Read this first
Anthropic said its Claude Mythos Preview model spent about 60 hours working semi-autonomously, with access to Python, Sage, and the published literature, and found a nontrivial automorphism in the lattice underlying HAWK, a signature scheme in the third round of NIST's additional-signatures standardization process. The automorphism reduces key recovery to a shortest-vector problem in a lattice of roughly half the original dimension. For the smallest parameter set, HAWK-256, that pushed the estimated key-recovery cost from about 2^64 operations down to about 2^38, a genuine break at that size. The HAWK team withdrew the scheme from NIST's process rather than patch it. ML-KEM (FIPS 203), ML-DSA (FIPS 204), and SLH-DSA (FIPS 205), the standards already finalized and ready to deploy, rest on different mathematical foundations and are not affected.
On July 28, 2026, an entry quietly changed status on NIST's list of active additional-signature candidates. HAWK, a lattice-based scheme that had survived two rounds of public scrutiny, is now marked withdrawn. Its own authors pulled it, within days of Anthropic disclosing that an AI model had found a weakness two years of human cryptanalysis had missed.
What Mythos actually found
HAWK's lattice has a symmetry, an automorphism, that nobody had exploited before. Claude Mythos Preview found it and used it to construct what its authors call a cocycle lattice from the public key, then applied lattice reduction and sieving to recover a short vector and rebuild a working secret basis, one that can forge signatures for the original public key. The effect of the automorphism is to cut the dimension of the lattice problem an attacker has to solve roughly in half, and halving a lattice dimension does not halve the attack cost, it collapses it.
For HAWK-256, the smallest parameter set, that took the estimated key-recovery cost from around 2^64 operations to around 2^38, well inside what a modern cluster can grind through. Reporting on the disclosure put the larger parameter sets, HAWK-512 and HAWK-1024, in a similar bind: security margins fell sharply under the same gate-count model even though full key recovery at those sizes remains out of practical reach today. A margin that thin is not something a standards body carries into a final draft.
Why the team withdrew instead of patching
The HAWK team's own assessment, according to the disclosure, was that the straightforward fixes, doubling parameters or moving to a higher-rank module, would make the scheme uncompetitive with the signature candidates it was supposed to be racing. A patched HAWK with a comfortable margin would cost more in signature size or speed than rivals already in the process. Rather than carry a scheme that had lost its reason for existing, its authors withdrew it. NIST's additional-signatures track exists precisely to stress-test candidates like this before one gets promoted to a standard, and this is what that process looks like when it works.
What this does not touch
It is worth being precise about the blast radius, because the headline invites overreach. HAWK was never a finalized standard, it was a third-round candidate in NIST's process for signature schemes beyond ML-DSA and SLH-DSA. The algorithms already finalized and namable in a procurement document, ML-KEM (FIPS 203) for key establishment and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for signatures, rest on different structures (module-LWE and module-SIS for the first two, hash-based for the third) that do not share HAWK's lattice symmetry. Nothing in this disclosure changes the 2030 and 2035 deadlines for retiring RSA and elliptic-curve cryptography, and nothing in it argues for pausing a migration built on the finalized standards.
The real story: cryptanalysis at agent speed
What should hold your attention is less HAWK than Mythos. A model working semi-autonomously, with tooling and literature access but without a human directing each step, found in about 60 hours a structural weakness that two years of open review, by cryptographers whose job is exactly this, did not surface. That changes the planning assumption for anything still in a standardization pipeline: the interval between a candidate's publication and a serious attack on it can now be measured in days of compute rather than years of conference cycles. It does not change the assumption for algorithms already finalized and widely reviewed, but it raises the bar for what counts as sufficiently reviewed before you build on something new.
The point
The point
HAWK's withdrawal is the standardization process doing its job, catching a weak candidate before it ships, not a crack in the post-quantum standards you should already be deploying. The part worth carrying forward is the clock: AI-assisted cryptanalysis just cut the review runway for an experimental scheme from years to hours. If you are building against anything short of a finalized FIPS standard, HAWK is the reminder that the ground under it can move fast.
For a migration in progress, the practical read does not change: ML-KEM and ML-DSA are the finalized standards to build on, and the work that matters is still finding where your systems run the algorithms they replace. That starts with a cryptographic inventory, not with waiting to see which additional signature scheme survives the next round.
References
- Discovering cryptographic weaknesses with Claude (anthropic.com) - Anthropic's disclosure of the HAWK finding.
- HAWK-n key recovery reduces to SVP in dimension n/2 + 1 (list.nist.gov, pqc-forum) - the technical writeup posted to NIST's PQC forum.
- Post-Quantum Cryptography news (csrc.nist.gov) - NIST's PQC project page, tracking the additional-signatures process HAWK was withdrawn from.
- quantakrypto: NIST's 2030 and 2035 deadlines - the timeline this disclosure does not change.
- quantakrypto: build a CBOM with qScan - the inventory step every migration still starts with.