Mythos Weakened a Post-Quantum Cipher for $100,000

So the way cryptography works, roughly, is that a bunch of very smart people propose a mathematical scheme, and then a bunch of other very smart people spend several years trying to break it, and if they fail we all agree to route our money through it. That's it. That's the mechanism. There is no proof that AES is secure. There is only the fact that twenty-five years of the world's best cryptanalysts have taken a swing at it and mostly missed, and we have collectively decided to treat sustained failure as evidence of safety, which, in fairness, is also how I evaluate my apartment building's structural engineering.

The economics of this arrangement have always been a little odd. Attacking a cipher is a career. You get a PhD, you get a postdoc, you spend three years on a problem, and if you're lucky you shave a factor of four off somebody else's attack on a version of the cipher nobody uses. The supply of attacks is limited by the supply of cryptanalysts, which is limited by the number of humans willing to do this instead of getting paid a great deal more to do almost anything else.

On July 28, Anthropic published a blog post reporting that its Claude Mythos Preview model had produced two novel cryptanalytic results, and that each one cost about $100,000 in API credits. I want to sit with that number for a second, because the technical results are interesting but the number is the story and it's a ripper.

The results, briefly

There are two, and neither one breaks anything you use.

One. HAWK is a digital signature scheme submitted to NIST's competition for post-quantum cryptography — the ongoing project to replace the signature algorithms that a working quantum computer would eventually flatten. HAWK is a third-round candidate. It had survived two rounds of expert review over two years, which is the whole point of the process: publish it, let everyone attack it, see what's left standing.

Mythos found a symmetry in the specific mathematical lattice HAWK uses — a "nontrivial automorphism," a phrase I am reproducing faithfully and will not attempt to unpack. Earlier work had proven that if such a symmetry existed and could be found efficiently, HAWK would be weakened. Nobody knew whether it was actually there. It was. The model found it in about sixty hours.

The effect is to halve HAWK's effective key size. Recovering a HAWK-256 key was thought to cost around 2⁶⁴ operations; Anthropic demonstrates 2³⁸. Still exponential, still specific to HAWK, doesn't touch other lattice schemes. You can fix it by doubling the key size, except that doubling the key size removes most of the reasons anyone liked HAWK, which is the cryptographic equivalent of "we can save the patient but he'll no longer be the patient."

Two. AES-128 has ten rounds. Mythos improved an attack on a version with seven, under a threat model that assumes the attacker can get 2¹⁰⁵ chosen plaintexts encrypted, a quantity of data I would describe as "not available." It invented a technique it named the Möbius Bridge, which eliminates a 2⁵⁶ guessing step in a meet-in-the-middle attack and makes the whole thing 200 to 800 times faster. Real AES is fine. Reduced-round attacks are how cryptographers estimate the safety margin on the full cipher, and this one narrows the margin slightly.

Anthropic disclosed to HAWK's authors in June, coordinated with NIST's public mailing list, briefed government and industry, and shipped both papers plus demonstration code. This is genuinely good behavior and I want to say so before I say anything else.

The part where the model didn't want to

When the researcher first pointed Mythos at AES, it declined. Not for safety reasons. It thought the project was stupid. It wrote things like AES-128 r5/r6 is just genuinely hard and there's nothing easy to find; this is the most-studied block cipher in existence, which is, and I cannot stress this enough, the correct view. That's what a well-calibrated cryptographer would say. It's what I'd say. It's what the model had learned by reading everything humans have written about AES, which is that attacking AES is a great way to spend three years and publish nothing.

So the researcher sent it a note, which Anthropic published with the typos intact:

"the models tend to think it is impossible to solve so they don't try they [sic] need a good amount of prompting."

And then three more messages over three days, all in the register of a hockey coach between periods. We want to find new attacks. We need to find something that worth publishing. We are not looking for low hanging fruit. In between, the model produced several hundred million tokens of autonomous work — a billion by the end — and arrived at the Möbius Bridge.

I find this genuinely funny and also slightly unnerving. The binding constraint on a system capable of extending twenty-five years of cryptanalytic literature was that it had absorbed, from us, the entirely reasonable belief that trying wasn't worth it. The fix was encouragement, delivered with grammatical errors, for free. A meaningful fraction of what we've been calling "capability" turns out to be nerve, and nerve is apparently something you can just hand over.

The number

$100,000 per result. Twice.

That is less than a postdoc. It is less than the catering at a mid-sized conference. It is, in crypto terms, a rounding error on a Series A. And what it buys you is a result that would have been the strongest line on a cryptographer's CV.

Once a category of intellectual labor has a list price, the market for it reorganizes, and it does not reorganize in favor of the incumbents. Anthropic also mentions, almost in passing, that it built a scaffold to attack AES autonomously and then, out of curiosity, pointed the same scaffold at HAWK to see whether it could rediscover that break independently. It could. So the $100,000 does not buy one result. It buys a machine that produces results, and the machine is not fussy about the target. Which brings me to the thing that will actually matter.

Verification is the new bottleneck

Mythos took about a week to find the AES attack. It took two Anthropic researchers roughly a month and several hundred hours to convince themselves the attack was correct.

That ratio is the entire future. Discovery got cheap; checking did not. The HAWK result was easier to trust because it runs end-to-end — you generate a key, you run the attack, you get the key back, and belief becomes unnecessary. The AES result is an argument, and arguments have to be read by humans who understand them, and there are maybe a few hundred such humans, and they are busy, and they are not paid for this.

Anthropic says as much, and says it about the field generally: human researchers may become bottlenecked on validating machine output. We have watched this happen already in vulnerability disclosure, where automated bug-finding produces reports faster than maintainers can triage them, and the practical result for a volunteer-run project is not more security but a full inbox and a person who quits. Peer review is a gift economy staffed by tired people at 11 p.m. It has no surge capacity.

Yes, fine, what about your coins

Nothing here touches Bitcoin. But note what Anthropic lists in its "further work" section: a practical 13-round attack on LEA, an ISO-standardized lightweight cipher, that recovers a key in under an hour on a desktop; an improved attack on 6-round Serpent; and smaller gains — under 10× — against Salsa20, SHA-1, and Poseidon.

Poseidon is the hash function underneath a great deal of zero-knowledge infrastructure. A sub-10× improvement is not an emergency. It is, however, the first time a language model has shown up in the same sentence as a primitive that large parts of the ZK ecosystem depend on, and Anthropic's stated view is that these are early results they expect to improve.

The bigger point is structural. The whole reason NIST is standardizing post-quantum signatures is that ECDSA dies to a sufficiently large quantum computer, and Bitcoin's answer to that is currently a pair of draft proposals — BIP-360, which introduces a quantum-resistant output type, and BIP-361, published in April by Jameson Lopp and co-authors, which would sunset legacy signatures and eventually freeze coins that haven't migrated. As of March, per that proposal, more than a third of all bitcoin sits at addresses that have exposed a public key. One BIP-361 co-author has estimated a full migration would take about seven years from the day consensus forms, and consensus has not formed.

So: the replacement schemes are being selected right now, by a process that has just demonstrated it can be outpaced by a model on a $100,000 budget over a long weekend. The chain that will have to adopt one of those schemes moves on a seven-year timeline and cannot compel anybody to do anything.

None of this is a reason to panic, and the disclosure norms are voluntary is a sentence I'd rather not have to keep writing. Anthropic did the right thing and also demonstrated to everyone else that the thing can be done. A year ago these models couldn't attack a toy cipher. Now one of them is improving on the literature after being told, essentially, to believe in itself.

The subsidy nobody accounted for

Here is the thing I keep coming back to.

AES is safe because thousands of expert-years have been thrown at it and bounced off. But AES is one algorithm. The world runs on hundreds. There is a cipher in your car key and your building's access badge and the smart meter on the side of your house. There is one in the industrial controller at a water treatment plant, and in the satellite modem on a container ship, and in a pacemaker, and in a payment terminal that was certified in 2011 and will be replaced when it physically dies.

Almost none of these got twenty-five years of adversarial attention. They got a design review, a standards committee, and then two decades of nobody bothering. That wasn't negligence. It was economics. Attacking an obscure cipher meant a cryptographer spending a year of their life on a target with no prestige and no publication, so nobody did it, so the cipher held. We have been running global infrastructure on security-by-lack-of-interest and quietly recording it on the books as security.

That subsidy was human attention scarcity, and it is being withdrawn. Anthropic's LEA result is exactly this shape: a lightweight cipher standardized in ISO/IEC 29192-2, designed for low-power devices, largely unexamined, and now partially attacked by a model in a fraction of the time a person would need. The full 24-round version is unbroken and the finding is preliminary. The category is the point.

And the category has a brutal asymmetry built into it. The systems with the least-scrutinized cryptography are, almost by definition, the ones that are hardest to patch — firmware, embedded chips, hardware in orbit, devices inside human bodies, controllers in buildings that nobody wants to take offline. Discovery is now measured in days and costs six figures. Remediation is measured in procurement cycles and costs a great deal more, if it's possible at all. Those two clocks used to run at roughly the same speed. They no longer do.

The stakes here aren't really about secrecy, either, which is the part people get wrong. Cryptography mostly does authentication: it's what lets a bank know it's you, a car know it's the right key, a device know a software update actually came from the manufacturer. Privacy failures leak information. Authentication failures let someone be you. If signature schemes get shaky, what erodes isn't confidentiality — it's the ability of any system to know who it's talking to, which is a load-bearing assumption for basically everything built in the last thirty years.

The honest counterweight is that this cuts both ways, and possibly cuts harder in the right direction. If it costs $100,000 to attack a cipher, it also costs $100,000 to audit one, and a utility or a chip vendor or a standards body can now afford to check the thing in its own product — which was never true before, because there was no cryptographer to hire. Anthropic frames this as an opportunity to finally examine the long tail, and it is one. Weaknesses that get found by a lab that publishes are strictly better than weaknesses that sit undiscovered until someone who doesn't publish finds them.

But you don't get to choose which side moves first, and the models aren't exclusive. Somebody has comparable capability, a similar budget, and no plans to email NIST. Anthropic more or less says this out loud — it asks what the world should do when a model finds a break that does matter, and admits it doesn't know.

The comforting version of this story is that cryptography has always worked by adversarial review, and the reviewers just got faster. That's probably right. The uncomfortable version is that we built a civilisation on the assumption that attacking things was expensive, wrote that assumption into nothing, priced it into nothing, and are now finding out what it was worth.