Carr Digital

Analysis · July 30, 2026

What the AI actually broke (and what it didn't)

An AI model found a real attack on HAWK, a post-quantum signature candidate, and the candidate withdrew from the NIST process. The deployed standards are fine. Here's the accurate version, with sources.

Danny B. Carr, Jr.

Last week Anthropic disclosed that one of its models, working mostly unsupervised for about 60 hours, found a genuinely new attack on a post-quantum signature scheme called HAWK. By midweek the headlines had it “cracking post-quantum cryptography.” If you run deployed cryptography for a living and that phrase spiked your blood pressure, the accurate version is better news and a more interesting story.

I write about post-quantum migration with a simple rule: every claim is either measured by me or cited to a primary source, and labeled. Everything below about the attack itself is the second kind. The sources are at the bottom, and they’re worth your time.

The part that’s true

HAWK is a lattice-based signature scheme that was competing in NIST’s additional digital signatures process, the follow-on competition to the standards that shipped in 2024. Its pitch was compact signatures and fast verification. It was a candidate. It was not deployed anywhere, and it was not a standard.

Anthropic pointed a research preview of its Mythos model at HAWK inside a scaffold that gave it Python, a computer algebra system, and a pile of published cryptography literature. Per the disclosure posted to the NIST pqc-forum, the model found “an improved key recovery attack against HAWK-n that reduces to SVP in dimension n/2 + 1,” built on a previously unexploited symmetry in HAWK’s lattice, a nontrivial automorphism. In plain terms: the model found a structural shortcut that lets an attacker work in a lattice problem roughly half the size the designers were counting on.

The numbers, from the same disclosure:

Parameter set Estimated attack cost before After
HAWK-256 (smallest) 2^64 2^38
HAWK-512 2^150 2^108
HAWK-1024 2^288 2^182

Two things are true about that table at the same time. The attack is still exponential; 2^108 operations is not something anyone runs this decade. And the security margin the scheme claimed is gone, because the whole point of a parameter set is the gap between “claimed” and “reachable,” and that gap just shrank by 42 bits at HAWK-512 and by 106 at HAWK-1024.

The HAWK team did the honorable thing, and did it fast. They helped verify the result before disclosure, and the day after publication they withdrew HAWK from the NIST process, noting that the available fixes, doubling parameters or moving to higher-rank modules, “would make HAWK uncompetitive.” NIST marked the candidate withdrawn. A signature scheme died in review this week. That’s a real event with a real body count of one.

The part that’s false

Nothing you have deployed got weaker. The finalized NIST standards, ML-KEM (FIPS 203) for key exchange, ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures, are unaffected, and Anthropic said so in the disclosure itself: the attack “is specific to HAWK and does not impact other NIST post-quantum signature candidates or lattice-based cryptography in general.”

The reason is worth understanding, because “lattice scheme broken, and my new stuff is lattices too” is exactly the wrong lesson to walk away with. HAWK’s security rests on the Lattice Isomorphism Problem: given two descriptions of the same lattice, find the map between them. Its keys hide structure behind symmetry. ML-KEM and ML-DSA rest on Module-LWE: recover a secret from a system of linear equations that has deliberate random noise mixed in. Their keys hide structure behind error. The attack was a symmetry hunt, and it found a symmetry HAWK’s specific design carries. It’s a factory defect in one lock design, not a new way to pick locks. And SLH-DSA isn’t even a lattice scheme; it’s built from hash functions and lives in a different neighborhood entirely.

I spent the last month rebuilding ML-KEM’s pipeline from the FIPS 203 spec in a toy lab, rings, NTT, compression, failure rates, the works. The object this attack exploits, a hidden symmetry in the key’s lattice, has no analogue in that construction that anyone knows how to use. That’s not a security proof, and nobody honest will hand you one. But it means “no known transfer” is a statement about structure, not vendor reassurance.

The AES footnote

The same disclosure included an improved attack on AES-128 reduced to 7 of its 10 rounds, some 200 to 800 times faster than the previous best result, which had stood since 2013. Reduced-round attacks are how cryptanalysts measure a cipher’s safety margin; it’s like proving you can pick a lock after the manufacturer agrees to remove three of its ten pins. Genuinely impressive, tells you something about the margin, changes nothing at the door. The attack also needs 2^105 chosen plaintexts, which is more ciphertext than every computer on Earth has ever produced, combined. That’s an attack you publish, not an attack you run. AES is fine.

The actual story

The story isn’t “AI breaks encryption.” The story is that the cost of finding attacks just dropped, hard. This result took roughly 60 hours of model time, about $100,000 in compute, and a human supervisor who, by Anthropic’s own description, is not a lattice cryptographer and mostly provided project management. Years of open review by people who are lattice cryptographers had not found it. Meanwhile, verifying the model’s output took the humans several hundred hours. The machine moved the needle on discovery. Trust still costs what it always cost.

If discovery is now partly a compute-budget question, three things follow.

First, expect more candidate carnage, and be glad about it. Public review exists to kill weak schemes before they ship. A withdrawal in a standards process is the system working; the same flaw found in 2031 would have been a fleet-wide firmware incident. HAWK failing the stress test in design review is the good timeline.

Second, the verification bottleneck is the new choke point. Machine-found attacks arrive faster than expert-hours to check them. The teams that build muscle for validating claims quickly, with reproducible evidence rather than authority, are the teams that stay ahead of this. That’s true for standards bodies and it’s true for your security org.

Third, this is the argument for hybrid deployments, arriving on schedule. The reason TLS is rolling out X25519MLKEM768, a classical key exchange and a post-quantum one glued together, is precisely that new math occasionally surprises us. When one assumption family has a bad week, the other one keeps the lights on. That design choice looked conservative in 2024. It looks like plain sense this week.

If your boss asks

  • An AI found a real weakness in a candidate signature scheme during NIST’s public vetting, and the candidate withdrew. That’s the review process working, faster than usual.
  • None of the finalized standards (ML-KEM, ML-DSA, SLH-DSA) are affected. Different underlying math, confirmed by the researchers who found the attack.
  • AES is fine. The new result improves an attack on a reduced-round variant and needs more chosen plaintext than the world has ever encrypted.
  • The lasting change is economic: attack discovery got cheaper, so favor crypto agility and hybrid deployments, and assume more candidates die in review from here on.

Provenance

Every claim above about the attack is Reported: it comes from the linked primary sources, read on 2026-07-30, not from a model’s memory or a headline. Where I describe my own lab work, the code and captured output are public in the book’s companion lab repo, and you can rerun it. If I got something wrong, email the studio and I’ll correct it here, with a note saying what changed.

Sources