Anthropic Demonstrates LLM-Driven Cryptanalysis Discovering Flaws in HAWK and Round-Reduced AES

Anthropic Demonstrates LLM-Driven Cryptanalysis Discovering Flaws in HAWK and Round-Reduced AES Researchers at Anthropic utilized Claude Mythos Preview to discover mathematical weaknesses and advance attacks on cryptographic schemes, notably weakening the post-quantum candidate HAWK and optimizing attacks against reduced-round versions of AES and other ciphers. Claude Mythos Preview identified a lattice automorphism that halves HAWK's effective key strength, reducing HAWK-256 attack costs from 2^64 to 2^38. Anthropic developed the 'Möbius Bridge' fingerprinting algorithm, accelerating meet-in-the-middle attacks on 7-round AES-128 by 200 to 800 times. Neither attack threatens production systems: HAWK remains an undeployed NIST candidate, and AES is only compromised in a 7-round reduced form. Developing each attack cost around $100,000 in API usage, while human verification of the AES attack required several hundred hours over nearly a month. To benchmark these evolving capabilities, Anthropic collaborated with ETH Zurich, Tel Aviv University, and TU Berlin to create CryptanalysisBench. Cryptanalytic Findings on HAWK and Reduced AES Anthropic deployed Claude Mythos Preview to uncover algorithmic weaknesses in cryptographic schemes. In analyzing HAWK—a third-round candidate in NIST's post-quantum digital signature project based on the Lattice Isomorphism Problem—Mythos identified a nontrivial automorphism in its lattice structure. This enabled an exponential-time enumeration attack that cuts effective key strength in half and forces a doubling of key sizes to maintain security, which degrades the scheme's core advantages. The expected cost to fully recover a HAWK-256 key fell from 2^64 to 2^38, though the attack does not operate in polynomial time, does not affect larger keys practically, and leaves other NIST candidates unaffected. Separately, Mythos improved chosen-plaintext meet-in-the-middle attacks on 7-round AES-128 by developing the 'Möbius Bridge' fingerprinting algorithm, which removes the need to guess among 256 values and achieves an attack 200 to 800 times faster than prior techniques across 2^105 requested encryptions. Methodology, Costs, and the Verification Bottleneck The attacks required substantial computational resources and distinct agentic setups. Formulating the HAWK exploit took roughly 60 hours, $100,000 in API costs, and a multi-agent framework where Claude worked semi-autonomously using Python, Sage, and cryptographic literature under non-expert human direction. The 7-round AES attack emerged almost autonomously after human prompting bypassed the model's initial claim that improving AES cryptanalysis was impossible; the discovery required several days, roughly $100,000 in API costs, and one billion output tokens. However, verifying the model's AES findings required two Anthropic researchers nearly a month of work totaling several hundred hours, underscoring that human validation may serve as the primary bottleneck as language models produce increasingly complex mathematical results. Broader Cryptanalytic Benchmarks and Improved Cipher Attacks Beyond HAWK and AES, Mythos established practical attacks on additional algorithms. On 13-round LEA, the model recovered keys in under an hour on a desktop computer using fewer than 2^30 encrypted plaintexts—advancing beyond previous literature requiring 2^98 plaintext pairs and 2^86 work—without compromising the full 24-round cipher. On 6-round Serpent-128, the model found a practical key recovery attack improving on prior bounds of 2^70 plaintext pairs and 2^90 decryptions, while yielding sub-10x improvements on Salsa20, Poseidon, and SHA-1. In tandem, Anthropic collaborated with ETH Zurich, Tel Aviv University, and TU Berlin to introduce CryptanalysisBench to measure LLM cryptanalytic proficiencies across diverse ciphers. Responsible Disclosure and Industry Impact Anthropic responsibly disclosed the HAWK vulnerability to its designers in June and subsequently posted to the public NIST mailing list, while consulting US government and industry leaders prior to sharing details. The authors emphasize that neither primary attack impacts current production environments, aligning instead with NIST's intended pre-deployment vetting. Acknowledging that LLMs evolved within one year from failing on basic ciphers to breaking expert-reviewed designs, Anthropic warns that capabilities are unlikely to plateau. Because many modern ciphers lack deep scrutiny, the authors argue academia, government, and industry must proactively establish protocols for instances where automated systems identify vulnerabilities carrying immediate real-world consequences.

Anthropic利用Claude Mythos发现密码学算法缺陷并改进分析攻击 Anthropic研究人员利用Claude Mythos Preview模型，成功发现了后量子数字签名候选方案HAWK的数学缺陷，并改进了对缩减轮数AES等密码算法的攻击方法。尽管这些攻击暂未波及生产系统，但验证过程表明模型已具备协助甚至自主推进密码分析的能力，同时也暴露出人工验证效率成为瓶颈的新挑战。 针对NIST后量子候选方案HAWK，模型发现了格中的非平凡自同构，将HAWK-256的密钥恢复成本从2^64降至2^38，迫使其需加倍密钥尺寸。 在7轮AES-128上开发出“莫比乌斯桥”指纹算法，在选择明文攻击下将攻击速度较此前最优成果提升200至800倍。 两项主要攻击的计算成本均在10万美元API费用左右，其中AES攻击的人工验证耗费了两位研究员近一个月的时间。 模型还对缩减轮数的LEA、Serpent-128、Salsa20、Poseidon和SHA-1实现了不同程度的分析改进，并联合多所高校推出了基准测试CryptanalysisBench。 后量子签名方案HAWK的攻击突破 HAWK是NIST征集附加后量子数字签名算法的第三轮候选方案，基于格同构问题的难度构建。Claude Mythos在非专家人类指导的多智能体框架下，结合Python、Sage及文献资料耗时约60小时发现其格中存在非平凡自同构。该漏洞使有效密钥强度减半，令全密钥恢复成本由原先预估的2^64降至2^38。若要维持原有安全性需将密钥大小加倍，这将削弱其作为候选方案的优势。该攻击不属于多项式时间攻击，且不影响其他基于格的密码学方案；Anthropic已于6月向作者及NIST公开邮件列表完成负责任披露。 缩减轮数AES及其他经典密码的分析进展 在克服最初的拒绝与“不可能改进”回应后，模型在数天内几乎自主生成了针对7轮AES-128的中间相遇攻击，耗费约10亿输出Token与10万美元API成本。其核心是提出一种名为“莫比乌斯桥”的指纹算法，构建不变量从而消除对256个值的猜测，使攻击速度提升200至800倍。此外，模型还对13轮LEA实现了1小时内、2^30选择明文以内的实用级密钥恢复，并优化了6轮Serpent-128的密钥恢复，且对Salsa20、Poseidon和SHA-1带来微幅改进。 密码分析验证瓶颈与行业协同 虽然模型生成AES攻击耗时数日，但Anthropic两位研究人员验证其正确性花费了近一个月（数百小时），凸显出人类审查新颖模型输出已成为主要瓶颈。为评估此类能力，Anthropic联合苏黎世联邦理工学院、特拉维夫大学及柏林工业大学构建了CryptanalysisBench基准测试。这些发现是迄今为止发现的最强攻击，但均属于针对未部署算法或轮数缩减版本的预期研究成果，并已提前与美国政府及行业领袖磋商。 对未来密码学审查与安全生态的影响 语言模型在一年内从无法分析基本密码跃升至发现专家多年未察觉的密码漏洞，表明模型能力远未见顶。许多未受充分审查的现代密码可能潜藏可被模型挖掘的弱点。由于密码学依赖对抗性审查以完善方案，作者认为语言模型将在推动算法安全性方面扮演核心角色，并呼吁学术界、政府与工业界提前拟定预案，以应对未来大语言模型直接攻破现实关键密码系统的潜在风险。

*Using Claude Mythos Preview, researchers at Anthropic have discovered improved ways to attack cryptographic algorithms (the mathematical methods used to keep online data private). The first attack significantly weakens HAWK, a digital signature scheme that was built for a post-quantum world. The second identifies a new way to attack round-reduced AES, the most widely used symmetric cipher. These are substantial research advances, but they do not currently affect any production systems. This post describes both findings in more detail and discusses the implications for cryptography in an age of powerful AI models.* When we launched Claude Mythos Preview, we showed it was able to autonomously find and exploit vulnerabilities in almost every piece of software we pointed it at. This included several major cryptographic libraries—shared collections of code that are used to encrypt data. The vulnerabilities that Claude found in these cryptographic libraries¹ were due to incorrect *implementation* of the algorithms—that is, errors in how programmers used the algorithms in their code that created opportunities for attackers to break the encryption. Now, we have found that Claude is able to find mathematical flaws *in the algorithms themselves*. Cryptographic algorithms are a fundamental building block of digital security. For example, when you visit a webpage like [https://www.anthropic.com](https://anthropic.com/), your browser checks that it is communicating with an authentic website using an algorithm called a *digital signature scheme*. Later, the traffic between you and the website is encrypted using *symmetric ciphers*—codes that allow secure data transmission between parties who share an identical key. Without secure cryptographic systems like these, your email, online banking, and other internet use would be open to cybercriminals, who could intercept or modify your communications. Flaws in these widely used cryptographic systems could put billions of users’ data at risk. The first result we describe in this post, which was discovered with Claude Mythos Preview, is an improved attack against a digital signature scheme called [HAWK](https://csrc.nist.gov/csrc/media/Projects/pqc-dig-sig/documents/round-1/spec-files/hawk-spec-web.pdf). In 2022, the US Government’s [National Institute of Standards and Technology](https://www.nist.gov/) (NIST) put out a [call](https://csrc.nist.gov/projects/pqc-dig-sig/round-3-additional-signatures) for additional cryptographic systems that would remain secure even against quantum computers (which could, if developed, break most of the existing signature schemes in use today). HAWK is one of the third-round candidates under consideration from this call. Despite HAWK having survived two rounds of expert human review over a period of two years, Mythos was able to improve the best-known attack on it in just 60 hours of work—effectively cutting its key strength in half. The second result concerns the [Advanced Encryption Standard](https://www.nist.gov/publications/advanced-encryption-standard-aes) (AES), a symmetric cipher that was adopted by NIST in 2001 and has received more scrutiny than almost any other encryption algorithm. In order to better understand the robustness of AES, weaker variations of the algorithm are regularly studied in cryptography research; Mythos found a way to break one such weaker version, and eliminated one of the guesses an attacker needs to make, improving the speed of the previous best attacks by 200-800×. To be clear, neither of these results has a practical impact on today’s computer systems; no production software will have to change as a result. HAWK is only a *candidate* signature scheme and so is not deployed;² our second attack is on a reduced version of AES and does not break the full cipher.³ Nevertheless, both results show the potential for frontier AI models to help discover flaws in important cryptographic algorithms, both before and after real-world deployment. This is cryptography research working as intended: stress-testing algorithms to build trust and ultimately make systems more secure. Mythos Preview achieved these results mostly autonomously and mostly without human intervention. Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack, and another researcher built a scaffold⁴ that allowed Claude to fully autonomously discover the AES attack.⁵ Each of the results cost roughly $100,000 in API cost to develop. After seeing these results, we broadened our search and began to discover other attacks. We discuss some of these follow-ups below. In order to make it easier for others to continue studying the cryptanalytic ability of LLMs, we partnered with academics at ETH Zurich, Tel Aviv University, and TU Berlin to build [CryptanalysisBench](https://arxiv.org/abs/2607.18538), a benchmark that packages together many cryptographic ciphers and makes it easy for others to evaluate the capabilities of LLMs on this important topic. Throughout the research process, we followed responsible disclosure procedures, and consulted with academics to confirm the validity of our findings. We also shared advance copies with US government and industry partners, and held discussions on the implications of this research. In the case of our HAWK finding, we shared our attack with the authors of HAWK in June and coordinated disclosure to the public NIST mailing list at the same time our results were released. In the rest of this post, we summarize the two findings in further technical detail and briefly describe some of our other recent cryptography results. Full descriptions of the two main findings are provided in two new papers, and we hope to release details for our other findings in the near future. Working with Mythos Preview, an Anthropic researcher developed an attack against the [HAWK](https://hawk-sign.info/) post-quantum digital signature scheme. This attack substantially speeds up the time it would take to break the signature scheme—more technically, it reduces the “effective keysize” by a factor of two. In [our paper](https://anthropic.com/document/hawk_key_recovery.pdf), we provide the full technical details of our result including [demonstration code](https://github.com/anthropics/cryptography-research-demo) that shows our attack running. HAWK is one of the remaining third round candidates of the NIST call for [Additional Digital Signatures](https://csrc.nist.gov/projects/pqc-dig-sig/round-3-additional-signatures). This contest is part of a near decade-long effort to standardize new [Post-Quantum Cryptographic](https://csrc.nist.gov/Projects/post-quantum-cryptography/post-quantum-cryptography-standardization) (PQC) schemes. This standardization effort is becoming critical as the horizon to building a cryptographically-relevant quantum computer [shrinks](https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/) and threatens classical cryptography such as RSA or ECDSA. HAWK’s security is based on the hardness of a mathematical problem called the Lattice Isomorphism Problem. Mythos’s attack works by finding a specific, previously unexploited symmetry called a nontrivial automorphism in the lattice used by HAWK. [Prior work](https://eprint.iacr.org/2025/928) proved that efficiently finding such an automorphism would permit an attack, but did not answer if such an automorphism was accessible in the lattice used by HAWK. The automorphism discovered by Mythos allows a faster enumeration attack that, while still exponential, means that one needs to double the size of HAWK keys to achieve the same level of security. Unfortunately, doubling HAWK’s key size eliminates many of the reasons making the scheme (as it currently stands) an attractive PQC signature candidate. To find the attack, Claude Mythos Preview worked semi-autonomously in an agentic harness, with occasional human guidance and nontechnical direction. Mythos found the attack after an extensive literature review to understand the state of the art, and substantial mathematical reasoning and computational experiments. After finding the attack, Mythos implemented an end-to-end verification pipeline to convince itself—and the human operator—of the attack’s correctness. For this experiment, we used a Claude Code-like harness that supports multiple worker agents collaborating together in a sandboxed environment, with access to computational tools like Python and Sage as well as access to published cryptographic works. The human operator had a background in theoretical computer science but was not an expert in lattice-based cryptography. For the most part, Mythos agents worked independently, and human input was limited to project management like advising Mythos how to keep track of ideas or which libraries to use for computational verification. The multi-agent workflow led to interesting dynamics. For example, the key idea in producing this attack was discovered by a pair of workers working together. Both started investigating the idea; the first worker prematurely rejected the idea as infeasible, but the second found a way to fully exploit it. The pair kept exchanging messages, and eventually both agreed they had found an effective attack. Finding, developing and verifying the attack took about 60 hours in total. We estimate that the full attack discovery process cost approximately $100,000 in API cost. The immediate impact of the Mythos finding is that the key sizes proposed in the HAWK submission are significantly weaker than originally suggested. For example, the expected cost of a full key recovery attack against the small HAWK-256 size was thought to be 2⁶⁴ but was demonstrated by Mythos to be 2³⁸. For larger keys, HAWK therefore remains impractical to attack. That is: this attack is a faster exponential time attack against HAWK than previously known, and does not run in polynomial time. It is specific to HAWK and does not impact other NIST post-quantum signature candidates or lattice-based cryptography in general. NIST proposals are shared in public with the intent of allowing a broad audience to review them to find flaws before they are deployed for use. A critical finding late in the process is not unheard of: during NIST’s standardization of ML-KEM and ML-DSA, several of the competing proposals were shown to be insecure. One candidate, SIKE, was found to be [completely broken in an hour on a laptop](https://www.quantamagazine.org/post-quantum-cryptography-scheme-is-cracked-on-a-laptop-20220824/). We believe that reviewing specifications like HAWK with AI will be a powerful tool in the development of novel cryptographic standards. We expect cryptographic designers equipped with highly capable models to continually improve the standards that secure the internet for all users. Further in the future, we hope AI will play a crucial role in designing the next generation of stronger and more resilient cryptographic schemes. In our second result, Mythos Preview improved an attack on a simpler “reduced-round” variant of the [Advanced Encryption Standard](https://www.nist.gov/publications/advanced-encryption-standard-aes) (AES) created in 2001 as part of a [prior NIST competition](https://csrc.nist.gov/news/1997/requesting-candidate-algorithm-nominations-for-aes). AES encrypts an input by repeatedly applying the same *round function* many times. AES-128, the specific cipher we attack, has 10 rounds. Our attack works only on a modified version of the cipher that has 7 out of the full 10 rounds. Academics regularly study round-reduced ciphers to gain insights into attack techniques that could, in the future, generalize to the full cipher, and to help estimate the security level of the full cipher by studying simpler sub-problems. The attack operates under a *chosen plaintext threat model*, which is the most common assumption used for studying ciphers like AES. Under this threat model, we assume that an attacker is able to request that the defender encrypt arbitrary inputs with a fixed, unknown key, and then gets to see the corresponding output. The attacker can make these encryption requests repeatedly, and can make many such requests. The prior work we build on assumes the attacker can request the encryption of 2¹⁰⁵ chosen plaintexts. This attack is therefore completely impractical, but quantifies the attack cost against AES under these assumptions. Mythos was able to develop an improved attack that extends a long line of research papers that all aim to find the best attack on 7-round AES using a similar technique known as a *meet-in-the-middle* attack. At a very high level, these attacks work by trading off *time* for *space*. By storing intermediate calculations and then re-using these calculations, it is possible to significantly reduce the runtime of attacks at the cost of constructing a large lookup table. Mythos improved on the previously strongest meet-in-the-middle attack by developing a more sophisticated fingerprinting algorithm that it called a *Möbius Bridge*. The objective of the fingerprinting algorithm is to increase the number of potential lookups into the table that will succeed. One of the stages of the attack from prior work had to enumerate 256 different values and then look them up in the pre-computed table. Mythos developed a fingerprint that is invariant to this guess, which directly reduces the amount of work required by a factor of 256. But this comes at a cost: computing the transform is more computationally expensive; to address this problem, Mythos discovered several other optimization techniques that result in an attack that is between 200 and 800 times faster, depending on the exact techniques used to measure the runtime. Our [technical paper](https://anthropic.com/document/aes_mobius_bridge.pdf) contains the full details of the attack method and an analysis of its correctness and runtime. Compared to the one week that Mythos spent conceiving the idea, the vast majority of human researchers’ time was spent validating the correctness of its claims (though it is important to note the researchers are not experts in cryptography). Mythos Preview discovered this result almost entirely autonomously. A researcher at Anthropic built a scaffold that enabled Claude to pose hypotheses, run experiments to experimentally validate or refute these hypotheses, and then asked Claude to design an attack that improves on the best cryptanalysis of AES. Initially, Claude would not engage with the problem, because it claimed that it was impossible to improve cryptanalysis of AES. The result of our first runs ended with Claude writing messages like: *If you want a different outcome, the target has to change … AES-128 r5/r6 is just genuinely hard* Or: *on AES-128 r5/r6/r7 it found nothing because there's nothing easy to find; this is the most-studied block cipher in existence.* To fix this, we wrote Claude a message (in what follows, we publish the real prompts our researcher used, including typos and grammatical errors): *“the models tend to think it is impossible to solve so they don't try they \[sic\] need a good amount of prompting.”* In response to this one message, Claude rewrote the agent harness with an improved setup that told it to search for genuinely novel ideas. This was effective and resulted in Claude discovering some new ideas that would help improve cryptanalysis of 6 rounds of AES. We then asked Claude *“why not do aes-128 r7? the whole point is to find something better than existing approaches.”* Over the course of the next three days, Claude autonomously produced several hundred million tokens while working on the problem; we gave it just three substantive prompts: Three days later, Mythos discovered the Möbius Bridge idea that results in an improved attack. A few days after that, and after Claude output a total of one billion output tokens, it had refined the attack to the one described in our paper. Researchers at Anthropic then spent several hundred hours learning enough cryptography research to validate the model’s claim, and to prepare [the research paper](https://anthropic.com/document/aes_mobius_bridge.pdf) itself, which we are releasing along with this blog post. Along with the research paper, we are also releasing [a document containing Claude’s chain of thought](https://anthropic.com/document/aes_mobius_bridge_cot.pdf) during the discovery of the key algorithmic insight.⁶ In this session, Claude begins by reviewing what previous agents had discovered, reading the various critiques, and then turns to proposing various new transforms; after proposing and rejecting several ideas, it comes up with the key idea of the Möbius transform. Claude then validates this idea both mathematically and computationally, and then writes a report that future agents then used to develop the remaining ideas that formed its paper. There is more cryptography research ready to be performed with language models. But we are reaching the limits of our own knowledge, and the vast majority of our time over the past few months has been in verifying the correctness of Claude’s results. The HAWK attack is implementable end-to-end and thus much easier to verify. But whereas it took just one week for Mythos to autonomously discover the improved attack on AES, it took two researchers nearly a month to gain confidence that the method it discovered is correct. Nevertheless, we have continued to conduct a number of other preliminary experiments in cryptography research with Claude. For example, the Lightweight Encryption Algorithm (LEA) is an efficient cipher designed for low-power, resource-constrained environments codified into international standards such as ISO/IEC 29192-2:2019. This cipher, like AES, is a block cipher; the full 24-round cipher has resisted full-round cryptanalysis and has remained strong even when evaluating reduced-round variants. At present, the best cryptanalysis of 13 rounds of LEA [requires](https://jeit.ac.cn/article/doi/10.11999/JEIT221282) 2⁹⁸ plaintext pairs and 2⁸⁶ work. Mythos Preview developed a practical attack that can recover a 13-round LEA key in under 2³⁰ encrypted plaintexts, and that runs in under an hour on a modern desktop computer. Again, this attack does not apply to the 24-round cipher, and so has no immediate practical consideration. Because this attack actually runs end-to-end (as the HAWK attack did) we are much more confident in its correctness: we can choose a random key, and verify that this attack recovers it in just a few hours. Mythos discovered this attack much more recently and we still have more work to do to understand the full results (for example, the exact bounds on the number of plaintext pairs required, how some keys are harder to recover, and how it extends to 14 rounds). After more investigation, we plan to make the full results public. Mythos Preview has also identified another practical full key-recovery attack on 6-rounds of the Serpent-128 cipher (a 32-round cipher—again limiting the impact of this attack), extending the current [published work](https://dl.acm.org/doi/10.5555/647935.740922) which requires more than 2⁷⁰ plaintext pairs and 2⁹⁰ decryptions. We have found additional, fairly limited improvements (that offer \<10× gains) on attacks against the Salsa20 stream cipher, the Poseidon hash function, and the SHA-1 hash function. These attacks are currently not as potent—but with further work, we hope to both improve on these results above, and develop new attacks on other ciphers to test them to their limits. Additionally, we plan to continue our experiments with [CryptanalysisBench](https://arxiv.org/abs/2607.18538) in order to track how frontier LLM capabilities evolve over time. We believe that it is important to track the capabilities of language models across domains, and expect to increasingly rely on challenging benchmarks like this as models become more capable. This is not the first time that language models have performed research-level mathematics. In just the last few months, researchers from Google have used Gemini to [resolve several open Erdős problems](https://deepmind.google/blog/alphaevolve-impact/), researchers from OpenAI have used GPT to [resolve the unit distance conjecture](https://openai.com/index/model-disproves-discrete-geometry-conjecture/) (a particularly challenging Erdős problem), and earlier this month [we announced that Claude Fable 5 resolved](https://x.com/__alpoge__/status/2079028340955197566) the [Jacobian Conjecture](https://en.wikipedia.org/wiki/Jacobian_conjecture). Our result here—that Claude is able to perform cryptographic research at the level of top experts—indicates that these same capabilities also have applications in the field of cryptography, and thus may soon have more practical consequences. The cybersecurity community is now grappling with the fact that language models are able to discover [so many bugs](https://www.anthropic.com/research/glasswing-initial-update) that the standard human processes (like vulnerability triage, verification, and remediation) struggle to keep up. We predict that the same will soon be true in academic cryptography research. As language models increasingly produce novel research outputs autonomously, human researchers may become bottlenecked on studying and validating these results for technical validity, novelty, and utility. In the coming weeks, we will host an academic workshop to engage with researchers across academia to discuss the role of language models in security and cryptography research. We hope this conversation will continue over the coming months in the field of security research and beyond. Both of our primary attacks are *expected* results. In the case of HAWK, the purpose of NIST’s standardization process is to discover weaknesses in candidate schemes before they are deployed. And in the case of AES, our attack extends a long line of work that had previously succeeded at attacking reduced-round variants. But we should not assume that language model capabilities will plateau at this level. In just one year, language models have gone from being unable to perform cryptanalysis of even the most basic ciphers to being capable of finding flaws in cryptographic designs that have escaped discovery despite years of human expert review. Many ciphers protecting modern systems have received less scrutiny than they deserve—they might still have important weaknesses lying dormant that LLMs will soon be able to discover. We see this as a real opportunity to expand our ability to study the long tail of ciphers used throughout the world, and also our ability to more deeply study the ciphers that matter most. Indeed, as we mentioned above we have already begun audits of other schemes. The attacks described in these two papers are the strongest attacks we have found to date. We are sharing them after a period of consultation with US government and industry leaders. But as we develop increasingly powerful cryptanalytic results, it would be prudent to consider how researchers should react if a language model were to discover vulnerabilities in cryptosystems where attacks *do* have an immediate real-world impact. We believe answering this question will require input from academia, government, and industry. We hope that our work here will help launch these conversations. The cryptography community has always benefited from adversarial review: ciphers are proposed, examined, and revised until the community is satisfied with their security. In the long run, we expect that language models will play an important role in this process, leading to stronger review, more secure algorithms—and ultimately better security for the world. Read the [full paper on HAWK](https://anthropic.com/document/hawk_key_recovery.pdf). Read the [full paper on AES](https://anthropic.com/document/aes_mobius_bridge.pdf), and the associated [chain of thought](https://anthropic.com/document/aes_mobius_bridge_cot.pdf). Read the paper [introducing CryptanalysisBench](https://arxiv.org/abs/2607.18538). *Edit 29 July: Updated an academic affiliation.*