Claude Mythos did not break the full AES cipher protecting a large share of the world’s digital data and payments. Anthropic’s cybersecurity prototype helped discover a new attack on a deliberately reduced version of AES and an improved attack on HAWK, an experimental digital-signature scheme.
The research matters because it shows that advanced AI can help cryptographers explore difficult problems. It does not mean criminals can suddenly decrypt bank cards, HTTPS connections or properly protected databases.
What did Claude Mythos Preview discover?
Anthropic describes Mythos Preview as a model specialised in finding and exploiting computer vulnerabilities. The company says it has identified weaknesses in cryptographic libraries and contributed to two cryptanalysis results involving reduced-round AES and HAWK.
For AES, researchers studied a version with fewer transformation rounds than the standard cipher. Each successive round further mixes the data and secret key. Removing rounds intentionally makes the construction easier to analyse and allows researchers to test new ideas.
Why is the AES used in payments still considered secure?
AES normally uses 128-, 192- or 256-bit keys and performs 10, 12 or 14 rounds respectively. Anthropic’s reported research concerns fewer rounds, not those full configurations.
This distinction is crucial. An attack on a reduced model helps measure an algorithm’s safety margin, but it does not automatically extend to the deployed cipher. Anthropic explicitly states that the result does not break full AES.
Payments also do not depend on AES alone. Modern systems combine encryption, authentication, temporary keys, secure hardware, payment tokens and fraud controls. A theoretical weakness in an experimental target does not compromise that entire chain.
What is HAWK and why is the attack noteworthy?
HAWK is a digital-signature scheme designed with resistance to future quantum computers in mind. A signature does not conceal a message; it proves authenticity and helps show that information was not altered.
Anthropic says Mythos Preview found a previously unknown attack in about 60 hours that substantially reduced the estimated security of one HAWK parameter set. The scheme’s designers were able to review the work. HAWK is nevertheless a research proposal, not a standard currently protecting everyday card payments.
Why does the advance still matter?
Cryptanalysis combines scientific literature, mathematical intuition, programming and experimentation. A model that can explore many hypotheses may accelerate this work, identify overlooked structures and assist human researchers.
That can benefit defenders by testing algorithms before adoption and helping repair cryptographic libraries. It also creates risk if powerful models allow attackers to automate vulnerability research. Anthropic therefore restricts Mythos access to selected security organisations.
Five facts to remember
- Full AES has not been broken.
- The experiment targeted reduced-round AES.
- HAWK is a proposed signature scheme, not a common payment system.
- The findings are still significant for cryptographic research.
- Consumers do not need to replace cards or passwords because of this announcement.
Primary source: Anthropic’s technical publication about Claude Mythos Preview. This article separates the company’s claims from their demonstrated real-world consequences.