That ratio comes from the vendor, not from a critic, which is what makes it usable. We hit the small version of it in our own delivery work: once we put ten coding agents on a codebase, the constraint stopped being how fast they wrote diffs and became how fast a human could review them. Cryptography is that shape with the dial turned up.
What Anthropic published on 28 July 2026
On HAWK, Claude Mythos Preview found a previously unexploited symmetry in the lattice the scheme is built on, halving its effective keysize. The expected cost of a full key-recovery attack on HAWK-256 drops from 2^64 to 2^38, and the paper ships with demonstration code (HAWK paper). Finding, developing and verifying it took about 60 hours; HAWK had survived two rounds of expert review over two years (Anthropic). Doubling the key size restores security but removes much of what made the scheme attractive.
On AES, Mythos attacked a 7-round variant of AES-128 and invented a fingerprinting technique it named the "Möbius Bridge", eliminating one of the 256-value guesses the previous best meet-in-the-middle attack had to enumerate. It runs 200 to 800 times faster (AES paper). Anthropic also released the model's chain of thought (transcript) and a public repository with the demonstration code (GitHub).
Alongside both sits CryptanalysisBench, a 191-task benchmark across six families of cryptographic primitives, drawn mainly from four NIST standardization efforts and built with ETH Zurich, Tel Aviv University and the University of Haifa (arXiv). On its easier first tier, five models solved 65% to 86% of the schemes (The Hacker News).
What these results do not mean
Anthropic states the limit plainly: neither finding has practical impact on deployed systems (Anthropic), which independent coverage confirms (The Decoder). The signature attack stays exponential and is specific to that one scheme, not to lattice-based cryptography in general (The Next Web). The AES work it improves on assumes an attacker can request 2^105 chosen plaintexts — a research assumption, not an operational one. NIST still listed HAWK as a third-round candidate on 29 July 2026 (The Hacker News).
Disclosure went the way you would want: HAWK's designers were notified in June, public release was coordinated with a NIST mailing list, and government and industry partners were briefed in advance (CyberScoop).
Verification took longer than discovery
Two details make the ratio worse than it reads. The researchers spent several hundred hours learning enough cryptography to validate the claim at all, and Anthropic says most of its team's time over the preceding months went into verifying model output rather than producing more of it (Anthropic). Each main result cost roughly $100,000 in API spend (William Ogou) — money that buys the artefact, not confidence in it.
The control sits inside the same publication. The HAWK attack runs end-to-end, so it can be checked by executing it, and Anthropic says it was much easier to verify for that reason; the same holds for a separate 13-round LEA attack that recovers a key in under an hour on a desktop. The AES result is a mathematical argument, so people had to check it. Same model, same team — an order-of-magnitude difference in review cost, driven entirely by whether the output could verify itself (Simon Willison).
What this means for you
Cost the review line separately. If a model produces a result for $100,000 in tokens and validation takes two qualified people a month, the token bill is the small half of the invoice — review, not generation, is the ceiling.
Prefer self-verifying output. The HAWK-versus-AES split is a design instruction: shape the task so the answer arrives with an executable check attached — tests that run, an attack that recovers a key, a migration that either applies or does not. That is the argument for putting validation gates inside the system that produces the work.
Read the artefact, not the headline. Anthropic released both papers, the transcript and a runnable repository; most coverage ran on the summary. The same discipline pays in procurement, where the licence rather than the benchmark table decides what you may do, and in incident response, where the disclosure document rather than the press release carries the detail.
If post-quantum migration is on your roadmap, the takeaway is narrow: a candidate lost half its effective key strength late in standardization, which is that process working. Review capacity is the scarce resource, and building it into an AI workflow is what our AI agent development work is for.
Frequently asked questions
Did Claude break AES? No. The attack works on a 7-round variant of AES-128, which ships with 10 rounds, and does not extend to the full cipher. No production software has to change as a result (Anthropic).
Is HAWK now unsafe to use? HAWK is a third-round NIST candidate, not a deployed standard. The attack halves its effective keysize — HAWK-256 drops from 2^64 to 2^38 — so larger keys stay impractical to attack, though doubling them removes much of the scheme's appeal (HAWK paper).
How long did the research take? About 60 hours to find, develop and verify the HAWK attack. The AES attack took one week to discover and nearly a month for two researchers to validate (Anthropic).
What did it cost? Roughly $100,000 in API spend per main result, excluding human validation time (William Ogou).
Sources
- Anthropic research post (2026-07-28)
- HAWK key-recovery paper (2026-07-28)
- AES Möbius Bridge paper (2026-07-28)
- Chain-of-thought transcript (2026-07-28)
- CryptanalysisBench, arXiv (2026-07-20)
- Demonstration repository, GitHub (2026-07-28)
- CyberScoop (2026-07-28)
- The Decoder (2026-07-28)
- The Next Web (2026-07-28)
- Simon Willison (2026-07-28)
- The Hacker News (2026-07-29)
- William Ogou (2026-07-29)