Askhat - stock.adobe.com
What Claude Mythos revealed about post-quantum security
Quantum computing will break standard security codes and change how we protect data and prepare for the future. Claude Mythos proved we're still not ready for the quantum era.
Cryptographic algorithms are a foundational approach for securing data and protecting digital communications. The HAWK cryptographic vulnerability recently exploited by Anthropic's Claude Mythos Preview was a design flaw that exposed a blind spot in post-quantum security standardization.
The compromised HAWK algorithm won't be an isolated phenomenon, and the emergence of competing models and open-source initiatives could accelerate the trend. In fact, less notable system compromises have occurred. Anthropic's Claude Mythos Preview model has identified thousands of high- and critical-severity vulnerabilities across every major operating system and web browser, discoveries that were beyond its stated training goals.
Researchers, companies and international standards bodies are collaborating to protect against flaws in next-generation security, such as "harvest now, decrypt later" (HNDL) cyberattacks. Meanwhile, Claude Mythos and other frontier AI models are exposing vulnerabilities at an unprecedented rate using established tools and conventional techniques. The compromised HAWK algorithm exposes systemic issues with post-quantum cryptography as well as future verification issues. It also represents a breakthrough, demonstrating weaknesses that researchers can acknowledge and resolve.
Searching for post-quantum assurance
In April 2026, Anthropic first released Claude Mythos Preview as the core model within Project Glasswing, a restricted-access consortium that controlled the model and used it to prevent AI-assisted cyberattacks. On July 28, the model compromised HAWK, a cryptographic security scheme built by researchers in the Netherlands. The National Institute of Standards and Technology had been conducting a comprehensive analysis and review of the HAWK algorithm as part of its search for quantum-resistant cryptography.
Modern IT security comprises digital ciphers, like the Advanced Encryption Standard, the Data Encryption Standard and the Rivest-Shamir-Adleman (RSA) cryptosystem. These standard encryption algorithms authenticate websites and protect data as it travels across networks. Such computational security schemes are vulnerable to quantum-based attacks. Discovering airtight security is urgent due to the breakneck pace of AI and quantum development.
The current juncture is historic as we transition from current public-key cryptography to post-quantum algorithms based on novel problems. This represents a fundamental shift for digital processing in the AI era. Quantum technology can easily break digital signatures, protected web traffic and key exchanges. Its potential to compromise today's IT systems is driving the rise of HNDL breaches. Furthermore, the HAWK attack raises an unsettling question: Are current IT systems and society at large prepared for a post-quantum world?
What the HAWK breach means for post-quantum cryptography
HAWK's algorithm consisted of a digital signature designed to withstand future quantum attacks. The cryptographic signature was based on an algebra-rich number system. As part of its structure, HAWK used a hidden lattice symmetry, a multidimensional grid of points that, in cryptographic terminology, is considered a "messy" configuration, posing a nearly infinite degree of complexity in finding an entry point. Through a structural "folding" of HAWK's lattice symmetry, Claude Mythos Preview discovered an entry point in record time. The result effectively halved HAWK's security margin, reducing its key size and exposing the vulnerability.
The HAWK attack presents opportunities and challenges. Enterprise leaders and researchers will need to reassess proposed post-quantum cryptographic standards, particularly as they apply to enterprise and business risks related to HNDL attacks. They will also need to reconsider the implications for human involvement in verifying AI breaches.
While AI accelerates the exposure of mathematical flaws, substantiating the results will require a significant increase in research hours. Moreover, potential process bottlenecks could affect how organizations review these exposures. Including multi-agentic AI in that review process could help to reduce false positives while incorporating new checks and balances. But the integration would also present a whole new set of skill challenges, requiring research proficiency in applying business logic to code reviews in addition to building trust boundaries with AI.
In software engineering and development, defensive AI agents can repeatedly test exploits against IT systems. However, this approach requires weeding out false positives, confirming suspected vulnerabilities and patching flaws. Vulnerability operations could become standard practice within software development to cover these new concerns. Another unintended consequence of patching is that it can be reverse-engineered, analyzed and turned into a new exploit blueprint for future attacks, further reducing the time between discovering a weakness and deploying a patch.
Finally, the threat of proliferating open-source models capable of matching or exceeding Claude Mythos's capabilities remains a possibility, leading to a growing attack landscape. It's clear that the baselines for AI performance have been steadily shifting as models continue to gain increased aptitude and more profound capabilities. The question remains: how quickly can we adapt to these advances?
In the HAWK attack, Claude Mythos executed a cryptographic probe in uncovering vulnerabilities using standard, well-known tools. In the current transition from RSA-based public-key approaches to post-quantum security, the goal of cryptanalysis is to ensure the requisite strength and integrity are in place to withstand post-quantum attacks. Perhaps the HAWK-Mythos compromise suggests a redoubling of research into novel code- and lattice-based cryptography, aided by AI's cryptanalysis capabilities.
Kerry Doyle writes about technology for a variety of publications and platforms. His current focus is on issues relevant to IT and enterprise leaders across a range of topics, from nanotech and cloud to distributed services and AI.
