Here is the short version, because it is the version that will get quoted wrong all week: an AI found a real, previously unknown flaw in a serious cryptographic scheme — and the scheme has already been pulled. Nothing you deploy today is broken. Both halves of that sentence matter, and most of the coverage is going to drop one of them.
On July 28, Anthropic published "Discovering cryptographic weaknesses with Claude". Its unreleased Claude Mythos Preview model, running semi-autonomously inside a Claude Code multi-agent scaffold with Python, SageMath, and a library of published cryptography papers, found a structural attack on HAWK — a lattice-based digital-signature scheme that had spent roughly two years inside NIST's additional post-quantum signature on-ramp without anyone spotting the problem. The HAWK team confirmed the finding and withdrew the scheme. NIST marked it withdrawn.
What it actually found#
HAWK's security rests on a lattice problem being hard. Mythos found a nontrivial automorphism — a symmetry in that lattice that no published attack had used. Anthropic's paper, HAWK-n Key Recovery Reduces to SVP in Dimension n/2 + 1, shows that the symmetry lets you recover a key by solving a shortest-vector problem in roughly half the dimension everyone assumed you'd need.
The numbers are blunt. For HAWK-256, the best known key-recovery cost drops from about 2⁶⁴ operations to about 2³⁸ — the difference between "computationally serious" and "a weekend on rented hardware." The whole discovery took about 60 hours of compute at around $100,000. Two years of human experts reviewing the same design missed it.
The result isn't that a computer did more arithmetic. It's that the model found the idea — a structural feature of the math — that the humans hadn't.
The part you should not panic about#
If you stopped reading at the headline, you'd think your stack was on fire. It isn't. Line up the facts a founder actually needs:
- HAWK was never shipped. It was a candidate in NIST's additional signature on-ramp — a call for more options, not a finalized standard. Practically nobody deployed it. Withdrawing it is the process working, not failing.
- The real standards are untouched. The finalized NIST post-quantum signatures — ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) — are unaffected, as is ML-KEM (FIPS 203) for key exchange. Different math, different assumptions.
- Classical crypto is fine. ECDSA, RSA, AES-256 as you use them are not implicated. Bitcoin runs ECDSA; TLS is unaffected. No coins, no sessions, no signatures you rely on moved.
- The AES headline is a lab result. A companion paper sped up the strongest known attack on 7-round AES by 200–800× — but it's a reduced-round academic attack needing more than 400 octillion chosen messages, and it does not extend to the full 10-round AES protecting real traffic.
Cryptographer Matthew Green's independent read lands in the same place: genuinely impressive, genuinely not a reason to change your TLS config tonight.
The part you should sit with#
Strip away the panic and the reassurance and one thing is left, and it's the thing that matters for anyone building software: "it's been peer-reviewed for years" is no longer the guarantee it was in January.
For most of computing history, "smart people looked at this hard and found nothing" was your best available proxy for "this is safe." What changed this week is that an AI, running a reproducible, affordable, repeatable research loop, found real structural mathematics that a specialist community had missed. That is a different kind of tool than a faster brute-forcer. And it cuts exactly two ways at once. The same loop that lets a standards body pre-emptively break its own candidates before an adversary does — Anthropic frames this as defensive work, and the HAWK withdrawal is the receipt — is a loop your adversaries can rent for six figures.
For a solo founder or a small team, the practical translation is unglamorous and immediate:
- Know your primitives. Inventory the signature, KEM, and hash algorithms your product actually depends on. You cannot reason about exposure you can't name.
- Prefer finalized standards for production. Ship ML-DSA, SLH-DSA, and ML-KEM before reaching for on-ramp candidates. HAWK is this month's argument for that rule.
- Downgrade "audited" from proof to prior. Peer review is still necessary. It is no longer sufficient. Design as if a cheap, tireless researcher will re-examine your assumptions — because now one can.
The comforting story is "AI broke crypto, be afraid." The boring, correct story is that a candidate scheme did exactly what the process is supposed to make it do — fail early, in public, before anyone depended on it — and it was an AI that pushed it off the ledge. If you want the actionable follow-up, we mapped the post-quantum signature schemes that survived, and which one to actually ship.
