An AI Just Cracked HAWK-256. Read the Fine Print.

Anthropic just published something that will get read two very different ways. The headline version: an AI model found a working key-recovery attack against HAWK, a post-quantum signature scheme in NIST's standardization pipeline, and released code that recovers the signing key on a single server in under four hours. The sober version: it broke a toy parameter set of a scheme nobody has deployed, using a mathematical door that HAWK's own designers had already flagged as ajar a year earlier. Both are true, and the gap between them is the actual story.

Here's what happened, mechanically. Anthropic ran a multi-agent research harness — a Claude Code-style setup where worker agents collaborate in a sandbox with access to math software and the literature — on top of a preview of its Mythos model. Pointed at HAWK, it found a previously unexploited automorphism in the scheme's underlying lattice. Exploiting that symmetry lets you build what the paper calls a τ-cocycle lattice from the public key, then run standard lattice reduction and sieving to pull out a functionally equivalent signing key. Not the original 96-byte seed — a 592-byte decoded key that signs just as well. The full run, discovery through working exploit, took roughly 60 hours of agent time and about $100,000 in API compute. The released artifact reproduces the HAWK-256 break in about three hours and 42 minutes on a 96-core box.

What the numbers actually mean

The eye-catching figure is the work-factor drop for HAWK-256: from roughly 2⁶⁴ operations to 2³⁸. That's not a marginal shave. 2³⁸ is a laptop-over-lunch number; 2⁶⁴ is a serious-but-finite cluster job. So on that parameter set, "key recovery" is a fair description of a real, practical attack.

But HAWK-256 is a challenge parameter — a deliberately weak target researchers use to test attacks, not a set anyone would ship. The parameters that matter are HAWK-512 and HAWK-1024, and there the story is a security-margin haircut, not a break. Gate-count estimates fall from about 2¹⁵⁰ to 2¹⁰⁸ for HAWK-512 and from 2²⁸⁸ to 2¹⁸² for HAWK-1024. Both remain comprehensively infeasible to attack. The practical consequence is that HAWK would need to roughly double its key sizes to restore its claimed security level — which happens to erase most of the compactness advantage that made HAWK interesting in the first place.

That last point is the one developers should sit with. HAWK's pitch was speed and small keys with no floating-point arithmetic. Take away the size advantage and you're left with a scheme resting on younger, less-scrutinized assumptions than the alternatives, for no clear win.

The part the press releases skip

The automorphism angle wasn't conjured from nothing. In 2025, Daniël van Gent and Ludo Pulles of CWI — who are on the HAWK team — published "Having Automorphisms Weakens Key," which showed that knowledge of a nontrivial automorphism can reduce HAWK's lattice-isomorphism problem to one of roughly half the rank, quadratically speeding up key recovery. Their conclusion at the time was reassuring: with an updated hardness assumption accounting for the known symplectic automorphism, HAWK held up.

What the Mythos run contributed was the additional automorphism needed to actually walk through that door end-to-end on HAWK-256, plus the full computational pipeline to turn the theory into a running exploit. That's a meaningful extension of known work, and it's genuinely impressive — but it's extension, not revelation. The honest framing is that AI-assisted cryptanalysis found the concrete instance of a weakness class the human experts had already circled. To their credit, Anthropic had the HAWK team verify the result before disclosure, and the finding went to the NIST PQC forum simultaneously with publication.

The AES result is weaker than it sounds

Alongside HAWK, Anthropic reported a speedup on a meet-in-the-middle attack against seven-round AES-128, via a fingerprinting trick they named the Möbius Bridge that eliminates one 256-way enumeration step. It runs 200 to 800 times faster than prior work depending on how you measure. Real AES-128 is ten rounds, so this doesn't touch the cipher you actually use, and the attack needs about 2¹⁰⁵ chosen plaintexts — physically impossible. It's a nice piece of academic cryptanalysis on a reduced-round variant, nothing more. Notably, it took Claude about three days to find and two human researchers nearly a month to convince themselves it was correct, which tells you something about where the bottleneck in AI-assisted research is moving.

What to actually do about it

If you're choosing post-quantum signatures right now, nothing here changes your shortlist, and that's the point. Stick with the standardized set: ML-DSA (formerly Dilithium) as your default, SLH-DSA if you want hash-based conservatism, FN-DSA (Falcon) when you need small signatures. HAWK is a round-three additional-signatures candidate — research, not a product — and spec updates for that round are due to NIST by mid-August. No production system needs a line changed.

The durable lesson is about shelf life. "No attack has been found yet" has always been a weak security argument, and cheap, tireless AI cryptanalysis makes it weaker. A $100,000 agent run is trivial next to the cost of migrating a deployed signature scheme. That's an argument for crypto-agility — designing systems so you can swap primitives without a forklift — and for treating young schemes with novel hardness assumptions as exactly what they are: promising, unproven, and now facing reviewers that don't get tired. HAWK didn't break this week. But the process that's supposed to break it before you deploy it just got a lot faster, and that's better news for defenders than for anyone betting on security-through-under-examination.