Artificial intelligence (AI) has helped researchers identify new weaknesses in two cryptographic systems, including a simplified version of the Advanced Encryption Standard (AES), the encryption technology used throughout much of the internet. Although the findings do not currently threaten passwords, bank accounts or everyday online transactions, experts say they could signal a new era in which AI assists security researchers in finding weaknesses in the mathematical foundations of digital encryption.
In a blog post published July 28, Anthropic’s Frontier Red Team said Claude Mythos Preview independently developed new cryptanalysis techniques targeting two systems: a reduced-round version of AES-128 and HAWK, an experimental post-quantum digital signature scheme being assessed through the U.S. National Institute of Standards and Technology’s (NIST) effort to standardize cryptography for the quantum computing era.
The findings do not mean that AI has cracked one of the internet’s most important encryption algorithms. Instead, they show how AI could help cryptographers discover weaknesses in experimental or deliberately weakened systems more efficiently.
Latest Videos FromLive Science
AI finds a faster attack on a weakened AES-128 variant
AES protects vast amounts of everyday digital activity, including encrypted websites, messaging apps, Wi-Fi networks, financial transactions and cloud services. However, the version examined by Anthropic was not the complete AES-128 algorithm used in real-world systems. Researchers instead studied a seven-round version of AES, a deliberately weakened model commonly used to test new cryptanalytic methods.
The full AES-128 standard uses 10 encryption rounds, while the Anthropic study focused on only seven. In a self-published study that has not been peer-reviewed, scientists Milad Nasr and Nicholas Carlini reported that Claude discovered a faster method for recovering the encryption key from the reduced-round system.
According to the researchers, the AI-assisted technique made the best-known attack between 200 and 800 times faster. Crucially, however, the method does not work against the full 10-round AES-128 algorithm used to protect real-world data.
The more notable result may involve HAWK. Unlike AES, which has protected digital information for more than 20 years, HAWK is a newer digital signature scheme designed to resist attacks from future quantum computers. It is one of the candidates being considered in NIST’s additional post-quantum signature standardization process and remains under review before any potential widespread deployment.
This development illustrates how AI can act as a powerful accelerator in cryptanalysis.
When combined with existing cryptanalytic techniques, the newly identified property made it significantly easier to recover HAWK’s secret key. Thomas Espitau, head of research at post-quantum cybersecurity company PQShield, described the work as “one of the most, if not the most significant, cryptanalytic result of the year.”
“To say it plainly, this is great work, and it is exactly what the NIST process is designed to produce,” Espitau told Live Science. “Candidate schemes exist to be attacked before they are deployed, not after.”
Espitau said the attack relied on established methods plus one important mathematical insight identified by Claude. The combination substantially reduced HAWK’s estimated security margin and demonstrated how AI could help researchers evaluate proposed cryptographic systems before they are adopted.
“This development illustrates how AI can act as a powerful accelerator in cryptanalysis,” Espitau said. “Claude Mythos Preview identified the exploitation of the sign-flip symmetry, providing the final piece of a puzzle that the research community had been assembling.”
What AI-assisted cryptanalysis means for cybersecurity
Despite the headlines, the research does not indicate that AI has suddenly surpassed human cryptographers or broken the encryption protecting the internet.
“There is nothing you need to change,” Roberta Faux, head of cryptography at cybersecurity and quantum encryption company Arqit, told Live Science. “Both Anthropic and the outside cryptographers agree that you don’t need to change your key sizes or switch your cryptography.”
Faux said the broader significance lies in AI’s ability to apply advanced cryptanalysis to thousands of algorithms that have received limited human attention.
“The interesting prospect is not a model outdueling the world’s best lattice theorist on one problem but a model applying solid, roughly expert-level analysis at scale to the several thousand ciphers nobody ever had the human-hours to examine,” she said.
Faux also cautioned against crediting AI alone for the HAWK result.
“The HAWK attack used no exotic ingredients; it simply competently assembled tools that were already lying around,” she said. “A post-quantum candidate is seriously scrutinized by maybe a few dozen people on the planet, so beating two years of review mostly reveals how thin that layer of review is.”
For consumers, the immediate implications are reassuring. The encryption used for online banking, shopping, messaging and cloud storage has not suddenly become obsolete. However, for cryptographers developing the next generation of digital security, the research suggests that AI could make it faster and easier to test future encryption and digital signature schemes for hidden weaknesses.
