Cybersecurity

A NIST Candidate Lost Half Its Security in 60 Hours

Anthropic says Claude improved the best known attack on HAWK, a NIST post-quantum candidate, in about 60 hours. What it changes for your migration plan.

CybersecurityBy Servola Tech Desk2026-07-284 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

A NIST Candidate Lost Half Its Security in 60 Hours

Sixty hours against two years of review

On 27 July Anthropic published the results of a research run in which its Claude Mythos Preview model was pointed at HAWK, a post-quantum digital signature scheme sitting in the third round of NIST's search for additional signature algorithms. HAWK had been public for two years and had survived two full rounds of expert cryptanalysis without anyone finding a better attack. Claude found one in roughly 60 hours.

The numbers are specific. For HAWK-256 the expected cost of a key-recovery attack falls from 2^64 to 2^38 operations, because Claude identified a symmetry in the lattice structure that no reviewer had exploited. Anthropic puts the bill at roughly 100,000 dollars, about 74,000 pounds, in API charges, and says one of its researchers worked alongside the model across a single week to develop it.

A second researcher built a scaffold that let Claude run unsupervised for three days against AES. It produced a meet-in-the-middle attack on the seven-round version of AES-128 that runs between 200 and 800 times faster than the previous best, using a fingerprinting technique the model named the Möbius Bridge. Anthropic states plainly that neither result touches systems in use today.

What actually broke, and what did not

Nothing you are running today is weaker than it was last week. HAWK is a candidate, not a standard, and is deployed nowhere. The AES result attacks a deliberately reduced seven-round variant, while full AES-128 has ten rounds and is untouched. Anthropic's own write-up says no production software will have to change as a result, and that scaling the AES attack would still cost hundreds of millions of dollars.

The rest of the haul is where the range shows. Mythos also produced a practical attack on 13-round LEA needing fewer than 2^30 known plaintexts and runnable in under an hour, a full key-recovery extension against six-round Serpent-128, and smaller gains of under ten times against Salsa20, Poseidon and SHA-1. Human cryptographers spent several hundred hours confirming the AES work was correct.

One detail is worth keeping. Claude first refused the AES task outright, telling the researchers that attacks on AES were not possible, and the novel approach only appeared after they pushed it to continue. What came back was not a recitation of published cryptanalysis. It was a technique nobody had seen, which is precisely why it had to be checked by hand.

The repair removes the reason it was chosen

Here is the part that is not in the announcement. NIST advanced HAWK to the third round in May for two stated reasons: compact signatures, and algorithmic diversity, since it rests on different assumptions than ML-DSA and FN-DSA. Anthropic's stated remedy for the new attack is that HAWK would have to double its proposed key sizes to hold its intended security level.

Doubling the key sizes spends the compactness. A scheme advanced for being small, then made twice as large, is left competing on exactly the ground it was selected to avoid. The timing is tight as well: the third round runs about two years, and updated submission packages are due on 14 August 2026, seventeen days after this result was published.

The wider point outlives HAWK. Its assurance rested on elapsed review, two years and two rounds with no better attack found, and that evidence was overturned for roughly the price of a mid-size penetration test. Two years of review, against sixty hours of machine work. Review time was always a proxy for scrutiny, and it has stopped being a reliable one.

What a 2026 migration plan should now assume

Keep production migrations inside the standardised set. ML-KEM, ML-DSA and SLH-DSA are published standards; the additional-signature candidates including HAWK are not, and NIST's own timeline puts final standards for them somewhere around 2028 to 2030. Nothing still in the onramp belongs in a plan you are executing this year.

Budget for substitution rather than selection. The deliverable that matters is an inventory of where each algorithm actually lives across your estate, plus the ability to replace one without a rebuild, because what changed this week is how fast a candidate's security estimate can move. In the UK the NCSC has published a national migration timeline running to 2035, and it points at the standardised schemes, not at the onramp.

Ask your vendors which scheme they have committed to in firmware and in hardware security modules, because that is where swapping is slowest. In software a downgraded algorithm is a configuration change. Burned into a device you bought on a seven-year replacement cycle, the same downgrade becomes a procurement problem you will be living with long after the cryptographers have moved on.

Frequently asked questions

Does this mean AES is broken?

No. The attack applies to a reduced seven-round version of AES-128 used for research, not the full ten-round cipher in production. Anthropic states explicitly that no production software has to change, and that even a scaled version of the attack would cost hundreds of millions of dollars to run.

Should we stop our post-quantum migration?

No, and the opposite is closer to right. The standardised schemes ML-KEM, ML-DSA and SLH-DSA are unaffected by this work. What the result argues for is designing the migration so that any single algorithm can be replaced later without rebuilding the system around it.

Was HAWK part of our plan in the first place?

Almost certainly not. HAWK is a third-round candidate in NIST's additional-signatures process, with final standardisation realistically in the 2028 to 2030 window. If a supplier has proposed it for a live deployment, that is worth questioning independently of this attack.

The lesson is not that a candidate algorithm failed, which is what the review process exists to make happen. It is that the cost of finding the failure has collapsed, and the assurance you get from an algorithm having gone unchallenged for years collapsed with it. Plan for the algorithm you deploy to be re-scored while you are still deploying it.

Anthropicpost-quantum cryptographyNISTHAWKAEScrypto-agilityPQC migration

Nine Ions on a Chip Raised 25 Million Dollars

An ETH Zurich spin-out raised six times its lifetime funding on a demonstration of nine trapped ions. The qubit count is the least useful number in the announcement, and knowing why changes how you read every vendor roadmap.

6 min read

AI Policy

Anthropic Wants Every Model Tested, Open or Closed

Dario Amodei ruled out backing a ban on open-weights models on 27 July and asked for mandatory safety testing instead. Europe switches that regime on from 2 August.

4 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles