Anthropic's released implementation gives an expected end-to-end runtime of about three hours and 42 minutes on a 96-core server, the company says — a striking concrete measurement for a key-recovery result that targets a challenge parameter in a NIST post-quantum process.
How Mythos Preview uncovered a hidden HAWK-256 symmetry
Anthropic reported that its Mythos Preview model discovered an additional automorphism — a nontrivial symmetry — in the lattice underlying the HAWK signature family that opened a direct key-recovery path against the HAWK-256 challenge parameter. The company said Mythos Preview largely conducted the research itself, with humans supplying project direction, compute and verification.
Anthropic describes the direct HAWK key recovery as an instance of the search module Lattice Isomorphism Problem (smLIP): the attacker must recover a hidden transformation between two lattices. Prior work by Daniël van Gent and Ludo Pulles showed that the presence of a nontrivial automorphism would reduce the search to finding a short vector in a lattice of roughly half the original dimension; Anthropic says Mythos Preview found the specific automorphism needed to exploit that path.
Technical outline of the HAWK-256 attack and its measured cost
The published HAWK-n attack constructs a τ-cocycle lattice from the public key, then uses lattice reduction and sieving to recover short vectors and reconstruct a secret basis able to sign for the original public key. Anthropic's implementation verifies recovered keys by signing a message and checking it against the NIST reference implementation; the code produces a 592-byte decoded key containing functionally equivalent signing material rather than recovering the original 96-byte secret-key seed.
Anthropic estimates the expected HAWK-256 key-recovery work factor falls from 264 to 238 and published gate-count estimates that drop from 2150 to 2108 for HAWK-512 and from 2288 to 2182 for HAWK-1024. The company emphasized the attack remains exponential, does not extend to other NIST candidates or lattice cryptography generally, and — in Anthropic's words — neither result affects production systems.
The AES-128 seven-round result and the Möbius Bridge
In a separate finding, Mythos Preview removed a previously required 256-way guessing step from an existing meet-in-the-middle attack on seven-round AES-128 by discovering an invariant fingerprint Anthropic calls the Möbius Bridge. That fingerprint does not change across the guessed value, allowing the attack to drop the 256-way enumeration and yield a 200- to 800-fold speedup depending on runtime accounting.
Anthropic stressed the attack's practical limits: it assumes an adversary can obtain about 2105 chosen plaintexts under one fixed unknown key, a requirement the company says puts the attack far outside real-world use. The released artifacts include complete black-box key recovery against a smaller AES-like cipher with a 24-bit key and component measurements in C, Python and Rust; Anthropic projected those measurements to estimate the cost for the real seven-round AES-128 but did not execute an end‑to‑end full AES-128 recovery.
Reproducibility, published artifacts, and immediate standing
Anthropic published two technical papers and reproducibility artifacts alongside the disclosures. The HAWK code supports HAWK-256 only, rejects non-HAWK-256 inputs, includes two public keys the company says it successfully attacked, and can generate and test fresh HAWK-256 keys. Anthropic said its HAWK-256 implementation yields an expected end-to-end runtime of roughly three hours and 42 minutes on a 96-core server.
Anthropic said Mythos Preview developed and verified the HAWK result in about 60 hours in a multi-agent environment; the total model output across the projects approached roughly one billion tokens and the API cost was about $100,000. Researchers then spent several hundred hours checking the methods; two researchers took nearly a month to reach confidence that the HAWK result was correct.
As of July 29, 2026, NIST continued to list HAWK as a third-round candidate. Anthropic's NIST-forum announcement thanked the HAWK team for helping verify the result and providing feedback but did not specify whether that feedback included reviewing the proof, running the public artifact, or both. The public thread contained no replies when checked, and The Hacker News did not locate an independent reproduction of Anthropic's HAWK-256 recovery during its review.
What this means for NIST, HAWK submitters, and practicing cryptographers
- NIST: will have to weigh Anthropic's published reductions and gate-count updates against its existing evaluations; Anthropic's disclosure notes HAWK remains listed as a third-round candidate as of July 29, 2026.
- HAWK submitters and implementers: may examine Anthropic's τ-cocycle construction and the released code for HAWK-256 to assess whether parameter changes, revised security claims, or other mitigations are warranted for non-challenge parameter sets.
- Cryptographers and academic reviewers: now have reproducibility artifacts and component measurements to inspect; Anthropic published the mathematical constructions and code for the AES components and for the HAWK-256 recovery, enabling targeted verification and follow-up analyses.
Anthropic's dual disclosures are concrete: a lattice-symmetry driven key-recovery path against the HAWK-256 challenge parameter with a measured multi-core runtime, and a mathematical invariant that eliminates a 256-way guess in a seven-round AES-128 meet‑in‑the‑middle construction while leaving the full‑scale attack impractical. The next steps are technical and local — peer verification of the released artifacts, reviewer assessment of parameter and claim updates, and follow‑up cryptanalysis — rather than immediate operational remediation, per Anthropic's own framing.
