AI Broke a Post-Quantum Candidate, Not Your Encryption

When Anthropic announced in late July that Claude had found genuine cryptanalytic attacks — and a NIST post-quantum signature candidate was withdrawn within a day — the headline wave was predictable: AI is coming for encryption. JP Aumasson, the cryptographer behind BLAKE3 and SipHash, pushed back with a post arguing LLMs won't break symmetric crypto. He's right. But the reassurance isn't the interesting part. The interesting part is that Anthropic's two results point in opposite directions, and the gap between them is a usable map of where machine cryptanalysis goes next.

Two results, opposite lessons

First result: Claude Mythos Preview found a previously unexploited symmetry — a nontrivial automorphism — in the lattice underlying HAWK, a signature scheme in the third round of NIST's additional post-quantum signatures process. Estimated key-recovery cost dropped from 2^64 to 2^38 for HAWK-256, where Anthropic recovered actual signing material end to end, and from 2^150 to 2^108 for HAWK-512. The model ran about 60 hours in a multi-agent harness, roughly $100,000 in API spend, with a human supplying project management but no lattice expertise. The HAWK team confirmed the finding within 24 hours and withdrew the scheme.

Second result: the model devised a technique it named the Möbius Bridge that speeds up a known meet-in-the-middle attack on 7-round AES-128 by a factor of 200 to 800. Sounds dramatic; isn't. As Matthew Green notes in his analysis, the improved attack still needs around 2^89 operations and 2^105 chosen plaintexts — a quantity of data no attacker could ever collect — and it says nothing about the full 10-round cipher. Verifying the math took two human researchers about a month, several times longer than the discovery run itself.

One result killed a scheme. The other nudged a number in a table of attacks that were already impractical. That asymmetry is the whole story.

Symmetric ciphers starve the model

Aumasson's case for why AES, ChaCha, SHA-3, and BLAKE3 are safe comes down to structure — specifically, the deliberate absence of it. Public-key cryptography needs algebraic structure to work at all; a trapdoor is structure. Symmetric designs want the opposite, and they get it by mixing operations that are mutually hostile: XOR destroys linearity with respect to modular addition, and modular addition destroys it with respect to XOR. There is no elegant hidden object inside AES for a model to notice, because designers have spent five decades making sure of that. The NSA quietly hardened DES's S-boxes against differential cryptanalysis in the mid-1970s, fifteen years before the technique was publicly discovered. This vein has been mined for a long time, by people who knew exactly what they were looking for.

That's why the symmetric frontier looks the way it does. Nearly every modern attack is some flavor of differential cryptanalysis, and progress is measured in fractional bits: the best single-key result against full AES-128 — the 2011 biclique attack — costs about 2^126, a factor-of-four win over brute force after a decade of world-class effort. Machine learning's previous contribution was Aron Gohr's 2019 work using deep learning to sharpen distinguishers on Speck32/64, a toy cipher. Claude's AES result fits the same curve: genuinely clever, genuinely marginal. When the target has no structure to exploit, intelligence buys very little. A search over 2^128 keys doesn't care how smart you are.

Post-quantum is the soft target

HAWK is the opposite case, and the uncomfortable detail — Green calls it embarrassing for the field — is that Claude didn't invent new mathematics. It applied known lattice techniques more thoroughly than humans had managed in three years of NIST review. HAWK rests on the lattice isomorphism problem, a young assumption with a thin scrutiny history compared to the LWE-family problems under ML-KEM and ML-DSA — which is precisely why the attack doesn't transfer to them. Young, algebraically rich, lightly reviewed: that's the profile of most of the post-quantum long tail, and it's fertile ground for a system that can grind through the entire attack literature without getting bored or needing tenure.

So the honest reading of the announcement isn't "AI breaks encryption." It's "AI compresses the scrutiny timeline." The HAWK weakness was always findable by humans; nobody had gotten to it. Now there's a tireless $100k-per-run reviewer that will get to it — and to every other lightly-studied scheme. Un-broken no longer means what it meant in June.

What this changes for you

Nothing about your AES-256-GCM or ChaCha20-Poly1305 deployments. If a vendor pitches "AI-resistant encryption" in the wake of this news, close the tab — the primitives were never the exposed surface, and your actual crypto risk remains what it was last month: nonce reuse, timing leaks, bad randomness, and hand-rolled protocol glue. LLMs are far more likely to find (and, if you're careless, to write) those bugs than to dent a cipher.

The real signal is for post-quantum migration plans. HAWK's 24-hour collapse is the standardization process working as designed — candidates exist to be shot at — but it sharpens two decisions. Stick to the boring winners: ML-KEM, ML-DSA, and SLH-DSA are standardized, LWE- and hash-based, and carry the deepest review history in the field. And treat hybrids as vindicated: X25519MLKEM768-style deployments in TLS exist exactly to hedge against young math failing, and the young math just failed on schedule. If your roadmap included an exotic non-standardized scheme because the benchmarks looked nice, this is the moment to quietly delete that line.

The bottleneck to watch is verification. Anthropic's AES result took a month of expert human checking for a week of model output, and Green argues results like these will increasingly need machine-checkable proofs before anyone should trust them. If model-driven cryptanalysis scales the way this announcement suggests, the scarce resource stops being attack ideas and becomes qualified humans — or Lean proofs — to validate them. That's a genuine shift in how the field works. It's just not a threat to your TLS config.