The Flaw Human Experts Missed for Two Years, an AI Found in a Weekend

Sixty-seven million. That's roughly how many times cheaper it just became to break HAWK-256, a post-quantum signature scheme that survived two full rounds of expert cryptanalytic review without anyone spotting the problem.

The reviewer who finally did? Not a person. Anthropic's Claude Mythos Preview found the weakness in about 60 hours of largely autonomous research, at a compute cost of roughly $100,000. The human overseeing the project wasn't even a lattice cryptography specialist.

If that sentence makes you slightly uneasy, good. It should. But probably not for the reason you think.

What Just Happened?

On July 28, 2026, Anthropic disclosed that Mythos Preview - the research model behind Claude Fable 5, had identified a previously unexploited mathematical symmetry in HAWK, a lattice-based digital signature scheme and one of nine third-round candidates in NIST's additional post-quantum signatures process. HAWK is the only lattice-based scheme left in that group, which made it a favorite.

The symmetry matters because prior academic work had already shown that if such a structure existed in HAWK's lattice, it would enable faster attacks. Nobody had confirmed it existed. Mythos confirmed it, then built a working attack on top.

The numbers: the expected cost of a full key-recovery attack on the smallest parameter set, HAWK-256, fell from roughly 2⁶⁴ operations to 2³⁸. In practical terms, Anthropic's published code recovers a working signing key in about 3 hours and 42 minutes on a 96-core server.

Three things keep this from being a crisis:

• HAWK-256 is a challenge parameter, deliberately undersized as a cryptanalytic target. The real-world sets are HAWK-512 and HAWK-1024, which remain impractical to attack.
• The attack is still exponential. It's a much faster exponential attack, not a polynomial-time break of the underlying math.
• Nothing in production uses HAWK. It's a candidate, not a standard, and the finding doesn't affect other NIST PQC algorithms or lattice cryptography generally.

So why is the research community treating this as a landmark? Because losing 26 bits of security means HAWK's proposed key sizes were significantly weaker than claimed. To hit its promised security levels, HAWK would need substantially larger keys, eroding the efficiency edge that made it attractive in the first place. And because of who found it, and how fast.

PQC in Plain English

Post-Quantum Cryptography is the effort to build encryption and signature schemes that stay secure even against quantum computers.

Here's the short version of why we need it. Most of today's public-key cryptography, the math protecting your HTTPS connections, software updates, and banking sessions, rests on problems like factoring huge numbers. Classical computers find these effectively impossible. A sufficiently large quantum computer running Shor's algorithm would not. Such a machine doesn't exist yet, but "harvest now, decrypt later" attacks hoarding encrypted traffic today to crack once quantum hardware matures are a real concern for long-lived secrets.

That's why NIST has spent nearly a decade running a public competition to standardize quantum-resistant algorithms. The process works like a demolition derby: submit your scheme, and the world's cryptographers spend years trying to wreck it. Survivors become standards. The system works; a previous candidate, SIKE, was broken in about an hour on a laptop and eliminated. Better to find flaws on the test bench than in your bank.

One distinction worth keeping straight:

• Encryption keeps data secret. A locked box only the recipient can open.
• Digital signatures prove authenticity. A tamper-evident wax seal proving a message really came from you and wasn't altered.

HAWK is a signature scheme. Nobody's messages were at risk of exposure here, the concern is about forgery resistance in a future standard.

Why This Discovery Actually Matters

Strip away the headlines and the significance is about process, not the specific bits lost.

HAWK's underlying problem had been public for years. Expert humans reviewed it through two full NIST rounds. The weakness sat there the whole time, waiting for someone to check whether a theorized symmetry actually existed. An AI checked. That's AI vulnerability discovery working exactly as promised and exactly as feared.

The economics are the uncomfortable part. Serious cryptanalytic research used to require a rare combination: deep mathematical intuition, years of specialization, and institutional backing. This result cost about $100,000 in compute and a human manager whose role was mostly picking software libraries. When finding cryptographic weaknesses becomes a purchasable line item, the tempo of the whole field changes.

Does that mean cryptographic security is collapsing? No. It means the review process is about to get dramatically more thorough; for everyone, including people you'd rather it didn't.

AI: Security Researcher or Security Threat?

Honest answer: both, and the ratio depends on who moves first.

On the defensive side, the upside is enormous. AI-driven analysis can audit protocols and implementations at a scale no human team can match. Candidate algorithms could face millions of hours of automated scrutiny before standardization, not after deployment. Anthropic followed responsible disclosure here, notifying HAWK's authors in June, coordinating with the NIST mailing list, and publishing reproducible code. That's the model working as intended: flaws found early, in public, on a scheme nobody depends on yet.

The offensive mirror image writes itself. If a safety-focused lab demonstrates this capability openly, it's naive to assume well-resourced adversaries aren't building the same thing quietly. AI exploit development, faster weaponization of disclosed bugs, and relentless pressure on defensive teams already stretched thin - none of that is hypothetical anymore.

The same 60 hours that harden a future standard could probe a deployed one. The technology doesn't care which. What tilts the balance is deployment: defenders adopting these tools faster than attackers, and disclosure norms holding. Fatalism isn't warranted. Complacency isn't either.

Why You Should Care Even If You've Never Heard of a Lattice

Cryptography is invisible plumbing. You notice it only when it fails.

Digital signatures verify that your banking app is talking to your actual bank. They authenticate the software updates on your phone; a forged signature there means malware installed with your device's blessing. Your messaging apps, your digital ID, government records, hospital systems, every cloud service holding your data: all of it rests on signature schemes staying unforgeable.

Quantum-safe cryptography is what keeps that plumbing intact through the quantum transition. The HAWK finding is reassuring in one sense: the flaw surfaced during evaluation, before a single system depended on it. It's sobering in another: assumptions about how long a "vetted" algorithm stays trustworthy just got shorter.

What Organizations Should Do Now

Nothing here justifies panic. Plenty justifies preparation.

• Track NIST PQC developments. The standardized algorithms, ML-KEM, ML-DSA, and SLH-DSA, are unaffected by this research. Migration toward them should continue, not stall.
• Inventory your cryptography. Most organizations genuinely don't know every algorithm, key size, and library they depend on. You can't replace what you can't find.
• Build crypto-agility. Architect systems so swapping an algorithm doesn't mean rebuilding everything. This finding is the strongest argument yet: the next weakness may arrive with 60 hours' notice.
• Adopt security-by-design. Layered defenses mean one cracked primitive doesn't unravel the whole system.
• Put AI on your side. The same class of tools that found this flaw can audit your protocols and implementations before someone else's tools do.
• Re-review periodically. "Passed audit in 2024" is a timestamp, not a property.

The Bigger Picture

For decades, cryptanalytic breakthroughs came from a small community of brilliant specialists, at a pace set by human careers. That era is ending. The next major result in cryptography or protocol analysis, or vulnerability research, may well come from an AI system running unattended over a long weekend, supervised by someone who isn't an expert in the field being advanced.

That cuts both ways, permanently. Fields that assumed scarcity of expert attention as a security margin need new assumptions. The organizations that thrive won't be the ones that hoped AI cryptanalysis would stay theoretical. They'll be the ones that priced it in early.

HAWK-256 wasn't the story. The invoice was.

FAQ

The Takeaway

The most important number in this story isn't 2³⁸. It's 60 - the hours it took a machine to find what two years of expert review missed. Cryptanalysis just became something you can rent. The only rational response is to assume every system you run will eventually be reviewed at that intensity, by someone, and to build accordingly.

If this changed how you think about your crypto stack, share it with the person who owns that roadmap. Subscribe for ongoing coverage of AI security and the PQC transition; this story is nowhere near finished. And if you've never actually read how a lattice scheme works, there's never been a better excuse to start.