An AI Broke a Post-Quantum Candidate in 60 Hours. The Lesson Is Crypto-Agility, Not Panic.

· Threat Intel · 7 min read

What happened

On 28 July 2026, Anthropic published research showing that its restricted Claude Mythos Preview model had found a new key-recovery attack against HAWK, a lattice-based digital signature scheme in NIST's additional post-quantum signature process. HAWK was the only lattice-based scheme among the nine candidates NIST advanced to the third round of that process in May 2026.

The model worked for roughly 60 hours in a multi-agent setup. A human researcher supplied direction and compute, but was not a lattice specialist. Anthropic put the API cost at about $100,000 and released the papers and reproducibility code.

Within days, the HAWK team withdrew the scheme. NIST's own post-quantum page now states that HAWK will not be standardized or deployed.

How serious was the break?

Precision matters here, because the headlines were louder than the maths.

  • The attack exploits a previously unused symmetry (automorphism) in HAWK's lattice, building on earlier academic work by van Gent and Pulles that had opened the path but not made it usable.
  • Against HAWK-256, a small challenge parameter published as a cryptanalysis target, the expected key-recovery work fell from about 2^64 to 2^38. Anthropic's code recovers working signing material in a few hours on a 96-core server.
  • For the real security levels, the estimates fell from about 2^150 to 2^108 (HAWK-512) and 2^288 to 2^182 (HAWK-1024). Both remain impractical to attack.
  • The attack is still exponential. It is not a polynomial-time break, and Anthropic says it does not extend to other candidates or to lattice cryptography in general.

The same release included a 200x to 800x speedup on a known attack against seven-round AES-128 (the real cipher has ten rounds). It still needs an impractical number of chosen plaintexts. Anthropic says no production software needs to change.

What it does NOT mean

NIST is explicit: ML-KEM (FIPS 203) and ML-DSA (FIPS 204) are unaffected. They rely on different mathematical foundations, and they remain ready for implementation now. SLH-DSA (FIPS 205) is hash-based and untouched.

So this is not a reason to pause post-quantum migration. If anything, it is a reason to stop treating migration as a one-time project.

What it DOES mean: the review clock just got faster

HAWK survived years of expert human review. A frontier model found a meaningful structural weakness in about 60 hours. Two consequences follow for any regulated institution:

1. Algorithms will keep changing

The NIST process is working exactly as designed: weak candidates get found and removed before deployment. But the pace of that process is accelerating. An estate that took five years to move from RSA to ML-KEM cannot afford another five-year project the next time an algorithm, parameter set, or implementation needs replacing.

2. Crypto-agility is the real deliverable

Crypto-agility is the ability to swap algorithms, key sizes, and libraries without rebuilding the systems that depend on them. It requires three things most banks do not have today:

  • A living inventory. A continuously updated Cryptographic Bill of Materials (CBOM) that says where every algorithm, key, and certificate lives and who owns it.
  • Abstraction. Cryptography configured through policy and central libraries, not hardcoded in hundreds of applications.
  • Repeatable change. A tested path from "this algorithm is now deprecated" to deployed replacement, with evidence your regulator can inspect.

What to do this quarter

  1. Do not stop. Keep migrating key exchange to hybrid X25519 + ML-KEM-768 on your highest-value, longest-lived data flows. Harvest-now-decrypt-later is still the live threat.
  2. Stick to finalised standards. Deploy FIPS 203, 204, and 205. Keep candidates from ongoing processes in the lab.
  3. Inventory before you migrate. You cannot swap what you cannot find. Build the CBOM first, then keep it current.
  4. Design for the second migration. Every change you make now should make the next one cheaper. Centralise cryptographic configuration, and record what changed and why.

The HAWK story is good news told badly. The standards process caught a weak scheme before anyone relied on it. The institutions that benefit are the ones that can act on the next finding in weeks, not years.

Qypher builds and maintains your CBOM, scores quantum exposure against RBI, MAS and CBUAE expectations, and generates the post-quantum migration artifacts your team deploys, so the next algorithm change is a policy update, not a new project. Get a free assessment →

Sources: NIST Post-Quantum Cryptography project page (HAWK withdrawal note); Anthropic research release, 28 Jul 2026; The Hacker News and Ars Technica coverage, Jul 2026.