Mythos Attack Ends HAWK Bid Without Breaking Production Encryption

HAWK has left the U.S. post-quantum standards contest after Anthropic's Mythos security model helped expose a faster attack on the digital signature candidate. The result matters because HAWK had already passed two evaluation rounds, but it does not mean that encryption used by people or businesses has been defeated. On Monday, July 27, 2026, Anthropic disclosed the work; HAWK's developer said the following day that he was withdrawing the algorithm.

Mythos was tested on two separate problems. Its HAWK work changed the fate of a proposed standard, while its AES result improved an attack only against a reduced laboratory challenge. Keeping those outcomes apart is essential: one candidate became less viable, yet neither experiment produced a practical route into production cryptosystems.

A Shortcut Cut HAWK's Effective Key Strength

HAWK produces digital signatures using mathematics meant to remain difficult even for future quantum computers. Its security depends on the Lattice Isomorphism Problem. The strongest known classical approach looks for mathematical symmetries called automorphisms, and Mythos produced a previously unknown way to find them. The issue concerns HAWK's design rather than every system built for the post-quantum era.

An Anthropic researcher without cryptography expertise directed the model for about 60 hours, using roughly $100,000 in computing resources. Ars Technica reported that the resulting method improved the best-known attack enough to cut HAWK's effective key strength in half. In cryptographic review, an algorithm is considered broken when a shortcut can recover a key faster than brute force, even if the attack remains too expensive for everyday use. That technical definition explains why withdrawal was justified despite the absence of a practical intrusion.

Doubling HAWK's key size could compensate for the weakness. That repair would also add computational cost, making the scheme less attractive beside other post-quantum signature options, including ML-DSA and FN-DSA. Sophie Schmieg, a Google specialist in post-quantum cryptography, said HAWK had already been suspected of harboring a weakness and summarized the new result bluntly:

Basically with this paper, HAWK is dead.

The withdrawal came during HAWK's third round of review at the National Institute of Standards and Technology. That round exists to uncover faults that earlier scrutiny missed. The failure therefore removes HAWK from consideration without evidence that other post-quantum schemes share its defect. In this case, the candidate was still being tested when the attack changed its standing.

Two Agents Combined Known Methods Into the Attack

Mythos remains available only to selected trusted users, consistent with Anthropic's earlier restricted Mythos rollout. For the HAWK task, the model operated semi-autonomously inside an agent system with occasional human guidance. It reviewed existing research, worked through the mathematics, ran computational experiments and then built a verification pipeline for the proposed attack.

Two Mythos agents explored the method largely independently. One initially rejected it as unworkable; the other found a way forward. They later converged on the same conclusion. Johns Hopkins cryptography professor Matthew Green found the combination notable because it assembled established techniques that researchers had not previously put together, rather than inventing an entirely new branch of mathematics. Ars Technica cautioned that its description was simplified; fuller methods appear in Anthropic's post and the accompanying papers.

That distinction narrows the claim. The experiment indicates that a model can search technical literature and test combinations at useful scale under human direction. It does not establish how often that process succeeds, whether the same attack was close to discovery by conventional researchers or how the model would perform against mature systems such as RSA or elliptic-curve cryptography. Anthropic did not say whether Mythos had been tested against those systems.

The AES Gain Remained Inside a Weakened Challenge

The AES experiment concerned a meet-in-the-middle attack, which feeds known plaintext into a cipher and compares the encrypted output for patterns that may reveal a key. The previous method required about 2¹⁰⁵ plaintext inputs. Code produced through Mythos used a Möbius Bridge technique to reduce that requirement to about 2⁸⁹ inputs.

Anthropic estimated a 200- to 800-fold time reduction. The remaining input count is still beyond practical reach, and the test used only seven AES rounds. Full AES adds more stages: 10, 12 or 14, based on key length. The experiment consequently improved a benchmark attack without producing a usable break of AES as deployed. Its real-world speed advantage also remains unknown because the tested version was deliberately reduced.

Ars Technica also noted that both projects used deliberately weakened challenge instances supplied for adversarial review. Those tests are legitimate tools for finding mathematical weaknesses, but their results cannot be carried over unchanged to full-strength implementations. Even after the reported improvements, the underlying building blocks remained secure and the attack methods appeared infeasible outside test conditions.

HAWK's Withdrawal Validates the Test, Not Every Mythos Claim

NIST's evaluation process was designed to keep a flawed candidate from becoming a standard, and HAWK's exit shows that filter operating before adoption. Mythos may have accelerated the discovery, but the public result does not reveal the model's success rate across harder targets. Anthropic also has a commercial interest in presenting its restricted system as a major advance, so one withdrawn candidate cannot settle the broader case for AI-led cryptanalysis.

The more immediate pressure falls on verification. Anthropic argues that models may generate technical findings faster than specialists can reproduce and assess them, but an unverified attack is not a security result. HAWK moved from model output to consequence only after the mathematics, experiments and human review supported a real weakness. Technical validity, novelty and practical value still have to be judged separately for every proposed shortcut.

The defensible conclusion is narrower than either panic or dismissal: Mythos helped end one post-quantum candidate and improved one impractical AES challenge. Production encryption survived both tests. The next measure of progress is not how many attacks an AI proposes, but how many independent reviewers can reproduce them against systems that people actually depend on.