For years, the security community has viewed large language models primarily as sophisticated assistants for finding implementation errors. We have grown accustomed to AI identifying buffer overflows in C++ or spotting logic flaws in a smart contract—essentially acting as a high-speed proofreader for human mistakes. However, the conversation is shifting this week from the errors of the programmer to the errors of the mathematician. The industry is realizing that AI is no longer just looking for bugs in the code; it is beginning to find holes in the underlying mathematics of encryption itself.

The Mathematical Assault on HAWK and AES

Anthropic's Claude Mythos Preview has demonstrated a level of cryptanalytic capability that challenges the traditional timeline of algorithm vetting. The most significant achievement is the successful attack on HAWK, a candidate for Post-Quantum Cryptography (PQC) that was included in the third round of the National Institute of Standards and Technology (NIST) standardization process. After 60 hours of autonomous work, Claude identified a previously unknown nontrivial automorphism within the HAWK algorithm. This discovery of a hidden symmetry allows an attacker to significantly increase the speed of an attack, effectively halving the key strength. To maintain the original intended security level, the key size of HAWK would now need to be doubled.

This is a particularly striking result because HAWK had already undergone two years of rigorous review by human experts before the AI identified this vulnerability. The model's capabilities extended beyond PQC into classical symmetric encryption. In an attack on a 7-round reduced version of AES-128, Claude developed a new fingerprinting algorithm dubbed the Möbius Bridge. This approach improves upon the traditional meet-in-the-middle attack by eliminating one of the values an attacker must guess, which increases the attack speed by 200 to 800 times.

The model's versatility was further proven through its performance on other algorithms. Claude successfully recovered the key for the 13-round Lightweight Encryption Algorithm (LEA), designed for low-power environments, in under one hour. It also executed a full key recovery attack on a 6-round version of Serpent-128. These results were not achieved through simple pattern matching but through a sophisticated multi-agent workflow. Claude utilized Python and Sage for computation, ingested public cryptanalysis papers, and autonomously managed a pipeline of hypothesis generation, experimentation, and verification.

The financial cost of these breakthroughs is perhaps the most jarring metric for security professionals. The total cost of the API calls required to develop these attacks was approximately $100,000. While this may seem high for an individual, it is a negligible investment for a state actor or a sophisticated criminal organization to break a NIST-candidate algorithm.

From Implementation Bugs to Algorithmic Flaws

This shift represents a fundamental change in the threat model for modern encryption. Until now, the industry operated on the assumption that if an algorithm was mathematically sound and vetted by the global community, the only remaining risk was a poor implementation. The Claude Mythos Preview results prove that AI can now perform cryptanalytic stress tests, moving from the role of a code reviewer to that of a research mathematician. This means that the mathematical foundations of our security are no longer static; they are subject to the accelerating compute and reasoning capabilities of LLMs.

This capability creates a new opportunity for the NIST standardization process. Traditionally, NIST relies on a global call for experts to find flaws before an algorithm is deployed. AI can now serve as a pre-audit tool, scanning candidate algorithms for mathematical weaknesses far faster than a human team could. To formalize this capability, Anthropic collaborated with ETH Zurich, Tel Aviv University, and the University of Haifa to release CryptanalysisBench, a benchmark specifically designed to evaluate the cryptanalytic abilities of large language models.

However, this acceleration introduces a dangerous new bottleneck: the verification gap. While Claude took only one week to conceive and refine the Möbius Bridge attack on AES, it took a team of researchers nearly a month to verify the accuracy of the results. As AI begins to generate cryptanalytic hypotheses at an exponential rate, the human ability to verify those claims becomes the primary point of failure in the security pipeline. We are entering an era where the AI can break the lock in a week, but the locksmith takes a month to confirm the door is open.

This reality necessitates a total audit of long-tail cryptosystems. While the HAWK vulnerability does not yet impact live systems because it was not yet standardized, and the AES attack is limited to a reduced-round version, thousands of other niche or legacy algorithms remain in use. These systems, which may not have received the same level of scrutiny as AES or RSA, are now vulnerable to automated, AI-driven mathematical analysis.

Security leaders must now assume that the window between the discovery of a mathematical flaw and its exploitation has shrunk. The strategy must shift toward shortening the update cycles for cryptographic primitives and integrating AI-based verification tools to close the gap between AI discovery and human validation.

AI is now simultaneously the most dangerous tool for breaking encryption and the most powerful tool for building the next generation of resilient, quantum-resistant mathematics.