AI Is Accelerating Cryptanalysis — and PQC Programs Need to Adapt

A new variable in cryptographic research

Anthropic's Claude Mythos Preview has demonstrated that frontier AI systems can contribute to advanced cryptanalysis, not simply automate known techniques. According to research reported by Decrypt, the model identified a previously unknown attack on HAWK, a post-quantum digital-signature scheme being evaluated in NIST's additional signature competition.

For HAWK's smallest parameter set, the reported attack reduced the estimated work required for secret-key recovery from 2⁶⁴ operations to 2³⁸. The proposed mitigation would require substantially larger keys, changing some of the efficiency characteristics that made the candidate attractive.

This does not mean deployed cryptography suddenly failed

The distinction is important. HAWK is a candidate under evaluation, not a deployed NIST PQC standard. The same research also improved attacks against a seven-round research version of AES; production AES-128 uses ten rounds and was not broken. These results are therefore not evidence that today's deployed AES or standardized PQC algorithms have been compromised.

In fact, finding weaknesses during open evaluation is part of how cryptographic standardization is supposed to work. What is new is the apparent research velocity: AI systems may help explore mathematical attack paths, test hypotheses, and iterate through possibilities much faster than traditional human-only workflows.

What this means for PQC programs

• Follow NIST standardization and cryptanalysis continuously rather than treating algorithm selection as a one-time decision.
• Avoid hard-coding cryptographic choices deep into applications and infrastructure.
• Design hybrid and crypto-agile architectures that can absorb future standards changes.
• Maintain an accurate inventory of cryptographic dependencies so affected systems can be located quickly.
• Build validation and interoperability testing into the migration lifecycle.

Quantum computing remains the central reason organizations must replace vulnerable public-key cryptography. AI-assisted cryptanalysis adds a second reason to modernize the way cryptography itself is governed: the assumptions underlying today's choices may evolve faster than enterprise change cycles.