Matthew Green’s assessment of Anthropic’s cryptanalysis is less dramatic than the headlines around an AI finding crypto flaws, and more useful: the company’s two reported results have very different consequences. Green says the attack on HAWK, a proposed post-quantum signature scheme, is consequential. The reported improvement against a reduced-round version of AES does not put deployed AES at risk.
Anthropic attributed both findings to its unreleased Claude Mythos model. Green, a cryptographer at Johns Hopkins, wrote on July 29 that the work indicates advanced models can absorb prior cryptanalysis research, combine its methods and extend them into new attacks without close technical supervision. That is a capability worth watching. It is not evidence that production encryption has fallen over.
Does Anthropic’s AES result affect AES used in real systems?
No, according to Green’s analysis. Full AES uses 10, 12 or 14 rounds depending on key size. The Anthropic result concerns a deliberately weakened seven-round version, a common research target because attacks on full ciphers are considerably harder to develop.
Green describes the new AES technique as a modest constant-factor improvement over published attacks on seven-round AES, rather than a new practical break. It also assumes an attacker can obtain an infeasible number of encryptions of chosen plaintexts under the target’s secret key. The claimed improvement may remain only a paper result, he adds, because its real-world runtime benefit has not been established by executing an attack at the stated scale.
Anthropic has separately said neither finding requires changes to current production software. That caveat survives scrutiny in Green’s account: a seven-round research variant is not the AES deployed in browsers, storage systems and messaging software.
Why the HAWK finding carries more weight
HAWK was a proposed post-quantum digital-signature scheme, not a deployed or standardized algorithm. It was being evaluated for a possible future standard, however. Independent reporting by Ars Technica said HAWK’s developer withdrew it from the NIST process after Anthropic’s announcement.
Green says the reported key-recovery attack remains exponential-time, but roughly cuts HAWK’s security bits in half. Increasing key sizes could theoretically offset that loss, he wrote, though doing so erodes the efficiency advantage that justified HAWK as a candidate.
The researchers demonstrated code that recovered keys within hours against a weaker challenge instance supplied for testing, rather than HAWK’s proposed deployment parameters. That does not amount to a field attack against live systems. It does, Green argues, expose a weakness sufficiently serious to damage the scheme’s case for standardization.
What unsettled Green was the mechanism. The approach did not depend on a new mathematical breakthrough. It joined and extended established techniques that researchers already knew about. AI systems may be especially effective at that kind of exhaustive synthesis, where the hard part is pursuing combinations humans failed to try.
Verification remains the constraint
Green’s larger warning is aimed at research review, not consumer panic. A model can generate a result that looks persuasive while being wrong or misleading, he says. For an executable HAWK-style challenge attack, independent reviewers can run the code and check whether it recovers a key. Theoretical speedup claims such as the AES work require more expert examination.
Formal proofs can help, Green notes, but experts must still judge whether the theorem being proved captures the relevant security claim. More AI-generated leads may accelerate cryptanalysis during the transition to post-quantum systems. They will also create more work for the humans asked to determine which ones are real.
This story draws on original reporting from A Few Thoughts on Cryptographic Engineering.
