Anthropic says Claude Mythos Preview helped uncover new weaknesses in advanced cryptographic systems, including a post-quantum candidate that had already survived years of expert review—showing AI is beginning to perform security research once reserved for specialists.
WHAT’S HAPPENING
Anthropic researchers used Claude Mythos Preview to develop improved attacks against two advanced cryptographic systems.
The first targeted HAWK, a digital-signature system being evaluated as a possible post-quantum cryptography standard. HAWK had survived two rounds of expert human review over roughly two years, but Claude helped researchers improve the best-known attack against it in about 60 hours, substantially reducing its effective security strength. (Anthropic)
Claude also developed an improved attack against a reduced-round version of AES, one of the world’s most widely used encryption standards. The AI-generated approach improved the speed of previous attacks by roughly 200 to 800 times. (Anthropic)
Importantly, Claude did not break the full AES encryption used in real-world systems. The research targeted a deliberately weakened seven-round version of AES-128, which normally uses 10 rounds. Neither discovery currently affects production systems. (Anthropic)
WHY IT MATTERS
Cryptography protects everything from online banking and email to websites and private communications.
Historically, finding mathematical weaknesses in sophisticated cryptographic algorithms has required highly specialized human researchers and extended peer review.
Claude’s results suggest frontier AI models may increasingly be able to participate directly in that research—reviewing technical literature, generating hypotheses, performing experiments and identifying weaknesses that humans have not previously found.
That could strengthen cybersecurity by allowing researchers to test new encryption systems more aggressively before they are widely deployed.
It also raises a harder question: What happens when AI eventually discovers a serious weakness in a cryptographic system that is already protecting millions or billions of people?
WHO BENEFITS
Cryptography researchers could gain an additional tool for stress-testing new algorithms.
Governments and standards organizations could use advanced AI to scrutinize proposed security standards before approving them.
Technology companies and consumers could ultimately benefit if AI helps expose weaknesses before attackers discover them.
Anthropic has also worked with researchers from ETH Zurich, Tel Aviv University and TU Berlin to create CryptanalysisBench, designed to measure how well large language models perform cryptanalysis. (Anthropic)
WHO LOSES
Cryptographic systems containing undiscovered weaknesses could face far more intensive scrutiny as AI dramatically increases the amount of research that can be performed.
There is also a potential defensive challenge.
If AI becomes increasingly capable of discovering cryptographic weaknesses, organizations may need faster systems for validating discoveries, coordinating disclosures and fixing vulnerabilities before the same capabilities become widely accessible.
For now, Anthropic says it followed responsible-disclosure procedures and consulted academics, government officials and industry partners before releasing the findings. (Anthropic)
WHAT HAPPENS NEXT
The immediate story isn’t that Claude has broken modern encryption.
It hasn’t.
The bigger development is that AI appears to be moving from helping researchers understand existing security research toward actually producing new cryptographic research.
Anthropic says most of the work was performed with limited human intervention, while researchers spent significant time afterward validating Claude’s findings. (Anthropic)
If that capability continues improving, AI could become a powerful new tool for finding weaknesses before cryptographic systems are deployed.
But the same progression could eventually force governments, researchers and technology companies to confront a much more difficult problem:
What do you do when an AI discovers a vulnerability in encryption the world is already using?
