Anthropic's AI model ends HAWK's bid to become a NIST post-quantum standard
Anthropic's Claude Mythos Preview found a weakness in HAWK, a post-quantum signature scheme NIST was weighing for standardization. Anthropic said the model needed 60 hours where human review had run two years, and NIST says HAWK's team has since withdrawn it.
Context for builders, not their beat.
Exposure map: HAWK's team withdrew it, so it won't be standardized. ML-KEM and ML-DSA are unaffected. NIST still evaluates backup candidates. Anthropic says each result cost roughly $100,000 in API fees. Organizations should apply NIST's standards now. No production software must change.
- Who has to decide decision HAWK development team Withdrew HAWK from consideration; it will not be standardized or deployed, claim 12
- What it limits constraint ML-KEM and ML-DSA Not affected: NIST's finalized standards rely on different mathematical foundations that remain secure, claim 13
- Who's exposed exposure Remaining backup candidates NIST is still evaluating additional algorithms that could one day serve as backup standards, claim 14
- What it costs cost Anthropic Each result cost roughly $100,000 in API cost to develop, claim 7
- Who has to decide decision Organizations migrating to PQC Should begin applying NIST's post-quantum standards now to migrate to quantum-resistant cryptography, claim 16
- What it limits constraint Production software No practical impact on today's systems; no production software will have to change, claim 9
| Who | How | Kind | Claim |
|---|---|---|---|
| HAWK development team | Withdrew HAWK from consideration; it will not be standardized or deployed | decision | 12 |
| ML-KEM and ML-DSA | Not affected: NIST's finalized standards rely on different mathematical foundations that remain secure | constraint | 13 |
| Remaining backup candidates | NIST is still evaluating additional algorithms that could one day serve as backup standards | exposure | 14 |
| Anthropic | Each result cost roughly $100,000 in API cost to develop | cost | 7 |
| Organizations migrating to PQC | Should begin applying NIST's post-quantum standards now to migrate to quantum-resistant cryptography | decision | 16 |
| Production software | No practical impact on today's systems; no production software will have to change | constraint | 9 |
What happened
- Anthropic said the attack improved on the best-known attack against HAWK and effectively cut the scheme's key strength in half.
- One Anthropic researcher worked with the model over a week to develop the HAWK attack, which Anthropic said was achieved mostly autonomously.
- A second result, found fully autonomously, sped up the best previous attacks on a weakened, round-reduced version of AES by 200 to 800 times.
- NIST said the HAWK finding does not touch its finalized standards ML-KEM and ML-DSA, which rest on different mathematical foundations that remain secure.
Why it matters
- What it costs cost Retiring a NIST candidate cost Anthropic roughly $100,000 in API fees per result, a sum within reach of any well-funded team that wants to attack the candidates still under review.
- What it sets up precedent NIST is still evaluating backup signature algorithms, and we'd expect the remaining candidates to face the same model-driven attacks before any of them is picked.
- Who has to decide decision Organizations planning post-quantum migration keep the same targets and timetable, since NIST still tells them to start applying its finalized standards now.
- What doesn't add up contradiction NIST's page calls Anthropic's tool "a super intelligence (SI) model", stronger language than Anthropic's own account of a preview model working alongside a researcher.
Sixty hours is model time, and two years is calendar time spent by human reviewers across two rounds [3][4], so dividing one by the other overstates the gain. Elapsed time is the fairer comparison. One Anthropic researcher worked with the model over a week [6], against roughly 104 weeks of review, a compression of about a hundredfold [18]. Each of Anthropic's two results cost roughly $100,000 in API fees [7], or about $200,000 together [19]. NIST's finalized post-quantum standards, for scale, came out of an eight-year effort [15].
Neither source records cryptographers disagreeing about the result. Anthropic says no production software has to change [9], and NIST says ML-KEM and ML-DSA rest on different mathematics that remain secure [13]. The difference is vocabulary. NIST's page, which dates Anthropic's announcement to July 28, 2026, describes the tool as "a super intelligence (SI) model" [11]; Anthropic calls it Claude Mythos Preview and says it worked mostly autonomously [1][17].
Model-driven attacks may stay confined to unstandardized candidates and weakened ciphers, as both of these results are [8][9]. Alternatively, the follow-up attacks Anthropic says it began finding after widening its search [10] may reach something deployed. Or the main effect falls on how NIST reviews, with candidates run through models before each round. We think the third comes first, because NIST is still evaluating backup algorithms [14] and its page still tells organizations to migrate now [16]. The counter-case is that two results from one lab is a sample of two. A model-found attack on full AES or on ML-DSA would put the risk in deployed systems.
What to watch
- Whether Anthropic publishes the follow-up attacks it says it began finding, and whether any of them targets a deployed algorithm.
- Whether NIST adds model-driven cryptanalysis to its review of the backup signature candidates before the next selection.
- Any model-found attack on full AES, ML-KEM or ML-DSA, which NIST says rest on foundations that remain secure.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Using Claude Mythos Preview, Anthropic researchers discovered an improved attack on HAWK, a digital signature scheme built for a post-quantum world.
- [2]
HAWK is one of the third-round candidates under consideration from NIST's 2022 call for additional cryptographic systems that would remain secure against quantum computers.
- [3]
HAWK had survived two rounds of expert human review over a period of two years.
- [4]
Mythos was able to improve the best-known attack on HAWK in just 60 hours of work.
- [5]
The improved attack on HAWK effectively cut its key strength in half.
- [6]
Over the course of a week, one Anthropic researcher worked together with Claude to develop the HAWK attack.
- [7]
Each of the results cost roughly $100,000 in API cost to develop.
- [8]
Mythos found a way to break a weaker, round-reduced version of AES, improving the speed of the previous best attacks by 200-800x; another researcher built a scaffold that let Claude discover the AES attack fully autonomously.
- [9]
Neither result has a practical impact on today's computer systems; no production software will have to change. HAWK is only a candidate and the AES attack does not break the full cipher.
- [10]
After seeing these results, Anthropic broadened its search and began to discover other attacks.
- [11]
On July 28, 2026, Anthropic announced that it used "a super intelligence (SI) model" to discover a vulnerability in HAWK, a lattice-based digital signature algorithm under consideration for standardization.
- [12]
The HAWK development team subsequently withdrew its algorithm from consideration, and it will not be standardized or deployed.
- [13]
The finding does not affect NIST's finalized PQC standards, such as ML-KEM and ML-DSA, which rely on different mathematical foundations that remain secure.
- [14]
NIST continues to evaluate additional algorithms that could one day serve as backup standards.
- [15]
NIST's post-quantum FIPS standards were developed through an eight-year effort managed by NIST.
- [16]
Organizations should begin applying NIST's post-quantum standards now to migrate their systems to quantum-resistant cryptography.
- [17]
Mythos Preview achieved these results mostly autonomously and mostly without human intervention.
- [18]
Two years of human review is roughly 104 weeks, about a hundredfold more elapsed time than the one researcher-week Anthropic spent on the HAWK attack.
- [19]
Anthropic's two cryptography results cost about $200,000 in API fees together.
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- nist.govDec 3Post-quantum cryptography | NIST
- anthropic.comJul 28Discovering cryptographic weaknesses with Claude \ Anthropic