Anthropic just gifted the cryptographic community a sneak peek at its new adversary.
This week they disclosed Claude Mythos found improved attacks against two heavily studied cryptographic designs. The first targeted HAWK, a post-quantum digital-signature candidate, which was, until yesterday, in the 3rd round of NIST’s PQC Digital Signatures process. HAWK already survived years of expert review and cryptanalysis by global math heavyweights. Working in an agentic harness, Mythos found and verified a previously unexploited symmetry in roughly 60 hours for $100K – in the IC, we’re not even talking about real money for less than $10-$100M for this type of potential exploit if this was a live standard. The attack reduced the expected work against the smallest HAWK parameter set from 2^64 to 2^68 and meant that larger HAWK keys would have to double in size to restore the intended security margin, thus largely destroying any incentive to use it. The HAWK team almost immediately withdrew their candidacy for NIST PQC standardization.
The second result improved the best-known attack on seven-round AES-128 by a factor of 200x to 800x. Mythos invented a technique it called the Möbius Bridge, then refined and tested it over several days.
Neither result breaks a production system. HAWK wasn’t deployed yet but as a NIST 3rd round candidate, it was very close to ubiquitous use worldwide. Recall this happened before with another PQC candidate SIKE just a couple years ago, but that flaw was discovered by human researchers. On the symmetric ciphers side, AES-128 uses ten rounds, and the new attack applies only to a deliberately weakened seven-round variant under impractical conditions. Those facts matter as does the trajectory of AI cryptanalysis when none of these algorithms have a verifiable proof of security. They are trustworthy until broken, not because they are intrinsically known to be hard. We’re still in the “we hope so” phase.
Anthropic reports that each line of research cost roughly $100K in API usage. The HAWK operator had a background in theoretical computer science but was not a lattice-cryptography expert. The AES work was almost entirely autonomous with the human researchers spending far more time validating the result than the model spent discovering it!! A system with no career, intuition, fatigue, or reputation to defend searched the literature, formed hypotheses, ran experiments, rejected bad ideas, coordinated multiple agents, and found publishable cryptanalysis specialists had missed, making this a very different threat model.
The Mathematical Zero Day
We know how to think about software zero-days, the undisclosed bugs in code, mostly benign, occasionally devastating: a memory error, a faulty boundary check, a bad implementation of an otherwise sound protocol. These are patched without replacing the mathematical foundation beneath the system at the core of any cybersecurity assurances.
A Mathematical Zero Day is very different because it is a previously unknown structural weakness in the algorithm itself: an exploitable symmetry, invariant, reduction, or shortcut hiding in the public specification. The implementation can be flawless and still inherits the weakness, no malformed C function to patch, none of the usual suspects of the first Mythos revelations like bug-chaining. The security assumption has changed despite the published assessments and security parameters claimed by the designers – these are not discoveries in the traditional mathematical sense. Here’s poorly recognized (acknowledged?!) fact: almost no modern cryptography has an absolute, unconditional mathematical proof of security, except the one-time pad. Previously secure can be obsolete overnight when hardness claims are entirely empirical. Even AES, still believed to be quantum-safe, has no reductions to underlying NP-hard math problems, making it 100% observational and experimental.
Cryptographers and legions of IC cryptanalysts have always searched for these weaknesses. NIST publishes candidate designs precisely so the world can attack them BEFORE they become standards. The HAWK result shows that process working. It also shows that the economics of the process have changed.
AI turns cryptanalysis into a massively parallel search problem. An agent can absorb published mathematics, generate thousands of hypotheses, write its own experimental code, enlist other agents, and keep working around the clock. Most attempts can and will fail. Failure is cheap, and a correct result is usually easy to verify once found. The asymmetry is brutal: one valid shortcut can erase years of confidence. In cryptocurrency, flawed key generation algorithms and guessing can empty your wallet. The resources for a billion wrong guessed keys per second on a laptop is nothing compared to access to a single private cryptocurrency wallet.
In this latest win, the public results are the reassuring version. Anthropic used controlled access, responsible disclosure, outside validation, and explicit safeguards. It has said Mythos Preview will not be made generally available in its current form, but that’s unfortunately meaningful for only a few months.
That restraint is good corporate conduct, but it’s not a security boundary on the global stage.
Frontier capability is already global. Epoch AI estimates that leading Chinese models have trailed the U.S. frontier by an average of seven months since 2023, with the measured gap ranging from four to fourteen months. Stanford’s 2026 AI Index reaches an even sharper conclusion: the U.S.-China performance gap has effectively closed on major model rankings, and the latest [self-serving] benchmarks prove it. Many capable Chinese models are released with open weights, allowing them to be run privately, modified, fine-tuned, and wrapped in agentic systems without an American model provider approving each request. Distillation is an industrial scale catchup technique that China has mastered and will eventually use to surpass US models. Moonshot’s Kimi K3 suggests there is no gap anymore.
If the relevant gap is measured in months, not generations. Whatever a responsible public chatbot refuses to do, a privately deployed model can be pushed to attempt elsewhere. Guardrails at Anthropic, OpenAI, or any other U.S. company cannot govern models developed and operated by foreign states, criminal groups, private laboratories, or anonymous open-source teams. US companies cannot train on stolen IP and data, they can’t run millions of fake accounts to distill competitor AI and so on. Adversary AI will win on that front because these legalities are not a barrier and costly lawsuits are a non-issue.
A serious security plan must assume intelligence services will use that advantage. They can combine frontier models with specialized cryptographic tools, classified research, intercepted data, and industrial-scale compute. If they find a useful attack, they will protect the source and method for as long as possible while quietly exploiting the access. Sure, perhaps foreign intelligence services will decline to turn thousands of unrestrained agents loose on global cryptographic standards because they have better things to do? Perhaps they will disclose a successful break instead of using it? Neither of these delusions belong in a national-security plan.
The 1970s Architecture Beneath Modern Networks
The larger problem is structural. We built cloud-scale infrastructure on a cryptographic model inherited from point-to-point telecommunications:
- Two endpoints connect.
- They authenticate and negotiate a small set of cryptographic mechanisms.
- A key-establishment algorithm protects the secret used for the session.
The session relies on those mechanisms until it ends. Modern protocols use several algorithms for different functions, including signatures, key establishment, hashing, and symmetric encryption. Yet each function can still depend on one dominant mathematical assumption. If that assumption fails, the control plane, identity layer, or confidentiality of the channel can fail with it.
Replacing RSA and elliptic-curve key establishment with ML-KEM, and classical signatures with ML-DSA or SLH-DSA, is mandatory. Treating that substitution as the finish line simply moves the concentration risk. An enterprise can complete a flawless PQC migration and still be one Mathematical Zero Day away from an emergency replacement program across every application, appliance, cloud service, certificate chain, and embedded device that adopted the same primitive.
Crypto-agility matters, but it isn’t enough, at all. Systems need accurate cryptographic inventories, tested replacement paths, policy-controlled algorithm changes, and the ability to run hybrid schemes during transitions. But agility is still a recovery mechanism. It reduces the time required to escape a broken primitive after the weakness becomes known. Any harvested data will be exploited and the same collection will continue with the new one. An undisclosed break creates a harder problem. You cannot rotate away from a weakness you do not know exists.
Build for Failure Before It’s Public
Long-term resilience requires architecture that assumes algorithms will age, implementations will fail, and adversaries will learn things they do not publish. For high-value systems, that means reducing the blast radius of any one cryptographic failure:
– Use cryptographic diversity where independent mechanisms can fail separately, rather than stacking several products on the same mathematical assumption.
– Separate identity, key establishment, data encryption, and policy control so one failure does not silently compromise all four.
– Generate short-lived encryption keys at the endpoints and keep them separate from the data they protect.
– Eliminate routine key transmission wherever the architecture allows it.
– Distribute entropy and trust across independent systems, clouds, and administrative domains.
– Segment data so a successful break does not unlock an enterprise-wide historical archive.
– Exercise algorithm replacement under operational conditions before an emergency forces the issue.
These are our core tenents and where Qrypt’s architecture departs from the conventional handshake. BLAST uses distributed quantum entropy so communicating endpoints can independently derive the same symmetric encryption keys on demand. The encryption keys are created locally and are never transmitted with, or separately from, the encrypted data. The entropy service is isolated from the application and cannot reproduce the final keys generated at the endpoints, nullifying the most commonly exploited HNDL collection platforms.
PQC still has an important role in the surrounding system, including authentication and secure coordination. The architectural difference is that the long-lived value of the data does not rest entirely on the durability of one public-key algorithm. Breaking a signature scheme, compromising a key-establishment primitive, or capturing network traffic should not automatically reveal every protected payload. No architecture makes mathematics irrelevant, but it can stop one mathematical failure from becoming a universal failure.
The Transition Has Already Started
The HAWK is proof that cryptanalysis has changed without saying anything about the larger PQC efforts towards standardization. In one year, according to Anthropic, language models progressed from struggling with elementary cryptanalysis to producing expert-level results against designs survived sustained elite human review. The next models will have longer reasoning horizons, better tools, more agents, and cheaper compute. Less restrained versions will appear abroad.
Security leaders should continue the PQC migration, but they should ask a harder question while doing it: if the algorithm chosen today develops a Mathematical Zero Day tomorrow, what else prevents the data from falling with it? If the answer is “we will patch and rotate,” the architecture still depends on learning about the attack before the adversary can exploit it. That’s a very bad bet. Any harvested data is immediately operationalized by the adversary when disclosed to great fanfare at BlackHat and other forums every year.
History is our guide and reason tells us to expect no courtesy notifications. Intelligence services do not announce their best access and will protect it at all costs, even human lives. Criminals do not disclose a profitable technique for the greater good. Models do not need consensus before they begin searching.
The era of Mathematical Zero Days has arrived. The defensible response is to remove single points of cryptographic failure before one of them fails in secret.
