Claude just uncovered two real cryptographic weaknesses, the kind of math flaws that matter to your banking app, your browser, and every "https" website you visit. One hits HAWK, a signature scheme built to survive future quantum computers. The other hits AES, the cipher your Wi-Fi and half the internet already run on. Neither breaks anything you use today, but both show something new: an AI model doing research-grade codebreaking on its own.

Anthropic announced the results on July 28, 2026, crediting the work to Claude Mythos Preview, its research-only model built for security and cryptography work. If the name is unfamiliar, that is fair. This is not a consumer chatbot moment. It is a frontier model getting turned loose on math problems that professional cryptographers have spent years staring at, and finding cracks they missed.

Here is the plain-language version of what happened, why it matters, and why you do not need to panic about your passwords.

Not the encryption you use. Both attacks are real, verified, and technically significant, but neither touches a system in production. HAWK is still just a candidate algorithm competing to become an official US government standard, not something protecting your data yet. AES was attacked only in a stripped-down "reduced round" version, 7 of its normal 10 rounds, which researchers use as a testbed and which is nowhere close to what actually encrypts your traffic.

Think of it like a security firm finding a design flaw in a vault that is still on the drawing board, plus a separate flaw in a training-dummy version of a vault that is already installed everywhere. Useful information. Not a break-in.

Cryptography writing loves jargon that scares off normal readers. Here is what the two terms in this story actually mean.

A digital signature scheme is how your browser confirms it is really talking to your bank's website and not an impostor. HAWK is a candidate for this job, specifically designed to survive attacks from quantum computers, which do not exist yet at the scale needed to threaten today's internet but which governments are already preparing for. NIST, the US standards body, has been running a multi-year public contest to pick the next generation of these schemes.

A symmetric cipher is the math that scrambles your data once a secure connection is established, using a shared secret key both sides already know. AES is the world's most-used cipher for this job. It has been studied since 2001 by more cryptographers than almost anything else in the field.

For HAWK, an Anthropic researcher worked with Claude for about a week. Claude found something called a nontrivial automorphism, a hidden symmetry in the math behind HAWK, that let it build a faster attack than anyone had published. The practical result: the "effective keysize" of HAWK dropped in half. A signature scheme's security is usually described in these keysize numbers, and cutting one in half is a big deal even without a working exploit against a live system, because it means you would need to double HAWK's key sizes just to keep the same protection, which erases most of the efficiency reasons anyone wanted to use HAWK in the first place.

For AES, a separate researcher built an automated setup and mostly let Claude run on its own. This part is the more striking story. Claude initially refused to engage, insisting reduced-round AES was too well studied to improve on. Anthropic published the actual back-and-forth, typos included, and it reads less like debugging a tool and more like managing a stubborn junior researcher. After a researcher pushed back with messages like "we want to find new attacks," not incremental tweaks, Claude spent close to three days and roughly a billion tokens of output before landing on a technique it named the Möbius Bridge. The payoff: an attack against 7-round AES that is 200 to 800 times faster than the previous best published method.

Both results cost about $100,000 in API usage to produce, and both went through outside review before publication. Anthropic looped in the HAWK authors directly, consulted academic cryptographers, and briefed government and industry partners ahead of release.

No, not today. Both findings are exactly the kind of stress-testing cryptography is supposed to get before anything ships widely. HAWK is not deployed anywhere yet, that is the entire point of NIST's review process, and the AES attack does not touch the real 10-round cipher your devices use. Anthropic itself frames this as the system working correctly: find the weak spots before attackers do.

What is worth paying attention to is the trend line, not just today's two cryptographic weaknesses. A year ago, language models could barely attempt basic cryptanalysis. Now one has matched or exceeded expert-level attacks on algorithms that survived years of dedicated human review, including a case where Claude fully autonomously discovered a novel technique with almost no researcher guidance beyond "keep trying, do not settle for an easy answer." Anthropic says it has already found smaller improvements against other ciphers, including Salsa20, SHA-1, and a lightweight cipher called LEA, and plans to keep going.

Does this affect my passwords or banking security right now? No. Neither attack applies to any cryptography currently protecting real systems. HAWK is unreleased and AES was only attacked in a weakened 7-round test version, not the full cipher your devices actually run.

What model did this work? Claude Mythos Preview, a research-focused model Anthropic built with extra capability for security and cryptography tasks, working semi-autonomously with human researchers guiding direction but not writing the math themselves.

How much did it cost to produce these results? Anthropic says each of the two main results cost roughly $100,000 in API usage, plus hundreds of researcher-hours spent verifying the math was correct.

Is AES itself broken now? No. The attack only works against a reduced 7-round version of AES-128, used by researchers to study attack techniques. The full 10-round cipher used in real systems was not touched.

Where can I read the technical details? Anthropic published full papers on both the HAWK attack and the AES result, along with the raw chain-of-thought transcript Claude produced while discovering the AES technique.