Preview remains unavailable to the public. The company shared its findings in advance with the US government and industry partners, coordinated disclosure with HAWK's authors back in June, and published the results alongside full technical papers. They also partnered with ETH Zurich, Tel Aviv University, and TU Berlin to release CryptanalysisBench — a benchmark that lets other researchers systematically evaluate how good language models are at breaking ciphers.

The responsible disclosure is good practice. But it also highlights the tension at the center of this story: Anthropic built a model that can find cryptographic weaknesses faster than human experts, and now they're trying to figure out who should be allowed to use it. That's not a technical problem. That's a governance problem. And nobody has a good answer yet.

Why this doesn't break the internet (yet)

Let me be precise about what these results do and don't mean.

The HAWK attack is serious for HAWK specifically, but HAWK isn't deployed anywhere. It's a candidate in a NIST standardization process — one of several still under consideration. The attack means HAWK probably needs bigger keys to be viable, which weakens its competitive position. NIST may decide to drop it, or the HAWK team may redesign it. No system currently relies on it.

The AES attack applies to a reduced version with 7 rounds. Full AES-128 uses 10 rounds. Breaking 7 rounds doesn't mean you can break 10. It means the margin of safety is smaller than cryptographers thought, and the techniques developed here — particularly the Möbius Bridge method — might eventually be extended to more rounds. Might. Not will.

So your bank account, your messages, your HTTPS connections — all safe today. This is not a five-alarm fire. Nobody needs to panic-change their encryption stack.

But it's a smoke detector going off in a building that hasn't caught fire yet. And the smoke is getting thicker.

The real story: AI as a research agent

Strip away the cryptography and here's what actually happened: an AI model, working mostly autonomously, performed original mathematical research at a level that competed with — and in specific ways exceeded — human experts who had years of head start.

This is the pattern that matters. Not chatbots writing emails. Not AI generating marketing copy. An AI agent that can survey a body of literature, form hypotheses, run computational experiments, implement verification pipelines, catch its own errors, and produce results that survive expert peer review. Results that were published as legitimate academic papers.

The multi-agent setup is particularly telling. One agent said "this won't work." Another agent disagreed and found a way. That internal disagreement — the push and pull between skepticism and exploration — mirrors how real research teams operate. Except this team burned through a billion tokens in three days and didn't need coffee breaks.

And the human role? Increasingly managerial. The researcher who guided the AES work wasn't a cryptanalyst. He was a project manager with good instincts about when to push and when to let the model explore. Three prompts. One typo. A result that improves on two decades of human work.

The skill that mattered wasn't cryptographic expertise. It was knowing how to steer an AI agent toward productive research — when to accept its judgment, when to override it, and when to say "try harder."

Where this goes next

Anthropic says they've already started finding other attacks beyond the two they published. The implication is that Mythos — or whatever comes after it — will keep finding things. And eventually, someone will deploy a model with these capabilities who isn't as careful about disclosure, who doesn't coordinate with NIST, who doesn't publish papers. Someone who just uses it.

The open question isn't whether AI can break cryptography. Anthropic just showed it can. The question is whether the cryptographic community can design algorithms fast enough to stay ahead of AI-assisted cryptanalysis — and whether the institutions that certify these algorithms can adapt to a world where a $100,000 compute budget can do what used to require a university research lab and years of specialized training.

NIST's post-quantum standardization process was designed for a world where the threats were quantum computers and human cryptanalysts. It may need to start accounting for AI as a third threat actor. Not a theoretical one. A practical one that just invalidated two years of expert review on a candidate scheme in a single weekend.

In the meantime, if you're building systems that rely on cryptography — and if you're building anything connected to the internet, you are — this is your signal that the threat model is expanding. Not today. Not tomorrow. But faster than most people expected a week ago.

The most expensive part of breaking HAWK wasn't the math. It was the compute. And compute only gets cheaper.

---

If you're interested in AI agents that do real work — browse the web, run terminal commands, read files, automate tasks — CopperRiver is a desktop AI assistant for Mac that runs open-source models locally. Plans start at $9/mo.