AI-Assisted Cryptanalysis Reaches New Milestones
Recent research from Anthropic has revealed that their model, Claude Mythos Preview, has successfully assisted in identifying and executing advanced cryptanalytic attacks. This development represents a shift in how Large Language Models (LLMs) are utilized within the security domain, moving from basic code generation to the derivation of complex mathematical vulnerabilities. According to The Hacker News, the AI helped derive an end-to-end key-recovery attack against HAWK-256, a signature scheme intended for the post-quantum era, and provided a massive computational speedup for attacks against the Advanced Encryption Standard (AES).
This research is particularly significant for the cryptographic community as it demonstrates that AI reasoning can identify “unused symmetries” in complex lattice structures that human researchers may have overlooked. While no CVE has been assigned to these findings yet—as they primarily affect a test scheme and reduced-round variants—the methodology provides a blueprint for future APT groups to potentially automate the discovery of cryptographic weaknesses.
Claude AI HAWK-256 Key-Recovery Attack
The HAWK-256 signature scheme is part of the ongoing effort to develop Post-Quantum Cryptography (PQC) that can withstand attacks from future quantum computers. However, Anthropic’s latest findings indicate that classical AI-driven analysis might pose a more immediate threat than previously anticipated. The Claude Mythos Preview model identified a previously unused symmetry in the lattice underlying the HAWK signature scheme.
By exploiting this symmetry, researchers were able to implement a full key-recovery attack. The efficiency of the attack is notable; the released implementation requires an expected runtime of only three hours and 42 minutes when running on a 96-core server. For security professionals researching how to detect AI-assisted cryptanalysis, the speed and low barrier to entry for such an attack on a PQC candidate are alarming. It suggests that the window for vetting new cryptographic standards is narrowing as AI tools become more adept at mathematical reasoning.
7-Round AES-128 Attack Speedup and Symmetric Crypto Implications
In addition to the PQC breakthrough, the research highlighted a significant 7-round AES-128 attack speedup. AES-128, which traditionally utilizes 10 rounds of transformation to secure data, has long been a target of reduced-round cryptanalysis. Anthropic reported that Claude helped achieve a 200- to 800-fold speedup for an existing attack on the seven-round variant.
While this does not represent a full break of the standard 10-round AES-128, it demonstrates that AI can drastically optimize the search space and mathematical operations required for complex TTPs in cryptanalysis. This optimization is precisely what defenders must prepare for as AI models move toward specialized technical tasks. The ability to refine an attack by several orders of magnitude could eventually bring the complexity of a full AES break within the reach of well-resourced adversaries.
Recommendations for Defenders and Researchers
The emergence of AI-driven cryptanalysis necessitates a re-evaluation of how organizations approach Zero Trust and long-term data protection. If cryptographic primitives can be weakened more quickly than expected, the “harvest now, decrypt later” strategy used by many threat actors becomes significantly more dangerous.
- Monitor NIST PQC Standardization: Stay informed on the progress of HAWK and other PQC candidates. Ensure that any future migration to post-quantum standards involves algorithms that have been rigorously tested against AI-augmented analysis.
- Maintain Full-Round Implementations: Ensure that all deployments of symmetric encryption, such as AES, use the full number of recommended rounds (e.g., 10 for AES-128, 14 for AES-256). Reduced-round implementations are increasingly vulnerable to AI-optimized attacks.
- Update Cryptographic Agility: Organizations should maintain a high degree of cryptographic agility, allowing them to rotate algorithms and update libraries quickly if a fundamental weakness is discovered in a widely used primitive.
- Enhance Monitoring: While SOC teams typically focus on higher-level alerts, researchers should look for unusual patterns in computational resource usage that might indicate large-scale cryptanalytic attempts within the environment.