The HAWK Mythos attack has ended the post-quantum digital signature scheme’s run as a possible US cryptography standard. After Anthropic said its Mythos security model helped find a serious weakness in HAWK, a HAWK developer told NIST’s PQC Forum on Tuesday that he was withdrawing the candidate.
HAWK was a digital signature proposal built for the post-quantum era, meaning it was designed to resist attacks from future quantum computers. Post-quantum cryptography is not magic quantum dust. It is conventional software and math chosen because known quantum algorithms are not expected to break it the way they threaten RSA and elliptic-curve systems.
The National Institute of Standards and Technology had already put HAWK through two testing rounds for post-quantum cryptographic algorithms. It was in a third round meant to find exactly this sort of problem before anyone blessed it as a standard.
What did Mythos find in HAWK?
Anthropic said Mythos improved the best-known attack against HAWK’s underlying math after about 60 hours of work and roughly $100,000 in compute. According to Ars Technica’s report on the findings, the human operator was an Anthropic researcher without cryptography expertise, which is the part Anthropic would very much like everyone to notice.
HAWK depends on the assumed difficulty of the Lattice Isomorphism Problem. The known classical attack looks for automorphism symmetries, structures that can make the problem easier to solve. Anthropic said Mythos produced a previously unknown way to find those symmetries, cutting HAWK’s effective key strength in half.
That does not mean someone can now crack deployed banking or messaging systems with a laptop and a grudge. HAWK was still a candidate, not a finished standard. The attack also targeted challenge instances, deliberately weakened versions used by researchers to stress-test designs. Still, in cryptography, an algorithm can be considered broken if an attacker can recover a key faster than brute force would require.
The weakness could be addressed by increasing HAWK’s key size, according to the reported analysis. The catch is that larger keys add computational cost, making HAWK less attractive next to other post-quantum signature schemes already in the field, including ML-DSA and FN-DSA.
Matthew Green, a Johns Hopkins cryptographer, wrote that the notable part was not Mythos inventing new mathematics from the void. In his view, the model combined existing tools that cryptographers already knew about but had not previously assembled in this way. Google post-quantum cryptography expert Sophie Schmieg wrote that HAWK had already looked vulnerable and that this result effectively finished it as a candidate.
What about the AES result?
Anthropic also said Mythos found an improvement against a weakened version of AES, the block cipher used widely across modern systems. That result is more limited. It involved a meet-in-the-middle attack under a chosen-plaintext model, where an attacker studies many known inputs and encrypted outputs to infer information about a key.
Green wrote that Mythos-generated code reduced the required number of plaintext inputs from about 2^105 to about 2^89 by using a more sophisticated fingerprinting technique called a Möbius Bridge. Anthropic said that could cut attack time by 200 to 800 times.
The caveats are doing real work. The tested AES variant used seven rounds, while standard AES uses 10, 12, or 14 rounds depending on key size. The input requirement remains far beyond practical use outside a lab. Anthropic acknowledged most of those limits, while arguing that AI systems may soon generate more cryptanalysis results than human researchers can quickly verify.
That claim deserves the usual vendor discount. Anthropic has an obvious interest in making Mythos look indispensable, and the strongest result landed on a young algorithm already under review. Even so, HAWK’s withdrawal gives AI-assisted cryptanalysis a concrete entry in the standards process, which is more than a demo reel.
This story draws on original reporting from Ars Technica.
