HAWK Withdrawn After AI-Assisted Attack Halves Key Strength
Anthropic's Mythos AI security model has dealt a fatal blow to HAWK, a post-quantum digital signature scheme that was under consideration as a US standard. After about 60 hours of work and $100,000 in compute costs, Mythos improved the best-known attack on HAWK, effectively cutting its key strength in half. The developer of HAWK withdrew the algorithm on Tuesday.
HAWK had survived two rounds of testing by NIST for post-quantum cryptographic (PQC) algorithms. It was in a third round designed to catch precisely these kinds of flaws. The algorithm relied on the hardness of the Lattice Isomorphism Problem, believed safe from quantum attacks. The best-known classical attack exploited automorphism symmetries. Mythos discovered a previously unknown method to find such symmetries, breaking the algorithm.
Matthew Green, a Johns Hopkins cryptography professor, noted: "What's particularly concerning (and so especially ripe for AI) is that the attack does not invent fundamentally new mathematics. It simply extends a bunch of tools that were lying around and well-known, and gets a good result."
Sophie Schmieg, a PQC expert at Google, confirmed HAWK's demise: "Basically with this paper, HAWK is dead." The weakness can be mitigated by doubling the key size, but that makes HAWK less competitive than existing PQC signing algorithms like ML-DSA and FN-DSA.
Mythos Also Targets AES, But Less Dramatically
Mythos also improved a meet-in-the-middle attack on a weakened version of AES (7 rounds instead of the standard 10-14). The new technique, using a Möbius Bridge, reduced the number of required plaintext inputs from 2^105 to 2^89 — a 200- to 800-fold reduction in time. However, the attack remains infeasible outside the lab, and the real AES uses more rounds, so the actual speed-up is unknown.
How Mythos Worked
Mythos operated semi-autonomously with occasional human guidance. It performed an extensive literature review, mathematical reasoning, and computational experiments. Two separate agents worked largely independently: one initially rejected the method, the other found a way to make it work. They eventually converged and verified the attack end-to-end.
Caveats and Implications
Anthropic is careful to note that the attacks are incremental and don't break any cryptosystems in production. The cryptosystems tested were weakened "challenge instances" provided by the authors. Even with improvements, the underlying primitives remain safe for now. Both attacks would likely be infeasible outside testing environments.
Still, the results signal a potential shift in cryptanalysis. Anthropic argues that language models can now produce novel research outputs autonomously, potentially bottlenecking human researchers on validation. The cybersecurity community is already grappling with AI-discovered bugs outpacing human triage.
What This Means for Developers
For now, no production systems are affected. But developers should watch for further developments in AI-assisted cryptanalysis. The HAWK withdrawal underscores the importance of rigorous adversarial testing for PQC algorithms. If you're evaluating PQC signatures, ML-DSA and FN-DSA remain viable; HAWK is off the table.
Conclusion
AI-assisted cryptanalysis is still untested, and vendors have incentives to hype their results. But the evidence is mounting that LLMs can find cryptographic weaknesses that humans miss. The race between securing and compromising our most vital assets just got a new player.
