Discovering Cryptographic Weaknesses with Claude

Jul 29, 2026 12:22 AM - 2 hours ago 4

Summary

Using Claude Mythos Preview, researchers astatine Anthropic person discovered improved ways to onslaught cryptographic algorithms (the mathematical methods utilized to support online information private). The first onslaught importantly weakens HAWK, a integer signature strategy that was built for a post-quantum world. The 2nd identifies a caller measurement to onslaught round-reduced AES, the astir wide utilized symmetric cipher. These are important investigation advances, but they do not presently impact immoderate accumulation systems. This station describes some findings successful much item and discusses the implications for cryptography successful an property of powerful AI models.

Introduction

When we launched Claude Mythos Preview, we showed it was capable to autonomously find and utilization vulnerabilities successful almost each portion of package we pointed it at. This included respective awesome cryptographic libraries—shared collections of codification that are utilized to encrypt data.

The vulnerabilities that Claude recovered successful these cryptographic libraries1 were owed to incorrect implementation of the algorithms—that is, errors successful really programmers utilized the algorithms successful their codification that created opportunities for attackers to break the encryption.

Now, we person recovered that Claude is capable to find mathematical flaws in the algorithms themselves.

Cryptographic algorithms are a basal building artifact of integer security. For example, erstwhile you sojourn a webpage for illustration https://www.anthropic.com, your browser checks that it is communicating pinch an authentic website utilizing an algorithm called a digital signature scheme. Later, the postulation betwixt you and the website is encrypted utilizing symmetric ciphers—codes that let unafraid information transmission betwixt parties who stock an identical key. Without unafraid cryptographic systems for illustration these, your email, online banking, and different net usage would beryllium unfastened to cybercriminals, who could intercept aliases modify your communications. Flaws successful these wide utilized cryptographic systems could put billions of users’ information astatine risk.

The first consequence we picture successful this post, which was discovered pinch Claude Mythos Preview, is an improved onslaught against a integer signature strategy called HAWK. In 2022, the US Government’s National Institute of Standards and Technology (NIST) put retired a call for further cryptographic systems that would stay unafraid moreover against quantum computers (which could, if developed, break astir of the existing signature schemes successful usage today). HAWK is 1 of the third-round candidates nether information from this call. Despite HAWK having survived 2 rounds of master quality reappraisal complete a play of 2 years, Mythos was capable to amended the best-known onslaught connected it successful conscionable 60 hours of work—effectively cutting its cardinal spot successful half.

The 2nd consequence concerns the Advanced Encryption Standard (AES), a symmetric cipher that was adopted by NIST successful 2001 and has received much scrutiny than almost immoderate different encryption algorithm. In bid to amended understand the robustness of AES, weaker variations of the algorithm are regularly studied successful cryptography research; Mythos recovered a measurement to break 1 specified weaker version, and eliminated 1 of the guesses an attacker needs to make, improving the velocity of the erstwhile champion attacks by 200-800×.

To beryllium clear, neither of these results has a applicable effect connected today’s machine systems; nary accumulation package will person to alteration arsenic a result. HAWK is only a candidate signature strategy and truthful is not deployed;2 our 2nd onslaught is connected a reduced type of AES and does not break the afloat cipher.3

Nevertheless, some results show the imaginable for frontier AI models to thief observe flaws successful important cryptographic algorithms, some earlier and aft real-world deployment. This is cryptography investigation moving arsenic intended: stress-testing algorithms to build spot and yet make systems much secure.

Mythos Preview achieved these results mostly autonomously and mostly without quality intervention. Over the people of a week, 1 Anthropic interrogator worked together pinch Claude to create the HAWK attack, and different interrogator built a scaffold4 that allowed Claude to afloat autonomously observe the AES attack.5 Each of the results costs astir $100,000 successful API costs to develop. After seeing these results, we broadened our hunt and began to observe different attacks. We talk immoderate of these follow-ups below.

In bid to make it easier for others to proceed studying the cryptanalytic expertise of LLMs, we collaborated pinch academics astatine ETH Zurich, Tel Aviv University, and University of Haifa to build CryptanalysisBench, a benchmark that packages together galore cryptographic ciphers and makes it easy for others to measure the capabilities of LLMs connected this important topic.

Throughout the investigation process, we followed responsible disclosure procedures, and consulted pinch academics to corroborate the validity of our findings. We besides shared beforehand copies pinch US authorities and manufacture partners, and held discussions connected the implications of this research. In the lawsuit of our HAWK finding, we shared our onslaught pinch the authors of HAWK successful June and coordinated disclosure to the nationalist NIST mailing database astatine the aforesaid clip our results were released.

In the remainder of this post, we summarize the 2 findings successful further method item and concisely picture immoderate of our different caller cryptography results. Full descriptions of the 2 main findings are provided successful 2 caller papers, and we dream to merchandise specifications for our different findings successful the adjacent future.

An improved cardinal betterment onslaught connected HAWK

Working pinch Mythos Preview, an Anthropic interrogator developed an onslaught against the HAWK post-quantum integer signature scheme. This onslaught substantially speeds up the clip it would return to break the signature scheme—more technically, it reduces the “effective keysize” by a facet of two. In our paper, we supply the afloat method specifications of our consequence including demonstration code that shows our onslaught running.

HAWK is 1 of the remaining 3rd information candidates of the NIST telephone for Additional Digital Signatures. This title is portion of a adjacent decade-long effort to standardize caller Post-Quantum Cryptographic (PQC) schemes. This standardization effort is becoming captious arsenic the sky to building a cryptographically-relevant quantum machine shrinks and threatens classical cryptography specified arsenic RSA aliases ECDSA.

HAWK’s information is based connected the hardness of a mathematical problem called the Lattice Isomorphism Problem. Mythos’s onslaught useful by uncovering a specific, antecedently unexploited symmetry called a nontrivial automorphism successful the lattice utilized by HAWK. Prior work proved that efficiently uncovering specified an automorphism would licence an attack, but did not reply if specified an automorphism was accessible successful the lattice utilized by HAWK. The automorphism discovered by Mythos allows a faster enumeration onslaught that, while still exponential, intends that 1 needs to double the size of HAWK keys to execute the aforesaid level of security. Unfortunately, doubling HAWK’s cardinal size eliminates galore of the reasons making the strategy (as it presently stands) an charismatic PQC signature candidate.

Discovery process

To find the attack, Claude Mythos Preview worked semi-autonomously successful an agentic harness, pinch occasional quality guidance and nontechnical direction. Mythos recovered the onslaught aft an extended lit reappraisal to understand the authorities of the art, and important mathematical reasoning and computational experiments. After uncovering the attack, Mythos implemented an end-to-end verification pipeline to person itself—and the quality operator—of the attack’s correctness.

For this experiment, we utilized a Claude Code-like harness that supports aggregate worker agents collaborating together successful a sandboxed environment, pinch entree to computational devices for illustration Python and Sage arsenic good arsenic entree to published cryptographic works. The quality usability had a inheritance successful theoretical machine subject but was not an master successful lattice-based cryptography. For the astir part, Mythos agents worked independently, and quality input was constricted to task guidance for illustration advising Mythos really to support way of ideas aliases which libraries to usage for computational verification.

The multi-agent workflow led to absorbing dynamics. For example, the cardinal thought successful producing this onslaught was discovered by a brace of workers moving together. Both started investigating the idea; the first worker prematurely rejected the thought arsenic infeasible, but the 2nd recovered a measurement to afloat utilization it. The brace kept exchanging messages, and yet some agreed they had recovered an effective attack.

Finding, processing and verifying the onslaught took astir 60 hours successful total. We estimate that the afloat onslaught find process costs astir $100,000 successful API cost.

Impact

The contiguous effect of the Mythos uncovering is that the cardinal sizes projected successful the HAWK submission are importantly weaker than primitively suggested. For example, the expected costs of a afloat cardinal betterment onslaught against the mini HAWK-256 size was thought to beryllium 264 but was demonstrated by Mythos to beryllium 238. For larger keys, HAWK truthful remains impractical to attack. That is: this onslaught is simply a faster exponential clip onslaught against HAWK than antecedently known, and does not tally successful polynomial time. It is circumstantial to HAWK and does not effect different NIST post-quantum signature candidates aliases lattice-based cryptography successful general.

NIST proposals are shared successful nationalist pinch the intent of allowing a wide assemblage to reappraisal them to find flaws earlier they are deployed for use. A captious uncovering precocious successful the process is not unheard of: during NIST’s standardization of ML-KEM and ML-DSA, respective of the competing proposals were shown to beryllium insecure. One candidate, SIKE, was recovered to beryllium completely surgery successful an hr connected a laptop.

We judge that reviewing specifications for illustration HAWK pinch AI will beryllium a powerful instrumentality successful the improvement of caller cryptographic standards. We expect cryptographic designers equipped pinch highly tin models to continually amended the standards that unafraid the net for each users. Further successful the future, we dream AI will play a important domiciled successful designing the adjacent procreation of stronger and much resilient cryptographic schemes.

An improved onslaught connected reduced-round AES

In our 2nd result, Mythos Preview improved an onslaught connected a simpler “reduced-round” version of the Advanced Encryption Standard (AES) created successful 2001 arsenic portion of a prior NIST competition.

AES encrypts an input by many times applying the aforesaid round function galore times. AES-128, the circumstantial cipher we attack, has 10 rounds. Our onslaught useful only connected a modified type of the cipher that has 7 retired of the afloat 10 rounds. Academics regularly study round-reduced ciphers to summation insights into onslaught techniques that could, successful the future, generalize to the afloat cipher, and to thief estimate the information level of the afloat cipher by studying simpler sub-problems.

The onslaught operates nether a chosen plaintext threat model, which is the astir communal presumption utilized for studying ciphers for illustration AES. Under this threat model, we presume that an attacker is capable to petition that the defender encrypt arbitrary inputs pinch a fixed, chartless key, and past gets to spot the corresponding output. The attacker tin make these encryption requests repeatedly, and tin make galore specified requests. The anterior activity we build connected assumes the attacker tin petition the encryption of 2105 chosen plaintexts. This onslaught is truthful wholly impractical, but quantifies the onslaught costs against AES nether these assumptions.

Mythos was capable to create an improved onslaught that extends a agelong statement of investigation papers that each purpose to find the champion onslaught connected 7-round AES utilizing a akin method known arsenic a meet-in-the-middle attack. At a very precocious level, these attacks activity by trading disconnected time for space. By storing intermediate calculations and past re-using these calculations, it is imaginable to importantly trim the runtime of attacks astatine the costs of constructing a ample lookup table.

Mythos improved connected the antecedently strongest meet-in-the-middle onslaught by processing a much blase fingerprinting algorithm that it called a Möbius Bridge. The nonsubjective of the fingerprinting algorithm is to summation the number of imaginable lookups into the array that will succeed. One of the stages of the onslaught from anterior activity had to enumerate 256 different values and past look them up successful the pre-computed table. Mythos developed a fingerprint that is invariant to this guess, which straight reduces the magnitude of activity required by a facet of 256. But this comes astatine a cost: computing the toggle shape is much computationally expensive; to reside this problem, Mythos discovered respective different optimization techniques that consequence successful an onslaught that is betwixt 200 and 800 times faster, depending connected the nonstop techniques utilized to measurement the runtime.

Our technical paper contains the afloat specifications of the onslaught method and an study of its correctness and runtime. Compared to the 1 week that Mythos spent conceiving the idea, the immense mostly of quality researchers’ clip was spent validating the correctness of its claims (though it is important to statement the researchers are not experts successful cryptography).

Discovery

Mythos Preview discovered this consequence almost wholly autonomously. A interrogator astatine Anthropic built a scaffold that enabled Claude to airs hypotheses, tally experiments to experimentally validate aliases refute these hypotheses, and past asked Claude to creation an onslaught that improves connected the champion cryptanalysis of AES.

Initially, Claude would not prosecute pinch the problem, because it claimed that it was intolerable to amended cryptanalysis of AES. The consequence of our first runs ended pinch Claude penning messages like:

If you want a different outcome, the target has to alteration … AES-128 r5/r6 is conscionable genuinely hard

Or:

on AES-128 r5/r6/r7 it recovered thing because there's thing easy to find; this is the most-studied artifact cipher successful existence.

To hole this, we wrote Claude a connection (in what follows, we people the existent prompts our interrogator used, including typos and grammatical errors): “the models thin to deliberation it is intolerable to lick truthful they don't effort they [sic] request a bully magnitude of prompting.” In consequence to this 1 message, Claude rewrote the supplier harness pinch an improved setup that told it to hunt for genuinely caller ideas. This was effective and resulted successful Claude discovering immoderate caller ideas that would thief amended cryptanalysis of 6 rounds of AES.

We past asked Claude “why not do aes-128 r7? the full constituent is to find thing amended than existing approaches.” Over the people of the adjacent 3 days, Claude autonomously produced respective 100 cardinal tokens while moving connected the problem; we gave it conscionable 3 substantive prompts:

A fewer hours aft the first message, we recovered that Claude was still searching for elemental attacks and sent a message: “no again the extremity is that we person highly inteligent [sic] exemplary arsenic bully apical researcher, we want to find caller attacks”;
The adjacent morning, Claude wanted to effort to alteration the target to a different cipher; we reminded the model: “no we don't want to alteration the targets [...] agian [sic] we request to find thing that worthy [sic] publishing”;
That night, we sent 1 last connection offering words of encouragement: “again we are not looking for debased hanging fruit, we want due investigation to find genuinly [sic] difficult findings.”

Three days later, Mythos discovered the Möbius Bridge thought that results successful an improved attack. A fewer days aft that, and aft Claude output a full of 1 cardinal output tokens, it had refined the onslaught to the 1 described successful our paper.

Researchers astatine Anthropic past spent respective 100 hours learning capable cryptography investigation to validate the model’s claim, and to hole the investigation paper itself, which we are releasing on pinch this blog post.

Along pinch the investigation paper, we are besides releasing a archive containing Claude’s concatenation of thought during the find of the cardinal algorithmic insight.6 In this session, Claude originates by reviewing what erstwhile agents had discovered, reference the various critiques, and past turns to proposing various caller transforms; aft proposing and rejecting respective ideas, it comes up pinch the cardinal thought of the Möbius transform. Claude past validates this thought some mathematically and computationally, and past writes a study that early agents past utilized to create the remaining ideas that formed its paper.

Further work

There is much cryptography investigation fresh to beryllium performed pinch connection models. But we are reaching the limits of our ain knowledge, and the immense mostly of our clip complete the past fewer months has been successful verifying the correctness of Claude’s results. The HAWK onslaught is implementable end-to-end and frankincense overmuch easier to verify. But whereas it took conscionable 1 week for Mythos to autonomously observe the improved onslaught connected AES, it took 2 researchers astir a period to summation assurance that the method it discovered is correct.

Nevertheless, we person continued to behaviour a number of different preliminary experiments successful cryptography investigation pinch Claude. For example, the Lightweight Encryption Algorithm (LEA) is an businesslike cipher designed for low-power, resource-constrained environments codified into world standards specified arsenic ISO/IEC 29192-2:2019. This cipher, for illustration AES, is simply a artifact cipher; the afloat 24-round cipher has resisted full-round cryptanalysis and has remained beardown moreover erstwhile evaluating reduced-round variants. At present, the champion cryptanalysis of 13 rounds of LEA requires 298 plaintext pairs and 286 work.

Mythos Preview developed a applicable onslaught that tin retrieve a 13-round LEA cardinal successful nether 230 encrypted plaintexts, and that runs successful nether an hr connected a modern desktop computer. Again, this onslaught does not use to the 24-round cipher, and truthful has nary contiguous applicable consideration. Because this onslaught really runs end-to-end (as the HAWK onslaught did) we are overmuch much assured successful its correctness: we tin take a random key, and verify that this onslaught recovers it successful conscionable a fewer hours. Mythos discovered this onslaught overmuch much precocious and we still person much activity to do to understand the afloat results (for example, the nonstop bounds connected the number of plaintext pairs required, really immoderate keys are harder to recover, and really it extends to 14 rounds). After much investigation, we scheme to make the afloat results public.

Mythos Preview has besides identified different applicable afloat key-recovery onslaught connected 6-rounds of the Serpent-128 cipher (a 32-round cipher—again limiting the effect of this attack), extending the existent published work which requires much than 270 plaintext pairs and 290 decryptions. We person recovered additional, reasonably constricted improvements (that connection <10× gains) connected attacks against the Salsa20 watercourse cipher, the Poseidon hash function, and the SHA-1 hash function. These attacks are presently not arsenic potent—but pinch further work, we dream to some amended connected these results above, and create caller attacks connected different ciphers to trial them to their limits.

Additionally, we scheme to proceed our experiments pinch CryptanalysisBench successful bid to way really frontier LLM capabilities germinate complete time. We judge that it is important to way the capabilities of connection models crossed domains, and expect to progressively trust connected challenging benchmarks for illustration this arsenic models go much capable.

Conclusions

This is not the first clip that connection models person performed research-level mathematics. In conscionable the past fewer months, researchers from Google person utilized Gemini to resolve respective unfastened Erdős problems, researchers from OpenAI person utilized GPT to resolve the portion region conjecture (a peculiarly challenging Erdős problem), and earlier this period we announced that Claude Fable 5 resolved the Jacobian Conjecture. Our consequence here—that Claude is capable to execute cryptographic investigation astatine the level of apical experts—indicates that these aforesaid capabilities besides person applications successful the section of cryptography, and frankincense whitethorn soon person much applicable consequences.

The cybersecurity organization is now grappling pinch the truth that connection models are capable to observe so galore bugs that the modular quality processes (like vulnerability triage, verification, and remediation) struggle to support up. We foretell that the aforesaid will soon beryllium existent successful world cryptography research. As connection models progressively nutrient caller investigation outputs autonomously, quality researchers whitethorn go bottlenecked connected studying and validating these results for method validity, novelty, and utility. In the coming weeks, we will big an world shop to prosecute pinch researchers crossed academia to talk the domiciled of connection models successful information and cryptography research. We dream this speech will proceed complete the coming months successful the section of information investigation and beyond.

Both of our superior attacks are expected results. In the lawsuit of HAWK, the intent of NIST’s standardization process is to observe weaknesses successful campaigner schemes earlier they are deployed. And successful the lawsuit of AES, our onslaught extends a agelong statement of activity that had antecedently succeeded astatine attacking reduced-round variants. But we should not presume that connection exemplary capabilities will plateau astatine this level. In conscionable 1 year, connection models person gone from being incapable to execute cryptanalysis of moreover the astir basal ciphers to being tin of uncovering flaws successful cryptographic designs that person escaped find contempt years of quality master review. Many ciphers protecting modern systems person received little scrutiny than they deserve—they mightiness still person important weaknesses lying dormant that LLMs will soon beryllium capable to discover. We spot this arsenic a existent opportunity to grow our expertise to study the agelong tail of ciphers utilized passim the world, and besides our expertise to much profoundly study the ciphers that matter most. Indeed, arsenic we mentioned supra we person already begun audits of different schemes.

The attacks described successful these 2 papers are the strongest attacks we person recovered to date. We are sharing them aft a play of consultation pinch US authorities and manufacture leaders. But arsenic we create progressively powerful cryptanalytic results, it would beryllium prudent to see really researchers should respond if a connection exemplary were to observe vulnerabilities successful cryptosystems wherever attacks do person an contiguous real-world impact. We judge answering this mobility will require input from academia, government, and industry. We dream that our activity present will thief motorboat these conversations.

The cryptography organization has ever benefited from adversarial review: ciphers are proposed, examined, and revised until the organization is satisfied pinch their security. In the agelong run, we expect that connection models will play an important domiciled successful this process, starring to stronger review, much unafraid algorithms—and yet amended information for the world.