Sixty Hours of AI Cryptanalysis Retired the Hawk Signature Scheme
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · August 9, 2026.
On July 28, Anthropic's Frontier Red Team published a result the cryptographic community had been told to expect and had never actually seen: a frontier AI model producing a genuinely new attack on a serious cryptographic design. Working across roughly 60 hours with a single researcher supervising, the company's Claude Mythos Preview model found a hidden symmetry, a nontrivial automorphism, in the lattice structure underneath Hawk, a digital signature scheme then in the third round of the United States National Institute of Standards and Technology's search for additional post-quantum signatures. Exploited properly, that symmetry cuts the scheme's effective security level in half.
The consequence arrived within a day. On July 29 the Hawk team withdrew the scheme from the NIST process, posting the decision to the standards body's public mailing list after confirming that the attack roughly halves the block size an attacker needs in lattice reduction, the workhorse technique against designs of this family. Hawk had entered the competition in 2023 and cleared two selection rounds of open expert review. The design team, ten cryptographers drawn from NXP Semiconductors, CWI Amsterdam, Leiden University, NCC Group, PQShield and the University of Bordeaux, had built a scheme prized for its engineering economy: signatures in 555 bytes, signing and verification in a tenth of a millisecond, no floating-point arithmetic, 14 kilobytes of RAM. Three years of human scrutiny had left its security estimate standing. Sixty hours of machine attention ended it.
A defense reader should sit with that sentence, because cryptanalysis is a military capability with a long institutional history, and the instrument that performs it just changed hands. What follows is what the published record establishes, what it does not, and how a program office should read both.
What the model actually found
The concrete demonstration ran against Hawk-256, a deliberately weakened challenge parameter set the designers published for exactly this kind of testing. Against it, the new attack drops the expected cost of recovering a private key from 2^64 operations to about 2^38, a figure The Hacker News reports as under four hours of running time on a 96-core commercial server. The production parameter sets, Hawk-512 and Hawk-1024, were never broken in that direct sense. The attack stays exponential in character, and the mathematical foundation of lattice cryptography stands. What the automorphism removes is margin: a scheme sized to a given security level now delivers roughly half of it, and a candidate whose appeal rested on small keys and small signatures cannot simply double its dimensions and remain itself. The withdrawal followed from that arithmetic.
Anthropic's own account is careful about the division of labor. On the Hawk work, the model operated semi-autonomously inside a scaffold with access to Python, the Sage computer-algebra system and the published literature, while one researcher supplied guidance the write-up describes as project management. A companion result against a reduced version of the Advanced Encryption Standard ran harder in the autonomous direction: over three days and roughly one billion generated tokens, the model improved a classical meet-in-the-middle attack on seven of AES-128's ten rounds by a factor of 200 to 800. That result is theoretical, requiring around 2^105 chosen plaintexts, and touches no deployed system. Each effort consumed roughly 100,000 dollars in compute, and checking the machine's claims cost Anthropic's researchers several hundred hours across nearly a month. Disclosure was orderly: the Hawk authors received the attack in June, government and industry partners saw advance copies, and publication was coordinated with the public posting to NIST's forum.
Quantum pillar: post-quantum cryptography (cryptanalysis of PQC candidates). Use posture: offensive. Technology readiness: TRL 3 of 9. The attack ran end to end as working software, recovering a Hawk-256 challenge key on a commercial server, though it has produced no validated break of the scheme's production parameter sets.
Cryptanalysis at machine speed
Read as capability, this development belongs on the offensive side of the ledger, and the readiness line above says so. The value demonstrated lies in breaking cryptography: finding, in a design an adversary relies on, a weakness its authors and reviewers missed. That the first documented use was constructive, feeding a public standards process and harming no fielded system, describes the user's intent rather than the tool's character. AI-assisted cryptanalysis is now a published, reproducible working method, and every organization able to rent frontier-model access and a hundred thousand dollars of compute can attempt it against targets of its own choosing.
That diffusion is the strategic point. Deep cryptanalytic benches have historically been the possession of a handful of signals-intelligence agencies, built over decades and closely held. A method that lets a modest team direct machine attention at a published cipher, a proprietary radio waveform's key schedule, or a competitor nation's national algorithm lowers the entry price of a capability that used to be scarce. The published results also mark its current ceiling honestly. Both findings improve exponential attacks; neither is the kind of polynomial break that retires a cipher outright. The model needed a human-built scaffold, curated literature and a supervisor. Above all, verification remains the bottleneck: a plausible-looking attack is worthless until confirmed, confirmation consumed hundreds of expert hours, and a force that cannot check machine mathematics at that standard gains little from generating it. The capability today is a fast hypothesis engine bolted to a slow, human proof obligation.
The near-term military uses on both sides are auditing tasks rather than code-breaking drama. Fielded defense systems carry decades of proprietary and legacy cryptography, in tactical radios, telemetry links and identification systems, much of it never exposed to sustained academic review. A machine method that reads a specification and searches for structural weakness gives its owner a way to triage that estate. A defender ranks its own inventory by fragility and schedules replacements; an adversary performs the same ranking on the systems it observes and the traffic it has already collected. Neither use requires a full break, because a halved security margin is often enough to move a target from infeasible to merely expensive.
For the defender the same instrument points the other way. The Hawk episode is, on its face, the vetting process succeeding: a weakness surfaced during evaluation, before a single system shipped with the scheme inside. Standards bodies, certification laboratories and national security agencies now have an affordable way to stress designs harder than volunteer academic attention ever managed. It is reasonable to expect the remaining candidates in NIST's signature on-ramp, and future national submissions elsewhere, to face deliberate machine adversaries before selection rather than after deployment.
What stands between this result and a program office
The immediate procurement facts are stable. The standards NIST finalized in 2024, ML-DSA, SLH-DSA and the pending FN-DSA, are unaffected by the automorphism, and Anthropic states plainly that no production software has to change. Migration timelines published by national authorities stand. A buyer mid-transition to post-quantum cryptography should keep moving; the event supplies no reason to pause and one strong reason to hurry, since the attacking side of the field is accelerating too.
The sharper lessons sit one level up. First, the episode prices the risk of fielding pre-standard cryptography. Hawk was attractive engineering, and a program that had baked it into a long-life platform ahead of standardization would today own a fleet-wide remediation. The readiness distinction between a candidate under evaluation and a qualified standard exists precisely for this failure mode. Second, the loss of the only lattice-based signature candidate in NIST's additional round strengthens the case the agency itself had been making: its signature on-ramp, which announced third-round candidates on May 14, 2026, was explicitly weighted toward schemes resting on assumptions other than structured lattices, so that one mathematical surprise cannot sweep the whole portfolio. Diversity of assumptions has moved from a theorist's preference to a demonstrated hedge. Third, the working answer to attacks that arrive at machine speed is crypto-agility: an inventory that knows where every algorithm lives, and a swap path that runs in months. The organizations that absorbed the Hawk news calmly were the ones for whom an algorithm was already a replaceable part.
What should a reader watch next? Whether the automorphism technique, or a successor, tightens against Hawk's production parameters or reaches other lattice designs, which would convert a margin story into a break story. Whether independent teams reproduce machine-found attacks on the surviving on-ramp candidates, which would confirm the method generalizes beyond one scheme and one model. And whether evaluation bodies begin publishing machine-adversary results as a routine part of certification, which would mark the defensive absorption of this capability. The instrument is now on the table for both sides. The standards in the field survived their first machine adversary; the candidate pool did not come through whole, and the honest conclusion for a buyer is that the vetting got stronger at exactly the moment the attackers did.
Sources
Primary source: Anthropic's Frontier Red Team, "Discovering cryptographic weaknesses," July 28, 2026; other material from the Hawk design team's site, the NIST additional digital signatures project page, and The Hacker News's report and withdrawal update.