60 hours to halve a post-quantum cipher: a 2026 crypto-agility playbook

Summary. On 28 July 2026 Anthropic reported that Claude Mythos Preview found two new cryptographic attacks: one that cuts the effective key strength of HAWK, a post-quantum signature candidate at NIST, in half, and one that speeds the best known attack on 7-round AES-128 by 200 to 800 times. The HAWK result took about 60 hours of model work and roughly $100,000 in API cost, and dropped the estimated key-recovery cost for the HAWK-256 challenge parameter from 2^64 to 2^38 operations. Neither result touches production systems: HAWK is a candidate scheme, not deployed, and the AES attack hits 7 of the cipher's 10 rounds and still needs about 2^105 chosen plaintexts. The signal for engineering leaders is not "encryption is broken." It is that machine cryptanalysis reached expert level in one year, and crypto agility is now an operational requirement rather than a 2030 project.

What Claude Mythos actually found

Anthropic's Frontier Red Team published the work on 28 July 2026 alongside two technical papers and reproducibility code. The company called the two attacks "the strongest attacks we have found to date" and stressed that no production software has to change because of them.

The first attack targets HAWK, a digital signature scheme whose security rests on the Lattice Isomorphism Problem. HAWK is the only lattice-based scheme among the nine candidates NIST advanced to the third round of its additional post-quantum signature process in May 2026. A 2025 paper by Daniël van Gent and Ludo Pulles had shown that a nontrivial automorphism, a symmetry that preserves the lattice, would reduce HAWK key recovery to a shorter problem, but it did not find one in HAWK's lattice. Claude Mythos found the missing automorphism. That halves HAWK's effective key size, so the parameters would need to double to hold their claimed security. Anthropic notes that doubling HAWK's key size removes most of what made it attractive as a candidate.

The concrete numbers matter. For the small HAWK-256 challenge parameter, the expected key-recovery work fell from 2^64 to 2^38 operations. In the same-day NIST forum note reported by The Hacker News, the gate-count estimates for the real security parameters fell from 2^150 to 2^108 for HAWK-512 and from 2^288 to 2^182 for HAWK-1024. Both larger parameter sets stay far out of reach. The released code recovers a 592-byte functionally equivalent signing key for HAWK-256 and runs in about three hours and 42 minutes on a 96-core server. The attack is a faster exponential-time attack, not a polynomial-time break, and Anthropic says it does not extend to other NIST candidates or to lattice cryptography in general.

The second result improves an attack on a reduced-round variant of the Advanced Encryption Standard (AES). AES-128 uses 10 rounds; academics routinely study weakened versions to measure how much safety margin remains. Working almost entirely on its own inside an agentic harness, Mythos produced a new meet-in-the-middle technique it named the Möbius Bridge. The prior best attack had to enumerate 256 candidate values and look each up in a precomputed table. The Möbius Bridge fingerprint is invariant to that guess, which removes the 256-way step; with further optimizations the 7-round attack runs 200 to 800 times faster, depending on how runtime is measured. It still assumes about 2^105 chosen plaintexts, which CyberScoop put at more than 400 octillion messages, so it cannot be run.

What it does not mean

Read the limits carefully, because the headlines will not. HAWK is a candidate under public review, and the whole point of the NIST process is to expose weaknesses before a scheme is standardized and deployed. Finding a serious flaw late is not new: during the standardization of ML-KEM and ML-DSA, the SIKE proposal was famously broken in about an hour on a single laptop in 2022. The AES result is on a 7-round teaching variant, not the 10-round cipher that protects your TLS sessions, disk volumes, and backups. As of 29 July 2026, NIST still listed HAWK as a third-round candidate, and the public record did not yet show whether NIST or the HAWK submitters would change the scheme's parameters or standing.

There is also a cost and verification story that tempers the panic. Each attack cost roughly $100,000 in API usage to develop. The HAWK attack runs end-to-end and is easy to check. The AES result was harder: two Anthropic researchers, who are not cryptographers, spent several hundred hours over nearly a month confirming the model's math after Mythos generated about a billion output tokens working the problem. On Anthropic's own account, human verification, not model capability, was the visible bottleneck.

Why it still matters

The capability curve is the real news. Anthropic points out that a year earlier, language models could not perform cryptanalysis of even basic ciphers; now one has improved attacks that escaped expert human review for two years. The company is candid that it has already begun auditing other schemes, and it lists preliminary attacks on the LEA lightweight cipher, Serpent, Salsa20, the Poseidon hash, and SHA-1, all on reduced-round or otherwise limited variants. To let others track this, Anthropic and academics at ETH Zurich, Tel Aviv University, and the University of Haifa released CryptanalysisBench, a 191-task cryptanalysis benchmark, on 20 July 2026.

The practitioners reading this should take the operational point, not the doomsday one. Ellen Boehm, senior vice president of strategy and AI innovation at Keyfactor, a cryptography-management provider, told CyberScoop that research like this makes it more important for organizations to "have visibility of where cryptography sits inside their enterprise, what business systems and processes it's connected to, and the need for PQC readiness, if they haven't already built a plan." She added that as AI tools get used continuously, enterprises need to "treat their trust infrastructure in an ongoing, operational manner versus thinking of it as a static environment that only changes every few years." That is the whole lesson: cryptography is now a moving target, and the organizations that can change algorithms quickly will absorb the next result without a fire drill.

The quantum timeline points the same way. NIST finalized its first three post-quantum standards in 2024, and the US National Security Agency's CNSA 2.0 guidance sets 2030 as the migration deadline for national security systems. Governments are treating the horizon to a cryptographically relevant quantum computer as close enough to act on now. An AI model weakening a candidate before it ships, and a future model finding a flaw in something already deployed, are two points on the same trend line.

The 2026 crypto-agility playbook

Crypto agility is the ability to change cryptographic algorithms across your systems without re-architecting them. Here is the plan a senior engineering team should run this quarter, before any single algorithm result forces the issue.

Start with a cryptographic bill of materials. You cannot rotate what you cannot see. Inventory every place a cryptographic primitive is used: TLS termination, code and firmware signing, JWT and session tokens, database and disk encryption, message queues, hardware security modules, and third-party libraries and vendors. Record the algorithm, key size, key owner, and rotation path for each. Most teams discover that cipher choices are hard-coded across dozens of services, which is exactly the state that makes a future migration a multi-quarter rewrite.

Adopt the standardized algorithms for new work now. NIST's FIPS 203, 204, and 205 became effective on 14 August 2024. Use ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) for signatures, with SLH-DSA (FIPS 205) as a conservative hash-based fallback whose security does not depend on lattice hardness. The HAWK result is a reminder of why that fallback exists: when one mathematical family takes a hit, you want a signature scheme built on a different assumption already in your toolbox.

Deploy in hybrid mode where you can. Pair a classical algorithm with a post-quantum one so a break in either leaves you protected, which is how most production TLS migrations are shipping in 2026. Put the algorithm choice behind an interface so a swap is a configuration change, not a code change across every service. This is the single design decision that separates teams that will shrug off the next cryptanalysis result from teams that will scramble.

Make cryptanalysis a schedule, not a project. Re-run dependency scanning and cryptographic inventory on a cadence, subscribe to NIST and vendor advisories, and treat algorithm changes the way you already treat certificate rotation. The same AI capability that produced the Möbius Bridge is available to your security team for software supply chain security and code auditing, so use it on your side of the line.

India-specific considerations

Indian enterprises inherit the same exposure with an extra compliance layer. The Digital Personal Data Protection Act 2023 (DPDP) makes organizations accountable for reasonable security safeguards over personal data, and encryption is the control most teams lean on to demonstrate that. A cryptographic inventory is therefore also a DPDP evidence exercise: it tells you which systems holding personal data would be affected if an algorithm has to be retired. Banking and payments teams face a second timeline from the Reserve Bank of India's data-protection expectations, and financial infrastructure is where hybrid post-quantum deployment is being tested first. Teams that already run a DPDP Act engineering playbook for Indian startups can fold crypto agility into the same control set rather than standing up a parallel program. The quantum threat itself is not imminent, but as the roadmap behind chips like Microsoft's Majorana 2 quantum processor shows, the planning horizon is short enough that "later" is not a strategy.

FAQ

How eCorpIT can help

eCorpIT is a Gurugram-based, senior-led engineering organization, founded in 2021 and certified for CMMI Level 5, MSME, and ISO 27001:2022. We help teams build a cryptographic bill of materials, design systems so algorithms swap without a rewrite, and plan hybrid post-quantum deployment against real timelines through a post-quantum cryptography readiness assessment. We design applications aligned with DPDP Act and relevant security requirements rather than claiming blanket compliance. To review your crypto agility posture with our security engineers, contact us.

References

1. Anthropic — Discovering cryptographic weaknesses with Claude

1. Anthropic — HAWK key recovery paper

1. Anthropic — AES Möbius Bridge paper

1. The Hacker News — Claude AI cracked a post-quantum test scheme and found a faster 7-round AES attack

1. CyberScoop — What Anthropic found when it turned Mythos loose on encryption algorithms

1. NIST — Post-quantum additional digital signatures, round 3

1. van Gent and Pulles — On the lattice isomorphism problem and HAWK (eprint 2025/928)

1. Anthropic and academic partners — CryptanalysisBench (arXiv 2607.18538)

1. Federal Register — Issuance of FIPS 203, 204, and 205

1. NIST — Post-quantum cryptography standardization project

1. DigiCert — Tracking the progress toward post-quantum cryptography

Last updated: 31 July 2026.