Claude Mythos Found Two Cryptographic Attacks. Only One of Them Was Cheap to Check.

Anthropic published both results on the same day. One took 60 hours end to end. The other took two researchers nearly a month just to confirm it was real.

Anthropic's Frontier Red Team published two cryptanalysis results on July 28, and the interesting number in that post is not the attack strength. It is the clock.

The first result is an improved key-recovery attack on HAWK, a third-round NIST post-quantum signature candidate. Claude Mythos Preview found a nontrivial automorphism in HAWK's lattice that two years of expert review had not located, cutting the expected cost of attacking HAWK-256 from 2^64 down to 2^38. Finding it, developing it, and verifying it took about 60 hours in total.

The second result improves an attack on 7-round AES-128 by a factor of 200 to 800, using a fingerprinting technique the model named a Möbius Bridge. Mythos produced that idea in roughly three days of near-autonomous work. Anthropic's own post then says this: "it took two researchers nearly a month to gain confidence that the method it discovered is correct."

Same model. Same week. Same team. One result closed in 60 hours; the other consumed several hundred human hours of catch-up study after the model was already done. That gap is the story, and it is not about cryptography.

The finding is not the expensive part anymore

The industry has spent two years asking whether models can produce genuinely new technical work. That question is now boring. Mythos produced research-grade cryptanalysis on the most-studied block cipher in existence, and Anthropic paid roughly $100,000 in API cost per result to get it. At that price, discovery is a line item.

Verification is not a line item. It is people, and it is calendar time, and it does not compress when you buy more tokens.

Anthropic says this directly in the conclusion, and it is worth reading twice: "human researchers may become bottlenecked on studying and validating these results for technical validity, novelty, and utility." They also note the same thing is already happening in vulnerability triage, where models find so many bugs that human processes struggle to keep up.

So the question builders should be asking has changed. Not "can my agent find something." It can. The question is what it hands you when it does, because that determines whether the finding costs you an afternoon or a month.

Runnable results verify cheaply. Arguments do not.

Compare the two artifacts.

The HAWK attack is implementable end to end. Anthropic shipped demonstration code that runs the attack. Better than that, Mythos built its own end-to-end verification pipeline as part of the work, specifically to convince itself and the human operator that the attack was correct. You do not need to follow the lattice argument if you can watch the key come out.

The AES result is an analytical improvement to a meet-in-the-middle attack. There is no runnable break, because the prior work it extends assumes an attacker can request 2^105 chosen plaintexts. Nobody is running that. The claim is a chain of reasoning about how much work an attacker saves, and the only way to check a chain of reasoning is for a human to learn enough to follow it. Two researchers, neither of them cryptographers, spent several hundred hours doing exactly that.

Anthropic then supplies the control case without meaning to. Further down the post they describe a newer attack on 13-round LEA that recovers a key in under 2^30 plaintexts and runs in under an hour on a desktop. Their comment: "Because this attack actually runs end-to-end (as the HAWK attack did) we are much more confident in its correctness: we can choose a random key, and verify that this attack recovers it in just a few hours."

Three findings from one team. The two that execute were confirmed in hours. The one that only argues took a month. Verifiability turns out to be a property of the artifact, not a property of the reviewer or the model.

That is a general result, and it has nothing to do with lattices. A migration script either migrates the database or it does not. A performance claim either survives your benchmark or it does not. A patch either makes the failing test pass or it does not. Those verify in minutes. An architecture recommendation, a threat model, a security review that says "this looks fine," a claim that some refactor is safe: those verify at human reading speed, forever, and your agent can produce them faster than you can read them.

Put this into practice

The lowest-friction version of this is one sentence you add to the way you ask.

Ask for the check alongside the claim. Instead of "find performance problems in this service," ask for "a failing benchmark that demonstrates each problem, then the fix that makes it pass." You are not asking the model to work harder. You are asking it to spend its cheap tokens producing the thing that makes your expensive time short. Mythos did this on its own for HAWK, and that is exactly why HAWK closed in 60 hours.

Sort findings by how they verify before you read any of them. Two buckets. Bucket one: things with a reproduction, a test, a script, a diff, a command you can run. Bucket two: things that are only an argument. Work bucket one first because it is nearly free, and let the size of bucket two tell you how much calendar time this batch actually costs. Most people read top to bottom by severity and discover the cost halfway through the week.

Budget verification explicitly. If you are giving an agent a long autonomous run, decide in advance how many hours of human review you are willing to spend on the output. Then size the run to fit that, not to fit your token budget. An overnight run that generates forty findings you cannot check is worse than a two-hour run that generates six you can.

Do not accept "I verified it" from the same agent that produced it. Mythos built a verification pipeline, and that pipeline was still checked by a person before anyone believed it. A self-graded result is a hypothesis with better formatting. The useful version is the agent building a harness you can run yourself, which is a different deliverable than the agent telling you it passed.

Notice when a domain has no runnable form. Security architecture review, dependency risk assessment, "is this API design going to hurt us," compliance mapping. These are exactly the areas where agents produce confident volume and where verification cost per item is highest. That is not a reason to avoid them. It is a reason to run smaller batches there and larger batches where a test can settle the argument.

What this does not prove

Plenty, and it is worth being specific.

This is one company's self-report about its own model, published as part of a capability announcement. Anthropic has an obvious interest in the framing, and none of the three data points here were reproduced by an outside team. They also disclose that the two researchers who spent a month on the AES claim were not cryptography experts, so some of that month is a story about the reviewers rather than the artifact. A working cryptanalyst might have moved faster. Probably not thirty times faster, but the number is not clean.

Runnable is also not the same as correct. A demo that recovers a key proves the attack works on the case in the demo. It does not prove the paper's complexity analysis, its parameter claims, or its generality. Executable verification buys you a strong floor, not a proof, and the honest version of my argument is that it collapses the cost of catching an outright wrong result while leaving the cost of catching a subtly overstated one roughly where it was.

The economics are also not yours yet. Each of these results cost about $100,000 in API spend, and Anthropic notes that many autonomous sessions produced nothing at all, so the headline token counts describe the path that worked rather than the total bill. And the AES attack targets 7 of 10 rounds under a threat model requiring 2^105 chosen plaintexts. Neither result touches a deployed system, which Anthropic states plainly and repeatedly.

One more caveat that cuts against my own framing: some of the most valuable work has no executable form and never will. Nobody has a unit test for whether a cryptographic design is elegant, or whether a system boundary is drawn in the right place. Demanding runnable artifacts everywhere would push your agents toward the problems that are easy to check, which is a real way to end up with a lot of verified, unimportant output.

The number to carry around

Two researchers. Nearly a month. One result.

That is the price tag on a machine-generated claim that cannot be executed, from a team with strong incentives to make the number look small. Anthropic also partnered with academics at ETH Zurich, Tel Aviv University, and the University of Haifa to release CryptanalysisBench so others can track this capability, which suggests they expect the discovery side to keep getting cheaper.

The discovery side getting cheaper is not the constraint you will feel. The constraint you will feel is the stack of findings on your desk that nobody has confirmed, growing faster than your team reads. You get to decide right now whether your agents hand you things that argue or things that run. That choice sets the size of the stack.

Sources: Anthropic Frontier Red Team, "Discovering cryptographic weaknesses with Claude" (July 28, 2026); HAWK key recovery paper; AES Möbius Bridge paper; demonstration code; CryptanalysisBench, arXiv 2607.18538; HAWK specification, NIST PQC additional signatures.